829415 - Elm nightly MAR files and exes are not being signed correctly

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Brian R. Bondy [:bbondy]]

This is blocking some other elm work, so if you can look into it that would be greatly appreciated!

I think something changed on in build config for the elm branch within the past couple weeks.
This probably happened at the same time as the other OS platforms were added other than just Windows.

We had a different independent bug that was happening before we realized this problem though.
Hence why it's only being reported now.

The MAR files are being signed with the private key associated with /toolkit/mozapps/update/updater/dep1.der
But instead it should be signed with the private key associated with /toolkit/mozapps/update/updater/nightly_aurora_level3_primary.der
I verified that the public key in this cert dep1.der verifies the MAR files.

Also the updater.exe file used to be digitally signed by the level 3 repo only nightly cert (name=Mozilla Corporation, issuer=issuer), but it is now being signed by: name=Mozilla Fake SPC, issuer=Mozilla Fake CA.
This is stopping MozillaMaintenance serive updates from succeeding, but not all updates. The MAR problem is stopping any updates at all from working on elm.

You can see this behavior in the following build:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-01-08-08-31-04-elm/
Which would try to updat eto the latest elm build, but fail because it's expecting the nightly level 3 cert and signed updater.exe by a trusted authority.

Comment 1

[Mike Hommey [:glandium]]

> This probably happened at the same time as the other OS platforms were added other than just Windows.

Note that around that time, bug 780561 landed on elm, iirc. I'm not excluding a breakage from there.

Comment 2

[[e-mail] (:bhearsum)]

Will look into this very soon.

Comment 3

[[e-mail] (:bhearsum)]

Attachment: use nightly signing servers for elm nightlies, like before

bug 819356 broke this.

Comment 4

[[e-mail] (:bhearsum)]

Comment on attachment 701100 [details] [diff] [review]
use nightly signing servers for elm nightlies, like before

Landed this, starting a reconfig very soon. Brian, wait until I close this bug before you start respinning anything.

Comment 5

[[e-mail] (:bhearsum)]

This in production. You can trigger new nightlies anytime now Brian.

Comment 6

[Brian R. Bondy [:bbondy]]

Thanks for the quick resolution!