Closed Bug 910029 Opened 10 years ago Closed 9 years ago

Security Review: Autoland

Categories

(mozilla.org :: Security Assurance: Review Request, task)

Product:
mozilla.org
Component:
Security Assurance: Review Request
Type:
task
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: rail, Assigned: curtisk)

References

Details

Initial Questions:

Project/Feature Name: Autoland
Tracking  ID:657828
Description:
Autoland is a system that scans bugzilla for changes made by authorized people, and reflects those changes into hg.  It interacts with the releng try system to "try" patches and with hg to "land" them into various trees.


Additional Information:
https://mana.mozilla.org/wiki/display/IT/Autoland

Dev branch location: https://github.com/rail/build-autoland/tree/v2 (v2 branch)
Key Initiative: Firefox/Firefox OS
Release Date: 2013-10-23
Project Status: development
Mozilla Data: Yes
Mozilla Related: Bugzilla, LDAP, treestatus.mozilla.org,  hg.mozilla.org, celery cluster (?), Build API, 
Separate Party: No

Security Review Questions:

Affects Products: Yes
Review Due Date: 2013-09-27
Review Invitees: mgervasini@mozilla.com, catlee@mozilla.com
Extra Information:
The initial code (master branch) has been sec reviewed at some point. Since then we decided to simplify the code, switch to Celery as a framework for distributed computing.

Additionally we plan to use message signing (see http://docs.celeryproject.org/en/latest/userguide/security.html#message-signing for the details) to increase security.
Group: mozilla-corporation-confidential
Whiteboard: [triage needed]
Assignee: nobody → sarentz
Whiteboard: [triage needed]
Can we get this done soon please?
Severity: normal → critical
Flags: needinfo?(sarentz)
Assignee: sarentz → nobody
Flags: needinfo?(sarentz)
Assignee: nobody → curtisk
Flags: needinfo?(curtisk)
https://wiki.mozilla.org/Security/Reviews/Autoland
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(curtisk)
Resolution: --- → FIXED
Thanks!
You need to log in before you can comment on or make changes to this bug.