950784 - Need automatic hsts preload list updates on any branches based on Gecko 18 and later

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Since bug 800444, we expire the hsts preload list after 18 weeks since its last update. That means that any branch since then needs to periodically update the list using the automated mechanism we have set up.
(see also bug 948004)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Attachment: enable hsts updates on all gecko branches >=18

Look OK to you, David? I left the v1.1hd branch of b2g18 off because that receives merges from the regular b2g18 branch anyway.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8362105 [details] [diff] [review]
enable hsts updates on all gecko branches >=18

Review of attachment 8362105 [details] [diff] [review]:
-----------------------------------------------------------------

I think I was a little confused when I filed this bug. The issue is branches that are around for a long time (like esr) definitely need this update to happen. However, I also recall making the decision to not enable this for beta to prevent last-minute changes that may cause compatibility issues. Since it is enabled on aurora and we move the trains every 6 weeks, the list won't ever expire on beta (or release, for that matter).
Long story short: I don't think we actually want to enable this for beta, but I don't know enough about the b2g trains to say whether they need it or not. Hopefully this explanation tells you what you need to know, though.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Does B2G make use of HSTS? Because the support time for the releases isn't ESR-length, but still much longer than desktop. If it does, I think we should do the updates.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

(In reply to Ryan VanderMeulen [:RyanVM UTC-5] from comment #3)
> Does B2G make use of HSTS? 

As far as I can tell, yes.

> Because the support time for the releases isn't
> ESR-length, but still much longer than desktop. If it does, I think we
> should do the updates.

Sounds good.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Attachment: enable hsts updates on b2g branches >=18

Per comment 4.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8363096 [details] [diff] [review]
enable hsts updates on b2g branches >=18

https://hg.mozilla.org/build/buildbot-configs/rev/62eac305a67c

Comment 7

[John Hopkins (:jhopkins)]

in production.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Hrm, it appears to have worked on b2g26 but not b2g18?

Comment 9

[Phil Ringnalda (:philor)]

http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-b2g18-linux64/mozilla-b2g18-linux64-hsts-bm64-build1-build0.txt.gz

Comment 10

[Ryan VanderMeulen [:RyanVM]]

What, you mean we don't post a latest b2g18 build?! Shocking :)

Anyway, I think attempts to do this automatically on that branch are going to be futile, so I went ahead and did a manual update.
https://hg.mozilla.org/releases/mozilla-b2g18/rev/fb89776dd0c1

I'll post a patch here for disabling them again.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Attachment: disable HSTS updates on b2g18

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8366673 [details] [diff] [review]
disable HSTS updates on b2g18

https://hg.mozilla.org/build/buildbot-configs/rev/96b9f5e3f48b

Comment 13

[Aki Sasaki (not active)]

In production.