This is part of my deliverable for this quarter. Related issue: https://github.com/armenzg/mozilla_ci_tools/issues/147 It seems that I'm having some authorization issues [1]. I thought that I would need to login first [2] but it doesn't do the trick. garndt: what do I need to make this work? I'm going to look for a try push instead of triggering something on m-c. [1] mozilla-inbound hg:[default!] $ ./mach taskcluster-build --head-repository http://hg.mozilla.org/mozilla-central --head-rev tip --owner garndt@mozilla.com tasks/builds/b2g_emulator_jb_opt.yml | taskcluster run-task --verbose Message: Authorization Failed Error: {"info":"None of the scope-sets was satisfied","scopesets":[["docker-worker:cache:tc-vcs","docker-worker:image:taskcluster/builder:0.5.5","queue:define-task:aws-provisioner-v1/build-c4-2xlarge","queue:create-task:aws-provisioner-v1/build-c4-2xlarge","docker-worker:cache:workspace-emulator-jb-opt"]]} Error: Authorization Failed at /usr/local/lib/node_modules/taskcluster-cli/node_modules/taskcluster-client/lib/client.js:206:23 at /usr/local/lib/node_modules/taskcluster-cli/node_modules/taskcluster-client/node_modules/promise/lib/core.js:33:15 at flush (/usr/local/lib/node_modules/taskcluster-cli/node_modules/taskcluster-client/node_modules/promise/node_modules/asap/asap.js:27:13) at process._tickCallback (node.js:355:11) [2] * taskcluster login ** web browser is opened * sign in with persona * click on "grant access" for those temp credentials > Saved credentials in: /Users/armenzg/Library/Application Support/taskcluster-cli/credentials.json

adusca in bug 1174313 garndt is going to look into generating what platforms would get triggered for a specific branch. We could then pick platforms and turn it into the try syntax that would be required to trigger it. This is related to what we spoke about wrt to TC. Once we have the right try syntax we could give it to --message [1] Unfortunately, the process of granting the right scope (privileges) to the temporary credentials that TaskCluster gives every user is not something that we think we should mainstream. We might give the privileges to a bot and build something like self-serve but for TC and give to it the right scope. We will see. ./mach taskcluster-graph --pushlog-id=74130 --project=try '--message=try: -b do -p all -u all -t none' --owner=joliu@mozilla.com --revision-hash=34641445d25efac3d4d6110ce0b6d81d2d15a14e --extend-graph

I believe this error might have been caused by missing image scopes. I added scopes for our public docker hub account which should get you 75% of the way there but there are a few tasks that use private images that we should not give scopes for. I updated our authentication manager and it should take about an hour for things to refresh. You probably need to log out and log back in.

I tried again (without calling taskcluster-login again) [1] After I logged in again, I got this new error [2] garndt: do you hit the same issue? [1] ./mach taskcluster-build --head-repository http://hg.mozilla.org/try --head-rev eeda604378cb --owner armenzg@mozilla.com tasks/builds/b2g_emulator_jb_opt.yml | taskcluster run-task --verbose Message: Authorization Failed Error: {"info":"None of the scope-sets was satisfied","scopesets":[["docker-worker:cache:tc-vcs","docker-worker:image:taskcluster/builder:0.5.5","queue:define-task:aws-provisioner-v1/build-c4-2xlarge","queue:create-task:aws-provisioner-v1/build-c4-2xlarge","docker-worker:cache:workspace-emulator-jb-opt"]]} Error: Authorization Failed at /usr/local/lib/node_modules/taskcluster-cli/node_modules/taskcluster-client/lib/client.js:206:23 at /usr/local/lib/node_modules/taskcluster-cli/node_modules/taskcluster-client/node_modules/promise/lib/core.js:33:15 at flush (/usr/local/lib/node_modules/taskcluster-cli/node_modules/taskcluster-client/node_modules/promise/node_modules/asap/asap.js:27:13) at process._tickCallback (node.js:355:11) [2] MacAir mozilla-inbound hg:[default!] $ ./mach taskcluster-build --head-repository http://hg.mozilla.org/try --head-rev eeda604378cb --owner armenzg@mozilla.com tasks/builds/b2g_emulator_jb_opt.yml | taskcluster run-task --verbose Task Created. Task ID: UWOtq0ePTwuCDz8GEqQ31A Task State: Pending events.js:85 throw er; // Unhandled 'error' event ^ Error: unable to verify the first certificate at Error (native) at TLSSocket.<anonymous> (_tls_wrap.js:929:36) at TLSSocket.emit (events.js:104:17) at TLSSocket._finishInit (_tls_wrap.js:460:8)

Ignoring the errors, it looks like this worked (there is a task ID returned). If you open up that task ID in the task inspector, the task completed successfully. I entered bug 1174800 for investigating the error you're seeing. When running with '--verbose' the live log should be streamed back to your terminal, but clearly that's not happening. Probably related to the secure live logging we're doing now.

As garndt indicates it, we can see the task in here: https://tools.taskcluster.net/task-inspector/#UWOtq0ePTwuCDz8GEqQ31A/0 garndt: why does this task does not show up on Treeherder? https://treeherder.mozilla.org/#/jobs?repo=try&revision=eeda604378cb&filter-searchStr=taskcluster I can't see any output from the treeherder-client. Should we file a bug for this? The task definition mentions treeherder: https://queue.taskcluster.net/v1/task/UWOtq0ePTwuCDz8GEqQ31A "treeherderEnv": [ "production", "staging" ], On another note, running the command without --verbose ends (after maybe a minute) like this: armenzg@armenzg-thinkpad:~/repos/branches/mozilla-central$ ./mach taskcluster-build --head-repository http://hg.mozilla.org/try --head-rev eeda604378cb --owner armenzg@mozilla.com tasks/builds/b2g_emulator_jb_opt.yml | taskcluster run-task events.js:72 throw er; // Unhandled 'error' event ^ Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE at SecurePair.<anonymous> (tls.js:1370:32) at SecurePair.EventEmitter.emit (events.js:92:17) at SecurePair.maybeInitFinished (tls.js:982:10) at CleartextStream.read [as _read] (tls.js:469:13) at CleartextStream.Readable.read (_stream_readable.js:320:10) at EncryptedStream.write [as _write] (tls.js:366:25) at doWrite (_stream_writable.js:223:10) at writeOrBuffer (_stream_writable.js:213:5) at EncryptedStream.Writable.write (_stream_writable.js:180:11) at write (_stream_readable.js:583:24)

Hi garndt, I want to bring back to this bug the conversation on figurying out how to trigger tasks to here. (in reference to bug 1174313#c9) Logging in again and running the command worked [1] Could you please list in here the scopes that have been added to my account to trigger these? I want to have them at hand for the day we set up something like a self-serve for TC (to be discussed at Whistler). [1] ./mach taskcluster-graph --project try --message "try: -b o -p linux64_gecko -u gaia-build-unit" --base-repository http://hg.mozilla.org/mozilla-central --head-repository http://hg.mozilla.org/try --head-rev 1b891687a19f --owner armenzg@mozilla.com --revision-hash 17e1e266875bf3eda8d80008e3ccb0a2d7796d49 | taskcluster run-graph --verbose

Temporary credentials get the following scopes: queue:* index:* aws-provisioner:* assume:* scheduler:* auth:azure-table-access:taskclusterdev/* docker-worker:cache:* docker-worker:image:taskcluster/* docker-worker:capability:device:loopbackVideo docker-worker:capability:device:loopbackAudio The last 3 are the ones that I needed to add to amke this work.

We figured this out, however, we won't follow up in this approach.

It seems like the revision-hash is now being retrieved in a different way: https://treeherder.mozilla.org/api/project/try/resultset/?revision=06c5d926ab7a