Open Bug 1370612 Opened 7 years ago Updated 1 years ago

repackage and l10n tasks need extra cot verification

Categories

(Release Engineering :: Release Automation: Other, enhancement, P1)

Product:
Release Engineering
Component:
Release Automation: Other
Type:
enhancement

Tracking

(Not tracked)

People

(Reporter: mozilla, Unassigned)

References

(Blocks 1 open bug)

Details

These are non-scriptworkers that can potentially modify artifacts that ship. We assume they're taking the artifacts from the upstream build-signing task; we need to verify.
Depends on: 1362489
We also need this for toolchain tasks. We have extra verification hardcoded for docker image shas, but we need a task-related solution as well.
Priority: -- → P1
Summary: repackage tasks need extra cot verification → repackage and l10n tasks need extra cot verification
(In reply to Aki Sasaki [:aki] from comment #1) > We also need this for toolchain tasks. We have extra verification hardcoded > for docker image shas, but we need a task-related solution as well. bug 1382564 added sha verification for toolchain tasks, which is good. We don't verify the signatures there, however, so we need to doublecheck that the cot artifact wasn't modified before the toolchain tasks ran: ideally this would be verifying an artifact from toolchain tasks that includes shas of the upstream artifacts.
Blocks: 1492618
Assignee: aki → nobody
QA Contact: catlee → gbrown
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.