Requirements: 1) master talks to the signing server over https 2) master validates https cert 3) master uses user/password http authentication over https 4) custom step should support multiple signing servers and should retry n times before switching to another server from the list 5) token should be downloaded from master to slave Please, see attached patch.

Comment on attachment 578257 [details] [diff] [review] token generation code Review of attachment 578257 [details] [diff] [review]: ----------------------------------------------------------------- r+ with these fixed ::: process/factory.py @@ +1130,5 @@ > + server_cert = os.path.join( > + os.path.dirname(build.paths.__file__), > + '../../../release/signing/host.cert') > + token = WithProperties('%(basedir)s/build/token') > + nonce = WithProperties('%(basedir)s/build/nonce') I think we can use 'build/token', 'build/nonce' here without properties @@ +1143,5 @@ > + )) > + self.addStep(SigningServerAuthenication( > + servers=self.signingServers, > + server_cert=server_cert, > + s="", this is a bit weird. can we make SigningServerAuthentication use a default empty string? ::: steps/signing.py @@ +114,5 @@ > + def downloadSignature(self, res): > + self.s = res > + StringDownload.start(self) > + > + def interrupt(self, reason='Interrupted'): Should you be calling the base class's interrupt here as well?

* Address comments * l10n repacks work now

* moved token generation after the compile step * tested in staging * keeping r+

Comment on attachment 578686 [details] [diff] [review] token generation code http://hg.mozilla.org/build/buildbotcustom/rev/202dfd424ea1