summaryrefslogtreecommitdiffstats
path: root/taskcluster/gecko_taskgraph/util/signed_artifacts.py
blob: 302a2e09f7e62da2bee769b462bc124384d8974c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
"""
Defines artifacts to sign before repackage.
"""

from taskgraph.util.taskcluster import get_artifact_path

from gecko_taskgraph.util.declarative_artifacts import get_geckoview_upstream_artifacts

LANGPACK_SIGN_PLATFORMS = {  # set
    "linux64-shippable",
    "linux64-devedition",
    "macosx64-shippable",
    "macosx64-devedition",
}


def is_partner_kind(kind):
    if kind and kind.startswith(("release-partner", "release-eme-free")):
        return True


def is_notarization_kind(kind):
    if kind and "notarization" in kind:
        return True


def is_mac_signing_king(kind):
    return kind and "mac-signing" in kind


def generate_specifications_of_artifacts_to_sign(
    config, job, keep_locale_template=True, kind=None, dep_kind=None
):
    build_platform = job["attributes"].get("build_platform")
    use_stub = job["attributes"].get("stub-installer")
    # Get locales to know if we want to sign ja-JP-mac langpack
    locales = job["attributes"].get("chunk_locales", [])
    if kind == "release-source-signing":
        artifacts_specifications = [
            {
                "artifacts": [get_artifact_path(job, "source.tar.xz")],
                "formats": ["autograph_gpg"],
            }
        ]
    elif "android" in build_platform:
        artifacts_specifications = [
            {
                "artifacts": get_geckoview_artifacts_to_sign(config, job),
                "formats": ["autograph_gpg"],
            }
        ]
    # XXX: Mars aren't signed here (on any platform) because internals will be
    # signed at after this stage of the release
    elif "macosx" in build_platform:
        langpack_formats = []
        if is_notarization_kind(config.kind):
            formats = ["apple_notarization_stacked"]
            artifacts_specifications = [
                {
                    "artifacts": [
                        get_artifact_path(job, "{locale}/target.tar.gz"),
                        get_artifact_path(job, "{locale}/target.pkg"),
                    ],
                    "formats": formats,
                }
            ]
        else:
            # This task is mac-signing
            if is_partner_kind(kind):
                extension = "tar.gz"
            else:
                extension = "dmg"
            artifacts_specifications = [
                {
                    "artifacts": [
                        get_artifact_path(job, f"{{locale}}/target.{extension}")
                    ],
                    "formats": ["macapp", "autograph_widevine", "autograph_omnija"],
                }
            ]
            langpack_formats = ["autograph_langpack"]

        if "ja-JP-mac" in locales and build_platform in LANGPACK_SIGN_PLATFORMS:
            artifacts_specifications += [
                {
                    "artifacts": [
                        get_artifact_path(job, "ja-JP-mac/target.langpack.xpi")
                    ],
                    "formats": langpack_formats,
                }
            ]
    elif "win" in build_platform:
        artifacts_specifications = [
            {
                "artifacts": [
                    get_artifact_path(job, "{locale}/setup.exe"),
                ],
                "formats": ["autograph_authenticode_202404"],
            },
            {
                "artifacts": [
                    get_artifact_path(job, "{locale}/target.zip"),
                ],
                "formats": [
                    "autograph_authenticode_202404",
                    "autograph_widevine",
                    "autograph_omnija",
                ],
            },
        ]

        if use_stub:
            artifacts_specifications[0]["artifacts"] += [
                get_artifact_path(job, "{locale}/setup-stub.exe")
            ]
    elif "linux" in build_platform:
        artifacts_specifications = [
            {
                "artifacts": [get_artifact_path(job, "{locale}/target.tar.bz2")],
                "formats": ["autograph_gpg", "autograph_widevine", "autograph_omnija"],
            }
        ]
        if build_platform in LANGPACK_SIGN_PLATFORMS:
            artifacts_specifications += [
                {
                    "artifacts": [
                        get_artifact_path(job, "{locale}/target.langpack.xpi")
                    ],
                    "formats": ["autograph_langpack"],
                }
            ]
    else:
        raise Exception("Platform not implemented for signing")

    if not keep_locale_template:
        artifacts_specifications = _strip_locale_template(artifacts_specifications)

    if is_partner_kind(kind):
        artifacts_specifications = _strip_widevine_for_partners(
            artifacts_specifications
        )

    return artifacts_specifications


def _strip_locale_template(artifacts_without_locales):
    for spec in artifacts_without_locales:
        for index, artifact in enumerate(spec["artifacts"]):
            stripped_artifact = artifact.format(locale="")
            stripped_artifact = stripped_artifact.replace("//", "/")
            spec["artifacts"][index] = stripped_artifact

    return artifacts_without_locales


def _strip_widevine_for_partners(artifacts_specifications):
    """Partner repacks should not resign that's previously signed for fear of breaking partial
    updates
    """
    for spec in artifacts_specifications:
        if "autograph_widevine" in spec["formats"]:
            spec["formats"].remove("autograph_widevine")
        if "autograph_omnija" in spec["formats"]:
            spec["formats"].remove("autograph_omnija")

    return artifacts_specifications


def get_signed_artifacts(input, formats, behavior=None):
    """
    Get the list of signed artifacts for the given input and formats.
    """
    artifacts = set()
    if input.endswith(".dmg"):
        artifacts.add(input.replace(".dmg", ".tar.gz"))
        if behavior and behavior != "mac_sign":
            artifacts.add(input.replace(".dmg", ".pkg"))
    else:
        artifacts.add(input)
    if "autograph_gpg" in formats:
        artifacts.add(f"{input}.asc")

    return artifacts


def get_geckoview_artifacts_to_sign(config, job):
    upstream_artifacts = []
    for package in job["attributes"]["maven_packages"]:
        upstream_artifacts += get_geckoview_upstream_artifacts(config, job, package)
    return [
        path
        for upstream_artifact in upstream_artifacts
        for path in upstream_artifact["paths"]
        if not path.endswith(".md5") and not path.endswith(".sha1")
    ]