Skip to content

Commit 581e24a

Browse files
jmaherjmaher
authored
Adjust xpi-manifest cot-scopes (#502)
1 parent a76a16d commit 581e24a

File tree

6 files changed

+94
-87
lines changed

6 files changed

+94
-87
lines changed

‎HISTORY.rst‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,13 @@ Change Log
44
All notable changes to this project will be documented in this file.
55
This project adheres to `Semantic Versioning <http://semver.org/>`__.
66

7+
[38.1.0] - 2021-05-19
8+
---------------------
9+
Changed
10+
~~~~~~~
11+
- added support for cot_restricted_scopes to match <scope>*
12+
13+
714
[38.0.0] - 2021-05-17
815
---------------------
916
Removed

‎src/scriptworker/constants.py‎

Lines changed: 25 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -122,44 +122,24 @@
122122
"xpi": "github",
123123
"adhoc": "github",
124124
"scriptworker": "github",
125-
},
126-
),
127-
},
125+
}
126+
)
127+
}
128128
),
129129
# decision task cot
130130
"valid_decision_worker_pools": immutabledict(
131131
{
132132
"by-cot-product": immutabledict(
133133
{
134-
"firefox": (
135-
"gecko-1/decision",
136-
"gecko-2/decision",
137-
"gecko-3/decision",
138-
),
139-
"thunderbird": (
140-
"comm-1/decision",
141-
"comm-2/decision",
142-
"comm-3/decision",
143-
),
144-
"mobile": (
145-
"mobile-1/decision",
146-
"mobile-3/decision",
147-
),
134+
"firefox": ("gecko-1/decision", "gecko-2/decision", "gecko-3/decision"),
135+
"thunderbird": ("comm-1/decision", "comm-2/decision", "comm-3/decision"),
136+
"mobile": ("mobile-1/decision", "mobile-3/decision"),
148137
"mpd001": ("mpd001-1/decision", "mpd001-3/decision"),
149-
"app-services": (
150-
"app-services-1/decision",
151-
"app-services-3/decision",
152-
),
153-
"glean": (
154-
"glean-1/decision",
155-
"glean-3/decision",
156-
),
138+
"app-services": ("app-services-1/decision", "app-services-3/decision"),
139+
"glean": ("glean-1/decision", "glean-3/decision"),
157140
"xpi": ("xpi-1/decision", "xpi-3/decision"),
158141
"adhoc": ("adhoc-1/decision", "adhoc-3/decision"),
159-
"scriptworker": (
160-
"scriptworker-1/decision",
161-
"scriptworker-3/decision",
162-
),
142+
"scriptworker": ("scriptworker-1/decision", "scriptworker-3/decision"),
163143
}
164144
)
165145
}
@@ -169,35 +149,15 @@
169149
{
170150
"by-cot-product": immutabledict(
171151
{
172-
"firefox": (
173-
"gecko-1/images",
174-
"gecko-2/images",
175-
"gecko-3/images",
176-
),
177-
"thunderbird": (
178-
"comm-1/images",
179-
"comm-2/images",
180-
"comm-3/images",
181-
),
182-
"mobile": (
183-
"mobile-1/images",
184-
"mobile-3/images",
185-
),
152+
"firefox": ("gecko-1/images", "gecko-2/images", "gecko-3/images"),
153+
"thunderbird": ("comm-1/images", "comm-2/images", "comm-3/images"),
154+
"mobile": ("mobile-1/images", "mobile-3/images"),
186155
"mpd001": ("mpd001-1/images", "mpd001-3/images"),
187-
"app-services": (
188-
"app-services-1/images",
189-
"app-services-3/images",
190-
),
191-
"glean": (
192-
"glean-1/images",
193-
"glean-3/images",
194-
),
156+
"app-services": ("app-services-1/images", "app-services-3/images"),
157+
"glean": ("glean-1/images", "glean-3/images"),
195158
"xpi": ("xpi-1/images", "xpi-3/images"),
196159
"adhoc": ("adhoc-1/images", "adhoc-3/images"),
197-
"scriptworker": (
198-
"scriptworker-1/images",
199-
"scriptworker-3/images",
200-
),
160+
"scriptworker": ("scriptworker-1/images", "scriptworker-3/images"),
201161
}
202162
)
203163
}
@@ -427,7 +387,11 @@
427387
"app-services": immutabledict({"project:mozilla:app-services:releng:beetmover:bucket:maven-production": "app-services-repo"}),
428388
"glean": immutabledict({"project:mozilla:glean:releng:beetmover:bucket:maven-production": "glean-repo"}),
429389
"xpi": immutabledict(
430-
{"project:xpi:signing:cert:release-signing": "xpi-manifest-repo", "project:xpi:ship-it:production": "xpi-manifest-repo"}
390+
{
391+
"project:xpi:signing:cert:release-signing": "xpi-manifest-repo",
392+
"project:xpi:releng:github:project:mozilla-extensions/*": "xpi-manifest-repo",
393+
"project:xpi:ship-it:production": "xpi-manifest-repo",
394+
}
431395
),
432396
"adhoc": immutabledict({"project:adhoc:signing:cert:release-signing": "adhoc-signing-repos"}),
433397
"scriptworker": immutabledict(
@@ -448,12 +412,7 @@
448412
# Which repos can perform release actions?
449413
# XXX remove /projects/maple when we have a
450414
# different prod signing testing solution
451-
"all-release-branches": (
452-
"/releases/mozilla-beta",
453-
"/releases/mozilla-release",
454-
"/releases/mozilla-esr78",
455-
"/projects/maple",
456-
),
415+
"all-release-branches": ("/releases/mozilla-beta", "/releases/mozilla-release", "/releases/mozilla-esr78", "/projects/maple"),
457416
# Limit things like pushapk to just these branches
458417
"release": ("/releases/mozilla-release",),
459418
"beta": ("/releases/mozilla-beta",),
@@ -476,27 +435,15 @@
476435
"/projects/oak",
477436
"/projects/pine",
478437
),
479-
"all-production-branches": (
480-
"/mozilla-central",
481-
"/releases/mozilla-beta",
482-
"/releases/mozilla-release",
483-
"/releases/mozilla-esr78",
484-
),
438+
"all-production-branches": ("/mozilla-central", "/releases/mozilla-beta", "/releases/mozilla-release", "/releases/mozilla-esr78"),
485439
}
486440
),
487441
"thunderbird": immutabledict(
488442
{
489-
"all-release-branches": (
490-
"/releases/comm-beta",
491-
"/releases/comm-esr78",
492-
),
443+
"all-release-branches": ("/releases/comm-beta", "/releases/comm-esr78"),
493444
"beta": ("/releases/comm-beta",),
494445
"esr": ("/releases/comm-esr78",),
495-
"all-nightly-branches": (
496-
"/comm-central",
497-
"/releases/comm-beta",
498-
"/releases/comm-esr78",
499-
),
446+
"all-nightly-branches": ("/comm-central", "/releases/comm-beta", "/releases/comm-esr78"),
500447
"nightly": ("/comm-central",),
501448
}
502449
),
@@ -518,10 +465,7 @@
518465
"scriptworker": immutabledict(
519466
{
520467
"scriptworker-scripts-repo": ("/mozilla-releng/scriptworker-scripts",),
521-
"all-production-repos": (
522-
"/mozilla-releng/scriptworker",
523-
"/mozilla-releng/scriptworker-scripts",
524-
),
468+
"all-production-repos": ("/mozilla-releng/scriptworker", "/mozilla-releng/scriptworker-scripts"),
525469
}
526470
),
527471
}

‎src/scriptworker/cot/verify.py‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -164,14 +164,36 @@ def is_decision(self):
164164
"""
165165
return self.task_type in DECISION_TASK_TYPES
166166

167+
def is_scope_in_restricted_scopes(self, scope, restricted_scopes):
168+
"""Determine if a scope matches in a list of restricted_scopes.
169+
if one of the restricted scopes ends with '*', find a partial match.
170+
171+
Returns:
172+
String: string of matching restricted_scope, if no match ""
173+
"""
174+
match = []
175+
for restricted in restricted_scopes:
176+
if restricted.endswith("*"):
177+
if scope.startswith(restricted.rstrip("*")):
178+
match.append(restricted)
179+
elif scope == restricted:
180+
match.append(restricted)
181+
182+
if len(match) > 1:
183+
raise CoTError("Scope {} matches >1 restricted_scope: {}\n".format(scope, match))
184+
elif len(match) == 1:
185+
return match[0]
186+
else:
187+
return ""
188+
167189
def has_restricted_scopes(self):
168190
"""Determine if this task is requesting any restricted scopes.
169191
170192
Returns:
171193
bool: whether this task requested restricted scopes.
172194
173195
"""
174-
return any((scope in self.context.config["cot_restricted_scopes"]) for scope in self.task["scopes"])
196+
return any((self.is_scope_in_restricted_scopes(scope, self.context.config["cot_restricted_scopes"])) for scope in self.task["scopes"])
175197

176198
def get_all_links_in_chain(self):
177199
"""Return all links in the chain of trust, including the target task.
@@ -1907,9 +1929,10 @@ async def trace_back_to_tree(chain):
19071929
# check for restricted scopes.
19081930
my_repo = repos[chain]
19091931
for scope in chain.task["scopes"]:
1910-
if scope in rules["scopes"]:
1932+
matched_scope = chain.is_scope_in_restricted_scopes(scope, rules["scopes"])
1933+
if matched_scope:
19111934
log.info("Found privileged scope {}".format(scope))
1912-
level = rules["scopes"][scope]
1935+
level = rules["scopes"][matched_scope]
19131936
if my_repo not in rules["trees"][level]:
19141937
errors.append("{} {}: repo {} not allowlisted for scope {}!".format(chain.name, chain.task_id, my_repo, scope))
19151938
# verify all tasks w/ same decision_task_id have the same source repo.

‎src/scriptworker/version.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ def get_version_string(version: Union[ShortVerType, LongVerType]) -> str:
5454

5555
# 1}}}
5656
# Semantic versioning 2.0.0 http://semver.org/
57-
__version__ = (38, 0, 0)
57+
__version__ = (38, 1, 0)
5858
__version_string__ = get_version_string(__version__)
5959

6060

‎tests/test_cot_verify.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2193,3 +2193,36 @@ async def test_get_scm_level(rw_context, project, level, raises):
21932193
await cotverify.get_scm_level(rw_context, project)
21942194
else:
21952195
assert await cotverify.get_scm_level(rw_context, project) == level
2196+
2197+
2198+
# tests for matching scopes with a partial match, implemented for xpi
2199+
@pytest.mark.parametrize(
2200+
"scope, restricted_scopes, expected",
2201+
(
2202+
(
2203+
"project:xpi:signing:cert:release-signing",
2204+
["project:xpi:ship-it:production", "project:xpi:signing:cert:release-signing"],
2205+
"project:xpi:signing:cert:release-signing",
2206+
),
2207+
("project:xpi:signing:cert:release", ["project:xpi:ship-it:production", "project:xpi:signing:cert:release-signing"], ""),
2208+
("project:xpi:ship-it:production", ["project:xpi:ship-it:production"], "project:xpi:ship-it:production"),
2209+
(
2210+
"project:xpi:releng:github:project:mozilla-extensions/xpi-manifest",
2211+
["project:xpi:releng:github:project:mozilla-extensions/*"],
2212+
"project:xpi:releng:github:project:mozilla-extensions/*",
2213+
),
2214+
("project:xpi:releng:github:project:mozilla-releng/xpi-manifest", ["project:xpi:releng:github:project:mozilla-extensions/*"], ""),
2215+
("project:xpi:ship-it:production", ["project:xpi:ship-it:*"], "project:xpi:ship-it:*"),
2216+
("project:xpi:ship-it:production", ["project:xpi:ship-it"], ""),
2217+
("project:xpi:ship-it:production", ["project:xpi:ship-it:staging"], ""),
2218+
("project:xpi:ship-it:*", ["project:xpi:ship-it:*"], "project:xpi:ship-it:*"),
2219+
("project:xpi:ship-it", ["*project:xpi:ship-it"], ""),
2220+
("project:xpi:ship-it:production", ["project:xpi:ship-it:production*", "project:xpi:ship-it:production"], "COTError"),
2221+
),
2222+
)
2223+
def test_scope_in_restricted_scopes(chain, scope, restricted_scopes, expected):
2224+
if expected == "COTError":
2225+
with pytest.raises(CoTError):
2226+
chain.is_scope_in_restricted_scopes(scope, restricted_scopes)
2227+
else:
2228+
assert chain.is_scope_in_restricted_scopes(scope, restricted_scopes) is expected

‎version.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"version":[
33
38,
4-
0,
4+
1,
55
0
66
],
7-
"version_string":"38.0.0"
7+
"version_string":"38.1.0"
88
}

0 commit comments

Comments
 (0)