FxCI: Fix dmg+pkg+msi enterprise repacks signature/notarization

Author: Alexandre Lissy

taskcluster/docs/kinds.rst

@@ -978,3 +978,11 @@ Generates customized versions of releases for enterprises.
 enterprise-repack-repackage
 ---------------------------
 Repackage customized versions of releases for enterprises.
+
+enterprise-repack-mac-notarization
+----------------------------------
+Mac notarization of customized versions of releases for enterprises.
+
+enterprise-repack-mac-signing
+----------------------------------
+Mac signature of customized versions of releases for enterprises.

taskcluster/gecko_taskgraph/transforms/chunk_partners.py

@@ -27,14 +27,19 @@ def chunk_partners(config, jobs):
         dep_job = get_primary_dependency(config, job)
         assert dep_job
 
+        print("job", config.kind, job)
+
         build_platform = dep_job.attributes["build_platform"]
         repack_id = dep_job.task.get("extra", {}).get("repack_id")
         repack_ids = dep_job.task.get("extra", {}).get("repack_ids")
         copy_repack_ids = job.pop("copy-repack-ids", False)
 
+        print("job2", config.kind, job)
+
         if copy_repack_ids:
             assert repack_ids, f"dep_job {dep_job.label} doesn't have repack_ids!"
             job.setdefault("extra", {})["repack_ids"] = repack_ids
+            print("job yield copy_repack_ids", config.kind, job)
             yield job
         # first downstream of the repack task, no chunking or fanout has been done yet
         elif not any([repack_id, repack_ids]):
@@ -45,6 +50,8 @@ def chunk_partners(config, jobs):
                 "release-eme-free-repack-signing",
                 "release-eme-free-repack-mac-signing",
                 "release-partner-repack-mac-signing",
+                "enterprise-repack-signing",
+                "enterprise-repack-mac-signing",
             ):
                 repacks_per_chunk = job.get("repacks-per-chunk")
                 chunks, remainder = divmod(len(platform_repack_ids), repacks_per_chunk)
@@ -55,22 +62,26 @@ def chunk_partners(config, jobs):
                     partner_job = copy.deepcopy(job)
                     partner_job.setdefault("extra", {}).setdefault("repack_ids", chunk)
                     partner_job["extra"]["repack_suffix"] = str(this_chunk)
+                    print("job partner_job", config.kind, job)
                     yield partner_job
             # linux and windows we fan out immediately to one task per partner-sub_partner-locale
             else:
                 for repack_id in platform_repack_ids:
                     partner_job = copy.deepcopy(job)  # don't overwrite dict values here
                     partner_job.setdefault("extra", {})
                     partner_job["extra"]["repack_id"] = repack_id
+                    print("job partner_job 2", config.kind, job)
                     yield partner_job
         # fan out chunked mac signing for repackage
         elif repack_ids:
             for repack_id in repack_ids:
                 partner_job = copy.deepcopy(job)
                 partner_job.setdefault("extra", {}).setdefault("repack_id", repack_id)
+                print("job partner_job 3", config.kind, job)
                 yield partner_job
         # otherwise we've fully fanned out already, continue by passing repack_id on
         else:
             partner_job = copy.deepcopy(job)
             partner_job.setdefault("extra", {}).setdefault("repack_id", repack_id)
+            print("job partner_job 4", config.kind, job)
             yield partner_job

taskcluster/kinds/enterprise-repack-mac-notarization/kind.yml

@@ -0,0 +1,29 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+---
+loader: taskgraph.loader.transform:loader
+
+transforms:
+    - taskgraph.transforms.from_deps
+    - gecko_taskgraph.transforms.mac_notarization
+    - gecko_taskgraph.transforms.chunk_partners
+    - gecko_taskgraph.transforms.partner_signing
+    - gecko_taskgraph.transforms.signing
+    - gecko_taskgraph.transforms.task
+
+kind-dependencies:
+    - enterprise-repack-mac-signing
+
+only-for-build-platforms:
+    - macosx64-shippable/opt
+    - macosx64-enterprise-shippable/opt
+
+tasks:
+    enterprise-repack-mac-notarization:
+        from-deps:
+            group-by: partner-repack-ids
+            copy-attributes: true
+        shipping-product: firefox
+        # TODO: shipping-phase: promote
+        copy-repack-ids: true

taskcluster/kinds/enterprise-repack-mac-signing/kind.yml

@@ -0,0 +1,28 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+---
+loader: taskgraph.loader.transform:loader
+
+transforms:
+    - taskgraph.transforms.from_deps
+    - gecko_taskgraph.transforms.chunk_partners
+    - gecko_taskgraph.transforms.name_sanity
+    - gecko_taskgraph.transforms.partner_signing
+    - gecko_taskgraph.transforms.signing
+    - gecko_taskgraph.transforms.hardened_signing
+    - gecko_taskgraph.transforms.task
+
+kind-dependencies:
+    - enterprise-repack
+
+only-for-build-platforms:
+    - macosx64-enterprise-shippable/opt
+
+tasks:
+    enterprise-repack-mac-signing:
+        from-deps:
+            group-by: partner-repack-ids
+        shipping-product: firefox
+        # TODO: shipping-phase: promote
+        repacks-per-chunk: 5

taskcluster/kinds/enterprise-repack-repackage/kind.yml

@@ -13,8 +13,6 @@ transforms:
     - gecko_taskgraph.transforms.job
     - gecko_taskgraph.transforms.task
 
-# Mac signing/notarization being listed here and not executed will mask
-# this task
 kind-dependencies:
     - enterprise-repack
     - toolchain
@@ -26,7 +24,6 @@ task-defaults:
     run-on-projects: ["enterprise-firefox"]
 
 only-for-build-platforms:
-    - linux64-enterprise-shippable/opt
     - macosx64-enterprise-shippable/opt
     - win64-enterprise-shippable/opt
 
@@ -47,23 +44,14 @@ tasks:
                     macosx64-.*:
                         - repackage/base.py
                         - repackage/osx_partner.py
-                    win32-.*:
-                        - repackage/base.py
-                        - repackage/win32_sfx_stub.py
-                        - repackage/win32_partner.py
                     win64-(?!aarch64).*:
                         - repackage/base.py
                         - repackage/win32_sfx_stub.py
                         - repackage/win64_partner.py
-                    win64-aarch64-.*:
-                        - repackage/base.py
-                        - repackage/win64-aarch64_sfx_stub.py
-                        - repackage/win64_partner.py
                     linux64.*:
                         - repackage/base.py
         package-formats:
             by-build-platform:
-                macosx64\b.*: [dmg]
+                macosx64\b.*: [dmg, pkg]
                 win32\b.*: [installer]
                 win64\b.*: [installer]
-                linux64\b.*: [tar]

taskcluster/kinds/repackage-msi/kind.yml

@@ -14,7 +14,7 @@ transforms:
 kind-dependencies:
     - repackage-signing
     - repackage-signing-l10n
-    - enterprise-repack
+    - enterprise-repack-repackage
     - fetch
 
 only-for-build-platforms: