From c0e47c14fabd20858effdf9d3b1e457f85a221e2 Mon Sep 17 00:00:00 2001 From: Andrew Halberstadt Date: Tue, 7 Apr 2026 14:09:47 -0400 Subject: [PATCH 1/3] fix: set default parameters according to enterprise --- taskcluster/gecko_taskgraph/parameters.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/taskcluster/gecko_taskgraph/parameters.py b/taskcluster/gecko_taskgraph/parameters.py index b5783d64f8111..aeade609467a5 100644 --- a/taskcluster/gecko_taskgraph/parameters.py +++ b/taskcluster/gecko_taskgraph/parameters.py @@ -155,7 +155,7 @@ def get_defaults(repo_root=None): "next_version": None, "optimize_strategies": None, "phabricator_diff": None, - "project": "mozilla-central", + "project": "enterprise-firefox", "release_enable_emefree": False, "release_enable_partner_repack": False, "release_enable_partner_attribution": False, From 155d5c1ea2282af202aa96404079f8114e1197b5 Mon Sep 17 00:00:00 2001 From: Andrew Halberstadt Date: Mon, 6 Apr 2026 11:35:59 -0400 Subject: [PATCH 2/3] Add signing tasks for linux64 enterprise-repacks --- taskcluster/config.yml | 1 + taskcluster/docs/kinds.rst | 4 + .../transforms/hardened_signing.py | 21 +- .../transforms/partner_signing.py | 1 + .../gecko_taskgraph/transforms/signing.py | 7 +- taskcluster/gecko_taskgraph/util/partners.py | 3 + .../gecko_taskgraph/util/signed_artifacts.py | 25 +- .../kinds/enterprise-repack-signing/kind.yml | 28 +++ .../test/params/enterprise-main-onpush.yml | 231 ++++++++++++++++++ 9 files changed, 297 insertions(+), 24 deletions(-) create mode 100644 taskcluster/kinds/enterprise-repack-signing/kind.yml create mode 100644 taskcluster/test/params/enterprise-main-onpush.yml diff --git a/taskcluster/config.yml b/taskcluster/config.yml index 672ab5a842710..14936567f95bc 100644 --- a/taskcluster/config.yml +++ b/taskcluster/config.yml @@ -212,6 +212,7 @@ treeherder: 'MSI-Ent': "MSI Enterprise repacks" 'MSIs-Ent': "MSI signed Enterprise repacks" 'DEB-Ent': "Debian Enterprise repacks" + 'BS-Ent': "Signing for Enterprise repacks" 'BMS-Ent': "Mac signing for Enterprise repacks" 'BMN-Ent': "Mac notarization for Enterprise repacks" 'MnEnt': 'Marionette tests Enterprise' diff --git a/taskcluster/docs/kinds.rst b/taskcluster/docs/kinds.rst index e8cb83101dae2..664bd4d272191 100644 --- a/taskcluster/docs/kinds.rst +++ b/taskcluster/docs/kinds.rst @@ -973,3 +973,7 @@ Mac notarization of customized versions of releases for enterprises. enterprise-repack-mac-signing ---------------------------------- Mac signature of customized versions of releases for enterprises. + +enterprise-repack-signing +------------------------- +Signature of customized versions of releases for enterprises. diff --git a/taskcluster/gecko_taskgraph/transforms/hardened_signing.py b/taskcluster/gecko_taskgraph/transforms/hardened_signing.py index 4f51f4ffa7f23..7c68d9f6b0045 100644 --- a/taskcluster/gecko_taskgraph/transforms/hardened_signing.py +++ b/taskcluster/gecko_taskgraph/transforms/hardened_signing.py @@ -144,14 +144,15 @@ def add_upstream_signing_resources(config, jobs): if "entitlements" in cfg: upstream_files.add(cfg["entitlements"]) - task_ref = f"<{dep_job.kind}>" - task_type = "build" - if "notarization" in dep_job.kind: - task_type = "scriptworker" - job["worker"].setdefault("upstream-artifacts", []).append({ - "paths": sorted(upstream_files), - "taskId": {"task-reference": task_ref}, - "taskType": task_type, - "formats": [], # Not for signing - }) + if upstream_files: + task_ref = f"<{dep_job.kind}>" + task_type = "build" + if "notarization" in dep_job.kind: + task_type = "scriptworker" + job["worker"].setdefault("upstream-artifacts", []).append({ + "paths": sorted(upstream_files), + "taskId": {"task-reference": task_ref}, + "taskType": task_type, + "formats": [], # Not for signing + }) yield job diff --git a/taskcluster/gecko_taskgraph/transforms/partner_signing.py b/taskcluster/gecko_taskgraph/transforms/partner_signing.py index 7c2f8e2f07d08..7aa747e5d1685 100644 --- a/taskcluster/gecko_taskgraph/transforms/partner_signing.py +++ b/taskcluster/gecko_taskgraph/transforms/partner_signing.py @@ -49,6 +49,7 @@ def define_upstream_artifacts(config, jobs): keep_locale_template=True, kind=config.kind, ) + task_type = "build" if "notarization" in dep_job.label or "mac-signing" in dep_job.label: task_type = "scriptworker" diff --git a/taskcluster/gecko_taskgraph/transforms/signing.py b/taskcluster/gecko_taskgraph/transforms/signing.py index 97b6656956e6a..c96e4276f9db3 100644 --- a/taskcluster/gecko_taskgraph/transforms/signing.py +++ b/taskcluster/gecko_taskgraph/transforms/signing.py @@ -143,12 +143,15 @@ def make_task_description(config, jobs): th_symbol = None - if "enterprise-repack-mac" in config.kind: + if "enterprise-repack" in config.kind: # assumes repacks-per-chunk is 1 repack_ids = job.get("extra").get("repack_ids") assert len(repack_ids) == 1 - th_group = "BMS-Ent" if "signing" in config.kind else "BMN-Ent" + if "mac" in config.kind: + th_group = "BMS-Ent" if "signing" in config.kind else "BMN-Ent" + else: + th_group = "BS-Ent" th_symbol = f"{th_group}({repack_ids[0]})" repack_label = "enterprise-repack-" + repack_ids[0].replace("/", "_") diff --git a/taskcluster/gecko_taskgraph/util/partners.py b/taskcluster/gecko_taskgraph/util/partners.py index ee6dad3137407..a7eeffa5af190 100644 --- a/taskcluster/gecko_taskgraph/util/partners.py +++ b/taskcluster/gecko_taskgraph/util/partners.py @@ -680,6 +680,9 @@ def get_enterprise_partner_configs(parameters): "macosx64-enterprise-shippable", "win64-enterprise-shippable", ]), + "enterprise-repack-signing": make_enterprise_repack([ + "linux64-enterprise-shippable", + ]), "enterprise-repack-mac-signing": make_enterprise_repack([ "macosx64-enterprise-shippable", ]), diff --git a/taskcluster/gecko_taskgraph/util/signed_artifacts.py b/taskcluster/gecko_taskgraph/util/signed_artifacts.py index c1e93d47f184e..73346e340c3bb 100644 --- a/taskcluster/gecko_taskgraph/util/signed_artifacts.py +++ b/taskcluster/gecko_taskgraph/util/signed_artifacts.py @@ -128,18 +128,19 @@ def generate_specifications_of_artifacts_to_sign( "formats": ["gcp_prod_autograph_gpg", "gcp_prod_autograph_widevine"], } ] - dep_job = config.kind_dependencies_tasks[job["dependencies"][dep_kind]] - if build_platform in LANGPACK_SIGN_PLATFORMS and not dep_job.attributes.get( - "artifact-build" - ): - artifacts_specifications += [ - { - "artifacts": [ - get_artifact_path(job, "{locale}/target.langpack.xpi") - ], - "formats": ["gcp_prod_autograph_langpack"], - } - ] + if not is_partner_kind(kind): + dep_job = config.kind_dependencies_tasks[job["dependencies"][dep_kind]] + if build_platform in LANGPACK_SIGN_PLATFORMS and not dep_job.attributes.get( + "artifact-build" + ): + artifacts_specifications += [ + { + "artifacts": [ + get_artifact_path(job, "{locale}/target.langpack.xpi") + ], + "formats": ["gcp_prod_autograph_langpack"], + } + ] else: raise Exception("Platform not implemented for signing") diff --git a/taskcluster/kinds/enterprise-repack-signing/kind.yml b/taskcluster/kinds/enterprise-repack-signing/kind.yml new file mode 100644 index 0000000000000..e760fcaf799a7 --- /dev/null +++ b/taskcluster/kinds/enterprise-repack-signing/kind.yml @@ -0,0 +1,28 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +--- +loader: taskgraph.loader.transform:loader + +transforms: + - taskgraph.transforms.from_deps + - gecko_taskgraph.transforms.chunk_partners + - gecko_taskgraph.transforms.name_sanity + - gecko_taskgraph.transforms.partner_signing + - gecko_taskgraph.transforms.signing + - gecko_taskgraph.transforms.hardened_signing + - gecko_taskgraph.transforms.task + +kind-dependencies: + - enterprise-repack + +only-for-build-platforms: + - linux64-enterprise-shippable/opt + +tasks: + enterprise-repack-signing: + from-deps: + group-by: partner-repack-ids + shipping-product: firefox-enterprise + # TODO: shipping-phase: promote + repacks-per-chunk: 1 diff --git a/taskcluster/test/params/enterprise-main-onpush.yml b/taskcluster/test/params/enterprise-main-onpush.yml new file mode 100644 index 0000000000000..2e0cef6a3144f --- /dev/null +++ b/taskcluster/test/params/enterprise-main-onpush.yml @@ -0,0 +1,231 @@ +android_perftest_backstop: false +app_version: 151.0a1 +backstop: false +base_ref: '' +base_repository: https://github.com/mozilla/enterprise-firefox +base_rev: fa76d3752eeabef58e828119616c0a818daae031 +build_date: 1775584008 +build_number: 1 +do_not_optimize: [] +enable_always_target: +- docker-image +existing_tasks: {} +files_changed: +- browser/components/enterprisepolicies/Policies.sys.mjs +filters: +- target_tasks_method +head_ref: refs/heads/enterprise-main +head_repository: https://github.com/mozilla/enterprise-firefox +head_rev: e777f24fecf3e650448de729180ed2f46bb3391e +head_tag: '' +hg_branch: null +level: '3' +message: '' +moz_build_date: '20260407174648' +next_version: null +optimize_strategies: null +optimize_target_tasks: true +owner: user@example.com +phabricator_diff: null +project: enterprise-firefox +pushdate: 0 +pushlog_id: '0' +release_enable_emefree: false +release_enable_partner_attribution: false +release_enable_partner_repack: false +release_eta: '' +release_history: {} +release_partner_build_number: 1 +release_partner_config: + enterprise-repack-mac-notarization: + hosted: + pilotProd: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + pilotStage: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + moz: + prodGCP: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + stageGCP: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + enterprise-repack-mac-signing: + hosted: + pilotProd: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + pilotStage: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + moz: + prodGCP: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + stageGCP: + locales: + - en-US + - fr + platforms: + - macosx64-enterprise-shippable + enterprise-repack-repackage: + hosted: + pilotProd: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + - macosx64-enterprise-shippable + - win64-enterprise-shippable + pilotStage: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + - macosx64-enterprise-shippable + - win64-enterprise-shippable + moz: + prodGCP: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + - macosx64-enterprise-shippable + - win64-enterprise-shippable + stageGCP: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + - macosx64-enterprise-shippable + - win64-enterprise-shippable + enterprise-repack-signing: + hosted: + pilotProd: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + pilotStage: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + moz: + prodGCP: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + stageGCP: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + repackage-deb: + hosted: + pilotProd: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + pilotStage: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + moz: + prodGCP: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + stageGCP: + locales: + - en-US + - fr + platforms: + - linux64-enterprise-shippable + - linux64-aarch64-enterprise-shippable + repackage-msi: + hosted: + pilotProd: + locales: + - en-US + - fr + platforms: + - win64-enterprise-shippable + pilotStage: + locales: + - en-US + - fr + platforms: + - win64-enterprise-shippable + moz: + prodGCP: + locales: + - en-US + - fr + platforms: + - win64-enterprise-shippable + stageGCP: + locales: + - en-US + - fr + platforms: + - win64-enterprise-shippable +release_partners: +- moz +- hosted +release_product: firefox-enterprise +release_type: nightly-enterprise +repository_type: git +required_signoffs: [] +signoff_urls: {} +target_tasks_method: enterprise_firefox_with_tests_tasks +tasks_for: github-push +test_manifest_loader: default +try_mode: null +try_task_config: {} +version: 151.0a1 From 05a9b8374614318e46f342371e3973e71952491f Mon Sep 17 00:00:00 2001 From: Andrew Halberstadt Date: Thu, 9 Apr 2026 10:01:57 -0400 Subject: [PATCH 3/3] DO NOT LAND: force shippable in PRs --- taskcluster/gecko_taskgraph/target_tasks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/taskcluster/gecko_taskgraph/target_tasks.py b/taskcluster/gecko_taskgraph/target_tasks.py index 41d5e7476731e..a3ac37b93a535 100644 --- a/taskcluster/gecko_taskgraph/target_tasks.py +++ b/taskcluster/gecko_taskgraph/target_tasks.py @@ -513,7 +513,7 @@ def filter(task): shippable = task.attributes.get("shippable", False) level = int(parameters["level"]) - if ("shippable" in task.label or shippable) and level < 3: + if ("shippable" in task.label or shippable) and level < 3 and False: return False if not build_platform or not build_type: