Create Linux enterprise-repack signing tasks

taskcluster/config.yml

@@ -212,6 +212,7 @@ treeherder:
         'MSI-Ent': "MSI Enterprise repacks"
         'MSIs-Ent': "MSI signed Enterprise repacks"
         'DEB-Ent': "Debian Enterprise repacks"
+        'BS-Ent': "Signing for Enterprise repacks"
         'BMS-Ent': "Mac signing for Enterprise repacks"
         'BMN-Ent': "Mac notarization for Enterprise repacks"
         'MnEnt': 'Marionette tests Enterprise'

taskcluster/docs/kinds.rst

@@ -973,3 +973,7 @@ Mac notarization of customized versions of releases for enterprises.
 enterprise-repack-mac-signing
 ----------------------------------
 Mac signature of customized versions of releases for enterprises.
+
+enterprise-repack-signing
+-------------------------
+Signature of customized versions of releases for enterprises.

taskcluster/gecko_taskgraph/parameters.py

@@ -155,7 +155,7 @@ def get_defaults(repo_root=None):
         "next_version": None,
         "optimize_strategies": None,
         "phabricator_diff": None,
-        "project": "mozilla-central",
+        "project": "enterprise-firefox",
         "release_enable_emefree": False,
         "release_enable_partner_repack": False,
         "release_enable_partner_attribution": False,

taskcluster/gecko_taskgraph/target_tasks.py

@@ -513,7 +513,7 @@ def filter(task):
         shippable = task.attributes.get("shippable", False)
 
         level = int(parameters["level"])
-        if ("shippable" in task.label or shippable) and level < 3:
+        if ("shippable" in task.label or shippable) and level < 3 and False:
             return False
 
         if not build_platform or not build_type:

taskcluster/gecko_taskgraph/transforms/hardened_signing.py

@@ -144,14 +144,15 @@ def add_upstream_signing_resources(config, jobs):
             if "entitlements" in cfg:
                 upstream_files.add(cfg["entitlements"])
 
-        task_ref = f"<{dep_job.kind}>"
-        task_type = "build"
-        if "notarization" in dep_job.kind:
-            task_type = "scriptworker"
-        job["worker"].setdefault("upstream-artifacts", []).append({
-            "paths": sorted(upstream_files),
-            "taskId": {"task-reference": task_ref},
-            "taskType": task_type,
-            "formats": [],  # Not for signing
-        })
+        if upstream_files:
+            task_ref = f"<{dep_job.kind}>"
+            task_type = "build"
+            if "notarization" in dep_job.kind:
+                task_type = "scriptworker"
+            job["worker"].setdefault("upstream-artifacts", []).append({
+                "paths": sorted(upstream_files),
+                "taskId": {"task-reference": task_ref},
+                "taskType": task_type,
+                "formats": [],  # Not for signing
+            })
         yield job

taskcluster/gecko_taskgraph/transforms/partner_signing.py

@@ -49,6 +49,7 @@ def define_upstream_artifacts(config, jobs):
             keep_locale_template=True,
             kind=config.kind,
         )
+
         task_type = "build"
         if "notarization" in dep_job.label or "mac-signing" in dep_job.label:
             task_type = "scriptworker"

taskcluster/gecko_taskgraph/transforms/signing.py

@@ -143,12 +143,15 @@ def make_task_description(config, jobs):
 
             th_symbol = None
 
-            if "enterprise-repack-mac" in config.kind:
+            if "enterprise-repack" in config.kind:
                 # assumes repacks-per-chunk is 1
                 repack_ids = job.get("extra").get("repack_ids")
 
                 assert len(repack_ids) == 1
-                th_group = "BMS-Ent" if "signing" in config.kind else "BMN-Ent"
+                if "mac" in config.kind:
+                    th_group = "BMS-Ent" if "signing" in config.kind else "BMN-Ent"
+                else:
+                    th_group = "BS-Ent"
                 th_symbol = f"{th_group}({repack_ids[0]})"
 
                 repack_label = "enterprise-repack-" + repack_ids[0].replace("/", "_")

taskcluster/gecko_taskgraph/util/partners.py

@@ -680,6 +680,9 @@ def get_enterprise_partner_configs(parameters):
             "macosx64-enterprise-shippable",
             "win64-enterprise-shippable",
         ]),
+        "enterprise-repack-signing": make_enterprise_repack([
+            "linux64-enterprise-shippable",
+        ]),
         "enterprise-repack-mac-signing": make_enterprise_repack([
             "macosx64-enterprise-shippable",
         ]),

taskcluster/gecko_taskgraph/util/signed_artifacts.py

@@ -128,18 +128,19 @@ def generate_specifications_of_artifacts_to_sign(
                 "formats": ["gcp_prod_autograph_gpg", "gcp_prod_autograph_widevine"],
             }
         ]
-        dep_job = config.kind_dependencies_tasks[job["dependencies"][dep_kind]]
-        if build_platform in LANGPACK_SIGN_PLATFORMS and not dep_job.attributes.get(
-            "artifact-build"
-        ):
-            artifacts_specifications += [
-                {
-                    "artifacts": [
-                        get_artifact_path(job, "{locale}/target.langpack.xpi")
-                    ],
-                    "formats": ["gcp_prod_autograph_langpack"],
-                }
-            ]
+        if not is_partner_kind(kind):
+            dep_job = config.kind_dependencies_tasks[job["dependencies"][dep_kind]]
+            if build_platform in LANGPACK_SIGN_PLATFORMS and not dep_job.attributes.get(
+                "artifact-build"
+            ):
+                artifacts_specifications += [
+                    {
+                        "artifacts": [
+                            get_artifact_path(job, "{locale}/target.langpack.xpi")
+                        ],
+                        "formats": ["gcp_prod_autograph_langpack"],
+                    }
+                ]
     else:
         raise Exception("Platform not implemented for signing")
 

taskcluster/kinds/enterprise-repack-signing/kind.yml

@@ -0,0 +1,28 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+---
+loader: taskgraph.loader.transform:loader
+
+transforms:
+    - taskgraph.transforms.from_deps
+    - gecko_taskgraph.transforms.chunk_partners
+    - gecko_taskgraph.transforms.name_sanity
+    - gecko_taskgraph.transforms.partner_signing
+    - gecko_taskgraph.transforms.signing
+    - gecko_taskgraph.transforms.hardened_signing
+    - gecko_taskgraph.transforms.task
+
+kind-dependencies:
+    - enterprise-repack
+
+only-for-build-platforms:
+    - linux64-enterprise-shippable/opt
+
+tasks:
+    enterprise-repack-signing:
+        from-deps:
+            group-by: partner-repack-ids
+        shipping-product: firefox-enterprise
+        # TODO: shipping-phase: promote
+        repacks-per-chunk: 1

taskcluster/test/params/enterprise-main-onpush.yml

@@ -0,0 +1,231 @@
+android_perftest_backstop: false
+app_version: 151.0a1
+backstop: false
+base_ref: ''
+base_repository: https://github.com/mozilla/enterprise-firefox
+base_rev: fa76d3752eeabef58e828119616c0a818daae031
+build_date: 1775584008
+build_number: 1
+do_not_optimize: []
+enable_always_target:
+- docker-image
+existing_tasks: {}
+files_changed:
+- browser/components/enterprisepolicies/Policies.sys.mjs
+filters:
+- target_tasks_method
+head_ref: refs/heads/enterprise-main
+head_repository: https://github.com/mozilla/enterprise-firefox
+head_rev: e777f24fecf3e650448de729180ed2f46bb3391e
+head_tag: ''
+hg_branch: null
+level: '3'
+message: ''
+moz_build_date: '20260407174648'
+next_version: null
+optimize_strategies: null
+optimize_target_tasks: true
+owner: user@example.com
+phabricator_diff: null
+project: enterprise-firefox
+pushdate: 0
+pushlog_id: '0'
+release_enable_emefree: false
+release_enable_partner_attribution: false
+release_enable_partner_repack: false
+release_eta: ''
+release_history: {}
+release_partner_build_number: 1
+release_partner_config:
+  enterprise-repack-mac-notarization:
+    hosted:
+      pilotProd:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+      pilotStage:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+    moz:
+      prodGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+      stageGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+  enterprise-repack-mac-signing:
+    hosted:
+      pilotProd:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+      pilotStage:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+    moz:
+      prodGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+      stageGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - macosx64-enterprise-shippable
+  enterprise-repack-repackage:
+    hosted:
+      pilotProd:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+        - macosx64-enterprise-shippable
+        - win64-enterprise-shippable
+      pilotStage:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+        - macosx64-enterprise-shippable
+        - win64-enterprise-shippable
+    moz:
+      prodGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+        - macosx64-enterprise-shippable
+        - win64-enterprise-shippable
+      stageGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+        - macosx64-enterprise-shippable
+        - win64-enterprise-shippable
+  enterprise-repack-signing:
+    hosted:
+      pilotProd:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+      pilotStage:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+    moz:
+      prodGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+      stageGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+  repackage-deb:
+    hosted:
+      pilotProd:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+      pilotStage:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+    moz:
+      prodGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+      stageGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - linux64-enterprise-shippable
+        - linux64-aarch64-enterprise-shippable
+  repackage-msi:
+    hosted:
+      pilotProd:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - win64-enterprise-shippable
+      pilotStage:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - win64-enterprise-shippable
+    moz:
+      prodGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - win64-enterprise-shippable
+      stageGCP:
+        locales:
+        - en-US
+        - fr
+        platforms:
+        - win64-enterprise-shippable
+release_partners:
+- moz
+- hosted
+release_product: firefox-enterprise
+release_type: nightly-enterprise
+repository_type: git
+required_signoffs: []
+signoff_urls: {}
+target_tasks_method: enterprise_firefox_with_tests_tasks
+tasks_for: github-push
+test_manifest_loader: default
+try_mode: null
+try_task_config: {}
+version: 151.0a1