scriptworker 63.1.0__tar.gz → 63.2.0__tar.gz

{scriptworker-63.1.0 → scriptworker-63.2.0}/HISTORY.rst

@@ -4,6 +4,20 @@ Change Log
 All notable changes to this project will be documented in this file.
 This project adheres to `Semantic Versioning <http://semver.org/>`__.
 
+63.2.0 - 2026-06-18
+-------------------
+
+Added
+~~~~~
+- When Chain of Trust verification fails, the log is also exposed as public/logs/live_backing.log
+  (https://bugzilla.mozilla.org/show_bug.cgi?id=2039779)
+- Values for ESR 153 to scriptworker constants (https://bugzilla.mozilla.org/show_bug.cgi?id=2046216)
+
+Fixed
+~~~~~
+- The TASKCLUSTER_CREDENTIALS_FD feature uses a regular temporary file rather than a memfd, to
+  make things work again on macOS
+
 63.1.0 - 2026-05-26
 -------------------
 

{scriptworker-63.1.0 → scriptworker-63.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scriptworker
-Version: 63.1.0
+Version: 63.2.0
 Summary: Taskcluster scriptworker
 Author-email: Mozilla Release Engineering <releng@mozilla.com>
 License-File: LICENSE

{scriptworker-63.1.0 → scriptworker-63.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "scriptworker"
-version = "63.1.0"
+version = "63.2.0"
 description = "Taskcluster scriptworker"
 authors = [
     { name = "Mozilla Release Engineering", email = "releng@mozilla.com" },

{scriptworker-63.1.0 → scriptworker-63.2.0}/src/scriptworker/artifacts.py

@@ -183,6 +183,29 @@ async def create_artifact(context, path, target_path, content_type, content_enco
                     raise ScriptWorkerRetryException("Bad status {}".format(resp.status))
 
 
+async def create_link_artifact(context, target_path, link_to, content_type, expires=None):
+    """Create a Taskcluster link artifact that redirects to another artifact in the same task.
+
+    Args:
+        context (scriptworker.context.Context): the scriptworker context.
+        target_path (str): the artifact name to create (e.g., ``public/logs/live_backing.log``).
+        link_to (str): the artifact name to link to (e.g., ``public/logs/chain_of_trust.log``).
+        content_type (str): Content type (MIME type) of the linked artifact.
+        expires (str, optional): ISO datestring of when the artifact expires.
+            Defaults to ``context.task["expires"]``.
+
+    """
+    payload = {
+        "storageType": "link",
+        "expires": expires or get_expiration_arrow(context).isoformat(),
+        "contentType": content_type,
+        "artifact": link_to,
+    }
+    args = [get_task_id(context.claim_task), get_run_id(context.claim_task), target_path, payload]
+    log.info("Creating link artifact {} -> {}".format(target_path, link_to))
+    await context.temp_queue.createArtifact(*args)
+
+
 def _craft_artifact_put_headers(content_type, encoding=None):
     log.debug("{} {}".format(content_type, encoding))
     headers = {aiohttp.hdrs.CONTENT_TYPE: content_type}

{scriptworker-63.1.0 → scriptworker-63.2.0}/src/scriptworker/constants.py

@@ -559,6 +559,7 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                             "project:releng:lando:repo:release": "release",
                             "project:releng:lando:repo:esr115": "esr115",
                             "project:releng:lando:repo:esr140": "esr140",
+                            "project:releng:lando:repo:esr153": "esr153",
                         }
                     ),
                     "glean": immutabledict({"project:mozilla:glean:releng:beetmover:bucket:maven-production": "glean-repo"}),
@@ -645,6 +646,7 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 "/releases/mozilla-release",
                                 "/releases/mozilla-esr115",
                                 "/releases/mozilla-esr140",
+                                "/releases/mozilla-esr153",
                                 "/projects/birch",
                                 # Bug 1821839 hneiva using to test hardened signing
                                 "/projects/maple",
@@ -654,6 +656,7 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 "/releases/mozilla-release",
                                 "/releases/mozilla-esr115",
                                 "/releases/mozilla-esr140",
+                                "/releases/mozilla-esr153",
                                 "/projects/birch",
                                 "/projects/maple",
                                 "/integration/autoland",
@@ -667,9 +670,11 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                             ),
                             "esr115": ("/releases/mozilla-esr115",),
                             "esr140": ("/releases/mozilla-esr140",),
+                            "esr153": ("/releases/mozilla-esr153",),
                             "esr": (
                                 "/releases/mozilla-esr115",
                                 "/releases/mozilla-esr140",
+                                "/releases/mozilla-esr153",
                             ),
                             "nightly": ("/mozilla-central",),
                             "autoland": ("/integration/autoland",),
@@ -681,6 +686,7 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 "/releases/mozilla-release",
                                 "/releases/mozilla-esr115",
                                 "/releases/mozilla-esr140",
+                                "/releases/mozilla-esr153",
                                 # bug 1845368: a permanent project branch for testing updates
                                 "/projects/pine",
                                 "/projects/larch",
@@ -693,6 +699,7 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 "/releases/mozilla-release",
                                 "/releases/mozilla-esr115",
                                 "/releases/mozilla-esr140",
+                                "/releases/mozilla-esr153",
                             ),
                             "all-production-branches-and-autoland": (
                                 "/mozilla-central",
@@ -700,6 +707,7 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 "/releases/mozilla-release",
                                 "/releases/mozilla-esr115",
                                 "/releases/mozilla-esr140",
+                                "/releases/mozilla-esr153",
                                 "/integration/autoland",
                             ),
                         }
@@ -728,6 +736,7 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 "/releases/comm-release",
                                 "/releases/comm-esr115",
                                 "/releases/comm-esr140",
+                                "/releases/comm-esr153",
                             ),
                             "beta": ("/releases/comm-beta",),
                             "release": ("/releases/comm-release",),
@@ -735,14 +744,16 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 "/releases/comm-release",
                                 "/releases/comm-esr115",
                                 "/releases/comm-esr140",
+                                "/releases/comm-esr153",
                             ),
-                            "esr": ("/releases/comm-esr115", "/releases/comm-esr140"),
+                            "esr": ("/releases/comm-esr115", "/releases/comm-esr140", "/releases/comm-esr153"),
                             "all-nightly-branches": (
                                 "/comm-central",
                                 "/releases/comm-beta",
                                 "/releases/comm-release",
                                 "/releases/comm-esr115",
                                 "/releases/comm-esr140",
+                                "/releases/comm-esr153",
                             ),
                             "nightly": ("/comm-central",),
                         }

{scriptworker-63.1.0 → scriptworker-63.2.0}/src/scriptworker/context.py

@@ -59,7 +59,7 @@ class Context(object):
 
     config: Optional[Dict[str, Any]] = None
     credentials_timestamp: Optional[int] = None
-    credentials_fd: int = -1
+    credentials_file = None
     proc: Optional[task_process.TaskProcess] = None
     queue: Optional[Queue] = None
     session: Optional[aiohttp.ClientSession] = None
@@ -99,8 +99,7 @@ class Context(object):
         if claim_task:
             self.task = claim_task["task"]
             self.verify_task()
-            # flags=0 to let the child inherit this fd
-            self.credentials_fd = os.memfd_create("scriptworker_temp_creds", flags=0)
+            self.credentials_file = tempfile.TemporaryFile()
             self.temp_credentials = claim_task["credentials"]
             path = os.path.join(self.config["work_dir"], "task.json")
             assert self.task
@@ -108,8 +107,9 @@ class Context(object):
         else:
             self.temp_credentials = None
             self.task = None
-            os.close(self.credentials_fd)
-            self.credentials_fd = -1
+            if self.credentials_file is not None:
+                self.credentials_file.close()
+                self.credentials_file = None
 
     def verify_task(self) -> None:
         """Run some task sanity checks on ``self.task``."""
@@ -201,7 +201,7 @@ class Context(object):
         if credentials:
             data = json.dumps(credentials, indent=2, sort_keys=True).encode("ascii")
             # use pwrite so we don't confuse the child by changing the file offset
-            assert os.pwrite(self.credentials_fd, data, 0) == len(data)
+            assert os.pwrite(self.credentials_file.fileno(), data, 0) == len(data)
 
     def write_json(self, path: str, contents: Dict[str, Any], message: str) -> None:
         """Write json to disk.

{scriptworker-63.1.0 → scriptworker-63.2.0}/src/scriptworker/cot/verify.py

@@ -41,7 +41,7 @@ from scriptworker.context import Context
 from scriptworker.ed25519 import ed25519_public_key_from_string, verify_ed25519_signature
 from scriptworker.exceptions import BaseDownloadError, CoTError, ScriptWorkerEd25519Error
 from scriptworker.github import GitHubRepository, extract_github_repo_full_name, extract_github_repo_owner_and_name, extract_github_repo_ssh_url
-from scriptworker.log import contextual_log_handler
+from scriptworker.log import contextual_log_handler, get_chain_of_trust_log_filename
 from scriptworker.task import (
     get_action_callback_name,
     get_and_check_tasks_for,
@@ -729,10 +729,7 @@ async def download_cot_artifact(chain, task_id, path):
     link = chain.get_link(task_id)
     log.debug("Verifying {} is in {} cot artifacts...".format(path, task_id))
     if not link.cot:
-        log.warning(
-            'Chain of Trust for "{}" in {} does not exist. See above log for more details. \
-Skipping download of this artifact'.format(path, task_id)
-        )
+        log.warning(f'Chain of Trust for "{path}" in {task_id} does not exist. See above log for more details. Skipping download of this artifact.')
         return
 
     if path not in link.cot["artifacts"]:
@@ -2045,7 +2042,7 @@ async def verify_chain_of_trust(chain, *, check_task=False):
         CoTError: on failure
 
     """
-    log_path = os.path.join(chain.context.config["task_log_dir"], "chain_of_trust.log")
+    log_path = get_chain_of_trust_log_filename(chain.context)
     scriptworker_log = logging.getLogger("scriptworker")
     with contextual_log_handler(
         chain.context,

{scriptworker-63.1.0 → scriptworker-63.2.0}/src/scriptworker/log.py

@@ -115,6 +115,19 @@ def get_log_filename(context: Any) -> str:
     return os.path.join(context.config["task_log_dir"], "live_backing.log")
 
 
+def get_chain_of_trust_log_filename(context: Any) -> str:
+    """Get the chain of trust verification log file path.
+
+    Args:
+        context (scriptworker.context.Context): the scriptworker context.
+
+    Returns:
+        string: chain of trust log file path
+
+    """
+    return os.path.join(context.config["task_log_dir"], "chain_of_trust.log")
+
+
 @contextmanager
 def get_log_filehandle(context: Any) -> Iterator[IO[str]]:
     """Open the log and error filehandles.

{scriptworker-63.1.0 → scriptworker-63.2.0}/src/scriptworker/task.py

@@ -672,7 +672,8 @@ async def run_task(context, to_cancellable_process):
     env["TASK_ID"] = context.task_id or "None"
     env["RUN_ID"] = str(get_run_id(context.claim_task))
     env["TASKCLUSTER_ROOT_URL"] = context.config["taskcluster_root_url"]
-    env["TASKCLUSTER_CREDENTIALS_FD"] = str(context.credentials_fd)
+    credentials_fd = context.credentials_file.fileno()
+    env["TASKCLUSTER_CREDENTIALS_FD"] = str(credentials_fd)
     kwargs = {
         "stdout": PIPE,
         "stderr": PIPE,
@@ -680,7 +681,7 @@ async def run_task(context, to_cancellable_process):
         "close_fds": True,
         "preexec_fn": lambda: os.setsid(),
         "env": env,
-        "pass_fds": (context.credentials_fd,),
+        "pass_fds": (credentials_fd,),
     }  # pragma: no branch
 
     timeout = get_task_maxruntime(context.task, context.config["task_max_timeout"])

{scriptworker-63.1.0 → scriptworker-63.2.0}/src/scriptworker/worker.py

@@ -8,6 +8,7 @@ Attributes:
 
 import asyncio
 import logging
+import os
 import signal
 import socket
 import sys
@@ -17,12 +18,13 @@ from typing import Any
 import aiohttp
 import arrow
 
-from scriptworker.artifacts import upload_artifacts
+from scriptworker.artifacts import create_link_artifact, upload_artifacts
 from scriptworker.config import get_context_from_cmdln
 from scriptworker.constants import STATUSES
 from scriptworker.cot.generate import generate_cot
 from scriptworker.cot.verify import ChainOfTrust, verify_chain_of_trust
 from scriptworker.exceptions import ScriptWorkerException, WorkerShutdownDuringTask
+from scriptworker.log import get_chain_of_trust_log_filename
 from scriptworker.task import claim_work, complete_task, prepare_to_run_task, reclaim_task, run_task, worst_level
 from scriptworker.task_process import TaskProcess
 from scriptworker.utils import cleanup, filepaths_in_dir, scriptworker_session
@@ -53,7 +55,21 @@ async def do_run_task(context, run_cancellable, to_cancellable_process):
     try:
         if context.config["verify_chain_of_trust"]:
             chain = ChainOfTrust(context, context.config["cot_job_type"])
-            await run_cancellable(verify_chain_of_trust(chain))
+            try:
+                await run_cancellable(verify_chain_of_trust(chain))
+            except Exception:
+                # Point live_backing.log at chain_of_trust.log so Treeherder parses the CoT failure
+                if os.path.exists(get_chain_of_trust_log_filename(context)):
+                    try:
+                        await create_link_artifact(
+                            context,
+                            target_path="public/logs/live_backing.log",
+                            link_to="public/logs/chain_of_trust.log",
+                            content_type="text/plain",
+                        )
+                    except Exception as link_exc:
+                        log.exception("Failed to create live_backing.log link artifact: {}".format(link_exc))
+                raise
         status = await run_task(context, to_cancellable_process)
         generate_cot(context)
     except asyncio.CancelledError: