scriptworker 63.4.3__tar.gz → 63.4.4__tar.gz

{scriptworker-63.4.3 → scriptworker-63.4.4}/HISTORY.rst

@@ -4,6 +4,14 @@ Change Log
 All notable changes to this project will be documented in this file.
 This project adheres to `Semantic Versioning <http://semver.org/>`__.
 
+63.4.4 - 2026-09-08
+-------------------
+
+Fixed
+~~~~~
+
+- Add chain-of-trust check against generic-worker's "interactive" feature (#828)
+
 63.4.3 - 2026-09-02
 -------------------
 

{scriptworker-63.4.3 → scriptworker-63.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scriptworker
-Version: 63.4.3
+Version: 63.4.4
 Summary: Taskcluster scriptworker
 Author-email: Mozilla Release Engineering <releng@mozilla.com>
 License-File: LICENSE

{scriptworker-63.4.3 → scriptworker-63.4.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "scriptworker"
-version = "63.4.3"
+version = "63.4.4"
 description = "Taskcluster scriptworker"
 authors = [
     { name = "Mozilla Release Engineering", email = "releng@mozilla.com" },

{scriptworker-63.4.3 → scriptworker-63.4.4}/src/scriptworker/cot/verify.py

@@ -493,6 +493,7 @@ def check_interactive_docker_worker(link):
 def check_interactive_generic_worker(link):
     """Given a task, make sure the task was not defined as interactive.
 
+    * ``task.payload.features.interactive`` must be absent or False.
     * ``task.payload.rdpInfo`` must be absent or False.
     * ``task.payload.scopes`` must not contain a scope starting with ``generic-worker:allow-rdp:``
 
@@ -506,6 +507,8 @@ def check_interactive_generic_worker(link):
     errors = []
     log.info("Checking for {} {} interactive generic-worker".format(link.name, link.task_id))
     try:
+        if link.task["payload"].get("features", {}).get("interactive"):
+            errors.append("{} is interactive: task.payload.features.interactive!".format(link.name))
         if link.task["payload"].get("rdpInfo"):
             errors.append("{} is interactive: task.payload.rdpInfo!".format(link.name))
         for scope in link.task["scopes"]: