Page MenuHomePhabricator

Jenkins needs the ability to sign tarballs
Closed, DeclinedPublic

Description

We need the ability to sign tarballs automatically. Using this ticket to track what needs to be done and by whome. Assigning to Antoine for now since he is the Jenkins guy.


Version: unspecified
Severity: normal

Details

Reference
bz62391

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 2:51 AM
bzimport set Reference to bz62391.
bzimport added a subscriber: Unknown Object (MLST).

Since we've had a number of conversations around this, let me enumerate the options we've talked about. We probably need to just pick a strategy and try it:

  1. The "Jenkins" who does the signing is a private/secured version where we feel comfortable keeping a private key.
  2. We put the signing key in an hsm in the datacenter, and make sure someone audits/watches what is being signed.
  3. Jenkins signs with a key only to say, "This is what Jenkins built". It's up to someone in the release process to verify and sign the tarballs to assert that someone is pretty sure the tarballs were built correctly.

I do not have any free time in March to handle release tarballs / securing Jenkins. If someone else can take the lead there that would be much appreciated. We can most probably use a private Jenkins server for ops/analytics/mw tarball usage. They all have the same need apparently.

Resetting assignee, I am not working on this.

hashar lowered the priority of this task from Medium to Lowest.Nov 24 2014, 10:14 AM
hashar set Security to None.
hashar claimed this task.

This has been going for 2+ years now. The context was to automatically build the tarballs from Jenkins. If we wanted to achieve this we would most probably need a dedicated Jenkins instance to handle it.

The MediaWiki releases are now handled by Release-Engineering-Team and we produce / sign them manually.

Hence this task is essentially moot: we will not bother making the signing automatic.

Yeah, and just for more context: to do this right we'd need support from Chris S and the Security team, which we won't get for a while anyways. It's just not a priority right now (with my personal FLOSS project health hat on, I wish it were).