This reverts commit ddd4913fcd.
Revert "Bug 2035606 - Add caching support to make_incremental_zucchini.py r=releng-reviewers,bhearsum"
This reverts commit 0da5f4228e.
Revert "Bug 2035606 - Split en-US and l10n zucchini tasks into their own kinds r=releng-reviewers,ahal"
This reverts commit 174c47ef6b.
Revert "Bug 2036179 - Move make_incremental_zucchini script to tools/update-packaging r=releng-reviewers,bhearsum"
This reverts commit 1c4d5aff21.
The zucchini partial generation script (make_incremental_zucchini.py) was
compressing patch entries with `xz -9 -e`, which encodes a 64 MiB dictionary
in the XZ stream header. The old bspatch pipeline (make_incremental_update.sh)
uses `xz -7 -e` (8 MiB dictionary). On the client side, the xz-embedded
decoder must malloc the full dictionary size regardless of actual data size.
The 8x increase from 8 MiB to 64 MiB is the most likely cause of increased
UNEXPECTED_XZ_ERROR rates observed after deploying zucchini on Nightly,
as the allocation is more likely to fail on memory-constrained systems.
The larger dictionary provides zero benefit: zucchini patches are compact
binary diffs with no long-range redundancy for LZMA2 to exploit. Empirical
verification across all six Nightly platforms (linux-aarch64, linux-x86_64,
mac, win32, win64-aarch64, win64) confirms that -7e produces same-sized
or marginally smaller output than -9e in general.
This patch also maps XZ_MEM_ERROR to the existing ARCHIVE_READER_MEM_ERROR
code instead of the generic UNEXPECTED_XZ_ERROR, so that OOM failures during
XZ decompression are correctly reported as memory allocation errors. This
error code is already checked by isMemoryAllocationErrorCode in
UpdateService.sys.mjs.
Differential Revision: https://phabricator.services.mozilla.com/D288868
The update-verify job no longer checks out the repository. Instead, the
scripts from tools/update-verify and their Python dependencies (mozrelease,
redo) are baked into the Docker image via COPY directives. The shell scripts
now use python3 directly instead of ./mach python.
Overall changes:
- Run update verify tests in a specific workspace directory
- Use `UV_SRC` as the base for other relative imports and references
- COPY required scripts and drop the checkout on update verify docker image
- Run update verify with python directly instead of mach
Differential Revision: https://phabricator.services.mozilla.com/D288300
code_cache_generator requires libxcb.so.1 at build time for WebUI code
cache generation but it wasn't in the Docker image. Adding this fixes
this while keeping Linux chromium builds consistent with all other
platforms we currently run.
Also the autoninja retry is removed as it was an attempt to mask a real
failure (Bug 2021140) but didn't end up being helpful.
Root cause of intermittent nature of this is still unclear.
Differential Revision: https://phabricator.services.mozilla.com/D291026
The parent image is now (since bug 1719607, 4.5 years ago) based on
another in-tree image so there's no need for a reminder here to update
to the next ubuntu LTS.
Differential Revision: https://phabricator.services.mozilla.com/D288934
While it would be strictly ideal to do it, requiring both MARs to be signed with the same certificate means that `partials` tasks cannot work on Try without 2 try runs (one to generate completes signed with the dep cert, another that generates partials). Disabling this allows us to generate partials off of production releases, which speeds up testing cycles.
Differential Revision: https://phabricator.services.mozilla.com/D287755
Remove p7zip-full and redundant 7zip from Docker images, drop the fallback
binary names from moz.configure, and update win/run.sh to use the fetched
7zz toolchain binary.
Differential Revision: https://phabricator.services.mozilla.com/D288116
Remove p7zip-full and redundant 7zip from Docker images, drop the fallback
binary names from moz.configure, and update win/run.sh to use the fetched
7zz toolchain binary.
Differential Revision: https://phabricator.services.mozilla.com/D288116
Split the hsts/hpkp pinning update (hfu) from the other periodic file
updates (pfu) into separate tasks and cron jobs. The pinning update runs
on central/beta/esr while the periodic update runs on all branches including
release.
Fix the patch abandonment logic in periodic_file_updates.sh to only abandon
patches of the matching type, preventing pinning and periodic updates from
abandoning each other's open Phabricator revisions.
Also enables esr140 for both jobs (bugs 1965205 and 1965206).
Differential Revision: https://phabricator.services.mozilla.com/D284835
This reverts commit 0382300c2d.
Revert "Bug 2015841 - ruff: fix 'String is split more times than necessary' r=linter-reviewers,ahal,sergesanspaille"
This reverts commit 1e0b4c3c7b.
Revert "Bug 2015841 - Reformat the code with ruff-format 0.15.0 r=linter-reviewers,perftest-reviewers,mozperftest-reviewers,releng-reviewers,sessionstore-reviewers,dom-storage-reviewers,dom-worker-reviewers,whimboo,chutten,ahal,sparky,sclements"
This reverts commit 15a20a737e.
Revert "Bug 2015841 - Update to ruff 0.15.0 r=linter-reviewers,ahal"
This reverts commit 4b0785d39e.
This reverts commit 5eca473e96.
Revert "Bug 2015841 - ruff: fix 'String is split more times than necessary' r=linter-reviewers,ahal,sergesanspaille"
This reverts commit 654a09320c.
Revert "Bug 2015841 - Reformat the code with ruff-format 0.15.0 r=linter-reviewers,perftest-reviewers,mozperftest-reviewers,releng-reviewers,sessionstore-reviewers,dom-storage-reviewers,dom-worker-reviewers,whimboo,chutten,ahal,sparky,sclements"
This reverts commit 93b38f0d79.
Revert "Bug 2015841 - Update to ruff 0.15.0 r=linter-reviewers,ahal"
This reverts commit cc04e8271b.
Move and refactor the zucchini partial MAR generator to support
certificate-based signature verification and URL validation.
Changes to make_incremental_zucchini.py:
- Move from tools/update-packaging/ to taskcluster/docker/partials-zucchini/
- Add URL validation with allowlist for download sources
- Add MAR signature verification using public key certificates
- Add MAR channel ID validation
- Refactor CLI: --from_url → --from-mars-json (JSON with version info)
- Add args: --branch, --cert-path, --mar-channel-id, --allow-staging-urls
- Standardize arg names (underscores to hyphens)
- Fix manifest version field: use application.ini instead of platform.ini
Changes to partials_zucchini.py transform:
- Add identify_desired_signing_keys() to determine cert type per branch
- Build --from-mars-json with previousVersion data
- Pass certificate path based on signing type
- Pass mar-channel-id and branch parameters
- Remove MAR_CHANNEL_ID environment variable
Changes to kind.yml:
- Use new partials-zuc docker image
- Update script path to /builds/worker/bin/make_incremental_zucchini.py
- Remove run-on-projects: [] restriction (still gated by shipping-phase)
- Remove obsolete environment variables
Differential Revision: https://phabricator.services.mozilla.com/D279010
Create deb13-partials-zuc Docker image with dependencies for MAR signature verification:
- Python mar library for reading and verifying MAR files
- Adds public key certificates (nightly, release, dep) during docker image creation
- Certificates added to /builds/worker/workspace/keys/
Differential Revision: https://phabricator.services.mozilla.com/D279009
Tom Ritter