You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
depot_tools/cipd_manifest.versions

515 lines
17 KiB
Plaintext

[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
# This file is auto-generated by 'cipd ensure-file-resolve'.
# Do not modify manually. All changes will be overwritten.
chromiumos/infra/crosjobs/linux-amd64
git_revision:ed616d595eb7241d39d34907050d2949121d6ae8
_vAeU0Q9lAxn933K8vDhwGK40zKVvV-yXGpIy43ATXAC
infra/3pp/tools/ninja/linux-amd64
version:2@1.8.2.chromium.3
PUvdixKxFO_KVk9d6WFpXLVDMM0MHv86jyyySTMQ7KIC
infra/3pp/tools/ninja/mac-amd64
version:2@1.8.2.chromium.3
w-R-1UrTQJ2UPgSjcqXMayjE6pf76XpXE434rOY1EC8C
infra/3pp/tools/ninja/mac-arm64
version:2@1.8.2.chromium.3
nVO-Kzyky9nfG4pRb3Qo7KdxyoEXjdwuOhVwy-h0rbMC
infra/3pp/tools/ninja/windows-amd64
version:2@1.8.2.chromium.3
HLdWFKyFMpFQO3VFSps1gevQGwY95hEBUFblIfDux5QC
infra/chromeperf/pinpoint/linux-386
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
maajkZJ8vTrebCH20SasSCaQ4XnSSudDFSXEaY3CBYQC
infra/chromeperf/pinpoint/linux-amd64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
iaUmYzrk8aiprULbAf8NdCiYVp_8iitWUjYPg_41Nk4C
infra/chromeperf/pinpoint/linux-arm64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
6evc6slMI_Arj0BaVb-_p2_E1jPqArBmXlssHXjHqKkC
infra/chromeperf/pinpoint/linux-armv6l
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
Cd6PDAsOfHhYMDEkjRwDClbFzpA0Qmr_KWMIhXI1N0sC
infra/chromeperf/pinpoint/linux-mips64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
GakP5Gtq9WtWDZ720XBuM3_XlOa0ENY56aCkJGGa7LcC
infra/chromeperf/pinpoint/linux-mips64le
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
neRhfr_N1giqM5vbgM7gadyznUIxrEeh1JdkLdViOa8C
infra/chromeperf/pinpoint/linux-mipsle
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
3dhM1zF2m6y606OSx5X8wyqj0CMpbem6GAENbx9Ro20C
infra/chromeperf/pinpoint/linux-ppc64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
MGe3qRMljGY1Y8J7UyCJo4fdoHAabp8NiluBSXlclC0C
infra/chromeperf/pinpoint/linux-ppc64le
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
ayuIE_2DcoLk5C85Pq6iQNk-ip-WadIhxnmrNKy6xUoC
infra/chromeperf/pinpoint/linux-s390x
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
cX25NHyRWRYdUab3B2274u5xtpfgedsSwvzcoNShpgAC
infra/chromeperf/pinpoint/mac-amd64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
eZMujRaZvGl7wBhQfUEuoihWWt2rxx9bPhiENFmoYzsC
infra/chromeperf/pinpoint/mac-arm64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
c2KZT-7q8LLDNEdYbqWF33FfXI5PrI8v9Ly92_rRCVkC
infra/chromeperf/pinpoint/windows-amd64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
zvmJOlA_DT_jJLVhgrxh2WjdXeHxrS6CoZaqk8MBprUC
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/goma/client/linux-amd64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
6Y07e3jfmsZxbLAtc4KDy2UoPfyIvcxSHi6A9Vl9GH0C
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/goma/client/mac-amd64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
bljk9GK5_oJUf8SnPqJdxH8Sv_uM0J3ZJ_SNkANmw20C
infra/goma/client/mac-arm64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
y_gGqoqlUoj2BeMWuVIgL4Tq0B-sC3snxlsv3IYS2ZMC
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/goma/client/windows-amd64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
Zmg4HmmXWQYQr7QfZX815Wvdsz26jsgItRRiDbzGjLAC
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/tools/bb/linux-386
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
JdUJYBAY7-VBj-TAi_1UbhnsrF8BmxnC5y5uFJRKH0QC
infra/tools/bb/linux-amd64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
KQYkgilGGhktMxFGm_-ramensPrZZsZnEXr6rb0uiMMC
infra/tools/bb/linux-arm64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
Y_FZxUGyZ_YcXr-FhpwYsCpaxYUNi-QXNKmb34WZ6dwC
infra/tools/bb/linux-armv6l
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
V26xnVN_1rk2WCKN-3uadIKZPvukAcaPsC3qYF-WyrsC
infra/tools/bb/linux-mips64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
LkvMpt85kbkLQv9BBK_7yTpI1QBA6GBNk6BwYKB_MN8C
infra/tools/bb/linux-mips64le
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
BdtHoHC7h06OtQsiqLMg4z2yjLHTyjGP-tF7ZT37Mq8C
infra/tools/bb/linux-mipsle
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
9DJrhZzTS1Q58Ct0AcHigREr5i80dCoEqFXvYndLoj8C
infra/tools/bb/linux-ppc64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
djPVD8BMizBn2lkVM2-4KxYbist_ERvRA3IZnoRBicIC
infra/tools/bb/linux-ppc64le
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
QYlzsPuZwKGYoUMoBE2nhv5DkGsBCMFKeenjEEM4r5oC
infra/tools/bb/linux-s390x
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
T2UUXfoq2o8EX8-eJTSUDutnvE2EOnWB07xKX-vB3FAC
infra/tools/bb/mac-amd64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
I-NLtgWw13LF_gDnHtsbWu_hsdbpeNLhUhQmSfR0ZWoC
infra/tools/bb/mac-arm64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
8IJE1qk97Uj5hj2KIJYSeFQi8hdBd5SBTty_VPJZnGQC
infra/tools/bb/windows-amd64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
_hrpGUOTDT7dmw2xRhs-XzCIHeCB8jS3TCa63Q5kAQUC
infra/tools/dirmd/linux-386
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
9FPf08gYWeOCweTSUhSxIOSpE1snA30_uPBZpcrK4CkC
infra/tools/dirmd/linux-amd64
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
kX-pDpZtrKTrHNa8WDNGHWLMBbgb-4xT1cM52J72StsC
infra/tools/dirmd/linux-arm64
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
bKDJZ9EGkzA44NS1ic7wXa-LAw4obTAv7z5EaThnRu8C
infra/tools/dirmd/linux-armv6l
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
SIVl96BSJ9vGNcv_clmeAJiHP6-gAZZ_RSX1IkTmXFQC
infra/tools/dirmd/linux-mips64
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
MoyaZPlbKQR5FujdYuAsLJ_iwN6_M88N2dDvf0tjW7cC
infra/tools/dirmd/linux-mips64le
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
2FXEhYbKdvBJv9PGMVU8GqS126Zw6khFJQzGggdE02QC
infra/tools/dirmd/linux-mipsle
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
YHS_e28sKA0QE715Ud05kfJhZMY8blERGNPq-NeQcBIC
infra/tools/dirmd/linux-ppc64
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
BDOS27yPng6INBxzkPXQeGl2UhswNOaiBq9NDjL_oXAC
infra/tools/dirmd/linux-ppc64le
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
Z75R7n6FtI5tpd8AalXlolkQamaPnauytJWbveCOfVcC
infra/tools/dirmd/linux-s390x
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
oBDaWetunjP-rtxGI4_5zQesUGe2T8WZ9n1GDX5R48sC
infra/tools/dirmd/mac-amd64
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
bTd0927LCPwJwndgtfb8rubPiZxgfGNlFgCY_lqx6U8C
infra/tools/dirmd/mac-arm64
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
hXOmxaKfURLlWal5jw46INI65Q7Ua41zCr76y-uz-o8C
infra/tools/dirmd/windows-amd64
git_revision:5242fcd971c12d801210fe0490126091cc4a551b
pEzvPk7Naw3egyHPTDjqK3WbetGiJjYZMkDDFaYRFdwC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-386
git_revision:297491c0babda68d84d8240c9d4504be671bc804
eP17h5YJMrU6hWBOvjZxWCz5h9SgkkW-vVF7W-L9qwIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-amd64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
Xf6nFp5RbFKQLUk7d3O5LKPmmdnAF8NU4NsoO0QGP1UC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-arm64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
owOKUdyWr11KyfuCRigGRsBM7uPnOMVrH_WOMYYCGJYC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-armv6l
git_revision:297491c0babda68d84d8240c9d4504be671bc804
iZa8O1smpKFTta3pQVz9TaIOlRIu31V4QPgGbIVkCgYC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-mips64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
s6dXt6MAJ8kreqm79HyghgHg9mk93u8ju303d1RIZ4cC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-mips64le
git_revision:297491c0babda68d84d8240c9d4504be671bc804
K2S9QpIR4701H7N2E6Fm9iGCOg8hwa3mY51S1CmrwdEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-mipsle
git_revision:297491c0babda68d84d8240c9d4504be671bc804
0jLzmuxOsRVyYofMKQfgivPZOtxsXv0Slcr1dRU78UgC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-ppc64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
7SK4rFVEOeA4CqHD0mKebTOCx7viE-dJMakFqE6W6BsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-ppc64le
git_revision:297491c0babda68d84d8240c9d4504be671bc804
ZruNFqBhC_reTL2dw3wf-t17dc_sPZJ_733R6BLBvMsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-s390x
git_revision:297491c0babda68d84d8240c9d4504be671bc804
8q6NmriGR1GiT9e-UlHeau2VMkcN0UYumU8AVDLIsZMC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/mac-amd64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
pxk-T_GADDuTTtmbUsK3TlMHbsMD8jb5Dt383XPmeeYC
infra/tools/luci-auth/mac-arm64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
cR0PKTchP7f5iIXZdCSffnp_p1_ySee-16Gg56qhxqIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/windows-amd64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
McEKBb2FM2gMj1og3guOfA_jd690eGivhdSbKP90ruwC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-386
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
zSFGw9XzmOL7vNYKz3egrrgmUNkdz_g_z9rjLnNMIwEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-amd64
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
xg1eYJ5iG47DiASZ5UQPMtjgLWzfWJysKbUR4Wwvo00C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-arm64
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
UxzJu-9G4xwhW89FSh8WWFrf2x3ubhQGRHROJD_1BbwC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-armv6l
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
vg6-VArUOypdgP6yMFvz6L0Zl1fBt7wOrKeFH76h3uIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-mips64
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
cripZG37qFtrsledTobLylAiqFfOPRH5OCYS6ExJ8r8C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-mips64le
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
-hOsDaQOO3vUseWusEOJa1lkrTkEbBaFyQmX7ki97cQC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-mipsle
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
COUEy6MAB5gV2S8YAY3myvLDyXg8KsY0oae3MJ50Ce0C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-ppc64
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
wSotYk1_-lT6mwX9fn123AJfDgnstPS38mu6whsDmZMC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-ppc64le
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
IAFaAk0858TOa1D2lXMeqWnBIFBiv11BjvkKwEobjZQC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-s390x
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
AQssg5ZsBVlKdI3ojA9INeiiAACXUFcqfHRzYv0CzsEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/mac-amd64
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
VSTfZXsshGFN-wYga6DgwYFOnC6cwWL_1tDw43FJd2MC
infra/tools/luci/led/mac-arm64
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
iSH-WmxqVvF7BDcGZUV7PEiMA3viGa9YMaRtoa6POAEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/windows-amd64
git_revision:675ae8e961c277222f676827af22af1f7b5f0a41
lvBhpYjyPscFXgt2-Rs9n8O_OlslcZK0ItiQlAddGscC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/lucicfg/linux-386
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
G6TOBimJq0kFydiv0jrdRIJ6efZX_ho_hJCTu_QK074C
infra/tools/luci/lucicfg/linux-amd64
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
pUlQ7tJwmfa_aHYvz_lPhbNZMnvZ-GqoQGEmfLVWiUAC
infra/tools/luci/lucicfg/linux-arm64
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
pKuUY-T9jS9L3TRg_EDY7tCL1t-_3lOMks77RsDjwskC
infra/tools/luci/lucicfg/linux-armv6l
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
fG2ThosnJTXnFs7UbYwCTTBUrAAjP5aLifIoC0QwfmYC
infra/tools/luci/lucicfg/linux-mips64
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
3Bw8hfnxBLDR-UvpsdDFqLO2duRUpuUeu2RrnAtUJnMC
infra/tools/luci/lucicfg/linux-mips64le
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
jgRw3cz4QhVzF_E1jLyuKDGPVvNs8bPGLsEtGCWb1nUC
infra/tools/luci/lucicfg/linux-mipsle
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
4UfVMjsN-XYkfKoWyZOaud92mA4ossQlr4Lg3sxT_QAC
infra/tools/luci/lucicfg/linux-ppc64
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
7WOQJoL7EkZ96zXjMCiqTLusbx7KAlR5GbVpeWo5KnAC
infra/tools/luci/lucicfg/linux-ppc64le
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
8gLpthJ-j-4_6PWGgmL5ohO_n3oU8D8kuFOY6J6EYQMC
infra/tools/luci/lucicfg/linux-s390x
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
438sj_pZZgsAjjWMCEPxW_vT_8XFQ1rM5H-VKJ5vGNwC
infra/tools/luci/lucicfg/mac-amd64
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
NJu6mBIS1FEQiuYHRPe0O2kIGxdhUs2EjyrOGTckzqkC
infra/tools/luci/lucicfg/mac-arm64
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
ekTYcijeC3Hv8VW5ph5vthv6QkJ0tGD6IjtC176x8HYC
infra/tools/luci/lucicfg/windows-amd64
git_revision:a765afe43452777b7f0c6ea21aa45a776ecc9e51
ILfiGCvcbeleMl03TSEVxky4WFMfSuFtvh3Pu9qytHEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-386
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
Kfwv-ninAitZN2lDaTLhjDkZSlxowo1Bb2pKqB0DKykC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-amd64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
0EmvufYSO4poeyc4HK9_HG6wT2UYDY-72RKTc6hyt2QC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-arm64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
B5Kx4gOi4nd7-KV7h7-Cpfv0xCp59O_VNvoOvnXF0XsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-armv6l
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
kQmD5w8uAfJd77Npyw43a7U05o1Tyd1vkCXjEs5f_B4C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-mips64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
0ADoqkLRY-7opXErUjdgZ5_wZPuDHjJE8_qUqUGsFbIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-mips64le
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
FDkkcfs8WCG-RN2j8w6oCoU3FpO_AUAL-K2Q4TDZTBcC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-mipsle
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
0kuTocrPzv19Ary4VvFs0aaIxhq_h64RJoFmf988f8sC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-ppc64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
e3QhhnuK9ShMXhvYFYJ_R7N_wdU92Xkr8laDuGXlIvUC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-ppc64le
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
E-jnGvKPR-SDDbcZxL6ek7k-8ls-xP0TUqwu7RuKDUsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-s390x
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
iz_aI2P5MzFwInZ6JogXptvee2RiAqkdF3bNLyYXlw0C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/mac-amd64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
Bok7GiNkjMXhzME9k-0flydzzK-0hiNoqNTl1VUantAC
infra/tools/luci/vpython/mac-arm64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
H611WwzO3XAZO3GjA8sHVHHAn_yZCHaPyFRJaTuu2_sC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/windows-amd64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
ecbKVz8gqRIOf8HGdgBkp-2F7CLXV4nU9Knek2DAWukC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/mac_toolchain/mac-amd64
git_revision:723fc1a6c8cdf2631a57851f5610e598db0c1de1
2ozLryqklxu4fc7KZr_EqEpL66z0G0moWJef2qnPXXwC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/mac_toolchain/mac-arm64
git_revision:723fc1a6c8cdf2631a57851f5610e598db0c1de1
1VL13oNQ2PA-Ez2iYTQOWHFcXwA9UD_nhKdhqXsJw-MC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-386
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
0jh5WJiKY3YuD_Jb8PqwvoEpkIErWxDjPK1zHJt7AWsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-amd64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
ifuMgrBw52FZoNeCoOOBKJnEOVZissbo16oyfdNNFR4C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-arm64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
37GBPQH01OFQ_mNexmZL4JXvTJrJZ6lupI2oipo7NygC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-armv6l
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
p5RXqsNOyauZgCE7fUiaJjjvfiyOaduXWxsPi79jSusC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-mips64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
5vO0g5QLGwZINTFQjnhKEEMDTaQ2geUUP16w3T7icicC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-mips64le
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
FV4lcmPr2Y3qx5dC85IxvN6j26tgBTIZY3KL3OO6ggQC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-mipsle
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
ZLw57efe_OTsHW_Sl5W2tK29zOx2xEi7m6XqQVEAS6EC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-ppc64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
1KLg18xHw43xbVYfPMPXBhqANzzRwP3aYRl0wi3qohIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-ppc64le
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
hKB-qdoedy6YFlpMY_B2sNmhdoJzQbcRRU-ivr_nPZsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-s390x
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
Z8errTmVek00stSE8njJ4agFHThZWdziTgN5qpNDFbcC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/mac-amd64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
SyQL0RzHkWotXKicxXx49tVIBYW56N-NeDSB046eXwkC
infra/tools/prpc/mac-arm64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
M2wFOESsz-1S_BtbL2dKzUhxAspQa1OolA-J954ggjQC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/windows-amd64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
pZ4PpzsgPaEjhtfUbbynrRQQ6e7zNBnEWnKn6aupqyQC
infra/tools/rdb/linux-386
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
eDoqUjRGHF4ih93bdiPvijigjMx8ZNPkSbL9aREBG_8C
infra/tools/rdb/linux-amd64
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
Iw1aBdqkvl57IqJXQfuM3ssu9YjdCfPOJiQCKv0WpmIC
infra/tools/rdb/linux-arm64
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
abXyEPXDjcuichfl5QMwOvKi5VBUQPrSTePVBYLDDKAC
infra/tools/rdb/linux-armv6l
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
SBHSyvNUjk4DpAByORG6p_AEMnOsiM47bShjq4mF-6gC
infra/tools/rdb/linux-mips64
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
1DF6OpBG2PQcbdtM1dadIDrNo6p9mm2DpxjKEOTP-dwC
infra/tools/rdb/linux-mips64le
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
lSonkIpZX_egKXaCZ1Lg717sGgIFpxNHjSKXX7q0aY4C
infra/tools/rdb/linux-mipsle
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
WnybWh2l6kMLXzI1k0oGWUv8Z6q8x4pLEvuf_R3L0vAC
infra/tools/rdb/linux-ppc64
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
tq0sHVhEQuzvEIOVDp5hZJO2lKgkeUSg_cCgVbzVGTwC
infra/tools/rdb/linux-ppc64le
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
jqwomi05VlSpofrDSa_DEtD3MSebRK1kNS5Ot0MDNLYC
infra/tools/rdb/linux-s390x
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
YqaFlu8JsGCF7ylNl5AIKzwpqyN8qIbL17iEWpNX9nAC
infra/tools/rdb/mac-amd64
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
578EwHmFA8y-HceOs-e22rI-kYO2ih4snfHd-XSX2ZYC
infra/tools/rdb/mac-arm64
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
QTOD8mtX2R10jT7TWr9OW4s0m3bMdTW74wY0ocZpD8EC
infra/tools/rdb/windows-amd64
git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
2V2D3yyct-s8XArPSgUUVxS2tvuSQ1CZOwP308EPx4QC