You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
depot_tools/cipd_manifest.versions

515 lines
17 KiB
Plaintext

[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
# This file is auto-generated by 'cipd ensure-file-resolve'.
# Do not modify manually. All changes will be overwritten.
chromiumos/infra/crosjobs/linux-amd64
git_revision:ed616d595eb7241d39d34907050d2949121d6ae8
_vAeU0Q9lAxn933K8vDhwGK40zKVvV-yXGpIy43ATXAC
infra/3pp/tools/ninja/linux-amd64
version:2@1.8.2.chromium.3
PUvdixKxFO_KVk9d6WFpXLVDMM0MHv86jyyySTMQ7KIC
infra/3pp/tools/ninja/mac-amd64
version:2@1.8.2.chromium.3
w-R-1UrTQJ2UPgSjcqXMayjE6pf76XpXE434rOY1EC8C
infra/3pp/tools/ninja/mac-arm64
version:2@1.8.2.chromium.3
nVO-Kzyky9nfG4pRb3Qo7KdxyoEXjdwuOhVwy-h0rbMC
infra/3pp/tools/ninja/windows-amd64
version:2@1.8.2.chromium.3
HLdWFKyFMpFQO3VFSps1gevQGwY95hEBUFblIfDux5QC
infra/chromeperf/pinpoint/linux-386
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
maajkZJ8vTrebCH20SasSCaQ4XnSSudDFSXEaY3CBYQC
infra/chromeperf/pinpoint/linux-amd64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
iaUmYzrk8aiprULbAf8NdCiYVp_8iitWUjYPg_41Nk4C
infra/chromeperf/pinpoint/linux-arm64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
6evc6slMI_Arj0BaVb-_p2_E1jPqArBmXlssHXjHqKkC
infra/chromeperf/pinpoint/linux-armv6l
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
Cd6PDAsOfHhYMDEkjRwDClbFzpA0Qmr_KWMIhXI1N0sC
infra/chromeperf/pinpoint/linux-mips64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
GakP5Gtq9WtWDZ720XBuM3_XlOa0ENY56aCkJGGa7LcC
infra/chromeperf/pinpoint/linux-mips64le
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
neRhfr_N1giqM5vbgM7gadyznUIxrEeh1JdkLdViOa8C
infra/chromeperf/pinpoint/linux-mipsle
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
3dhM1zF2m6y606OSx5X8wyqj0CMpbem6GAENbx9Ro20C
infra/chromeperf/pinpoint/linux-ppc64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
MGe3qRMljGY1Y8J7UyCJo4fdoHAabp8NiluBSXlclC0C
infra/chromeperf/pinpoint/linux-ppc64le
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
ayuIE_2DcoLk5C85Pq6iQNk-ip-WadIhxnmrNKy6xUoC
infra/chromeperf/pinpoint/linux-s390x
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
cX25NHyRWRYdUab3B2274u5xtpfgedsSwvzcoNShpgAC
infra/chromeperf/pinpoint/mac-amd64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
eZMujRaZvGl7wBhQfUEuoihWWt2rxx9bPhiENFmoYzsC
infra/chromeperf/pinpoint/mac-arm64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
c2KZT-7q8LLDNEdYbqWF33FfXI5PrI8v9Ly92_rRCVkC
infra/chromeperf/pinpoint/windows-amd64
git_revision:53d72e5099bc6f080370ae5f23560383027b947f
zvmJOlA_DT_jJLVhgrxh2WjdXeHxrS6CoZaqk8MBprUC
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/goma/client/linux-amd64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
6Y07e3jfmsZxbLAtc4KDy2UoPfyIvcxSHi6A9Vl9GH0C
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/goma/client/mac-amd64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
bljk9GK5_oJUf8SnPqJdxH8Sv_uM0J3ZJ_SNkANmw20C
infra/goma/client/mac-arm64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
y_gGqoqlUoj2BeMWuVIgL4Tq0B-sC3snxlsv3IYS2ZMC
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/goma/client/windows-amd64
git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
Zmg4HmmXWQYQr7QfZX815Wvdsz26jsgItRRiDbzGjLAC
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
6 years ago
infra/tools/bb/linux-386
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
JdUJYBAY7-VBj-TAi_1UbhnsrF8BmxnC5y5uFJRKH0QC
infra/tools/bb/linux-amd64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
KQYkgilGGhktMxFGm_-ramensPrZZsZnEXr6rb0uiMMC
infra/tools/bb/linux-arm64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
Y_FZxUGyZ_YcXr-FhpwYsCpaxYUNi-QXNKmb34WZ6dwC
infra/tools/bb/linux-armv6l
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
V26xnVN_1rk2WCKN-3uadIKZPvukAcaPsC3qYF-WyrsC
infra/tools/bb/linux-mips64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
LkvMpt85kbkLQv9BBK_7yTpI1QBA6GBNk6BwYKB_MN8C
infra/tools/bb/linux-mips64le
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
BdtHoHC7h06OtQsiqLMg4z2yjLHTyjGP-tF7ZT37Mq8C
infra/tools/bb/linux-mipsle
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
9DJrhZzTS1Q58Ct0AcHigREr5i80dCoEqFXvYndLoj8C
infra/tools/bb/linux-ppc64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
djPVD8BMizBn2lkVM2-4KxYbist_ERvRA3IZnoRBicIC
infra/tools/bb/linux-ppc64le
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
QYlzsPuZwKGYoUMoBE2nhv5DkGsBCMFKeenjEEM4r5oC
infra/tools/bb/linux-s390x
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
T2UUXfoq2o8EX8-eJTSUDutnvE2EOnWB07xKX-vB3FAC
infra/tools/bb/mac-amd64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
I-NLtgWw13LF_gDnHtsbWu_hsdbpeNLhUhQmSfR0ZWoC
infra/tools/bb/mac-arm64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
8IJE1qk97Uj5hj2KIJYSeFQi8hdBd5SBTty_VPJZnGQC
infra/tools/bb/windows-amd64
git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
_hrpGUOTDT7dmw2xRhs-XzCIHeCB8jS3TCa63Q5kAQUC
infra/tools/dirmd/linux-386
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
LUOIOIKF9t_3WAJVOmnn4VQkqVtjqsSp2RA7-nKE-uEC
infra/tools/dirmd/linux-amd64
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
UDobpzFcgd5a422WBg6QCiD2mh1hIp19GTkafykKgFEC
infra/tools/dirmd/linux-arm64
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
NIOZCFCygolit6e4zAfil9IbLR6W1n0C1r6L62BRn9AC
infra/tools/dirmd/linux-armv6l
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
EGrGHHHzIjo3AFRjeW_-T4fsYm2I0mMkgtNqU-zQFeoC
infra/tools/dirmd/linux-mips64
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
mmVWrqrcCjDAUxFkPGJjvpey3RkSRXHuRhx8VIttNKsC
infra/tools/dirmd/linux-mips64le
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
x7KOFDc674odT1EKMUOP4I8z7Umu7eFhgzcAPjjBqw8C
infra/tools/dirmd/linux-mipsle
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
yK6E2KOEciBTT1DHW0GxG3Tu8sRoWmMI-cAtur4fbsgC
infra/tools/dirmd/linux-ppc64
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
s-mpVLeeOUyDyH7GEiBdEw_gYiEsTDy-9DfuOof-VFcC
infra/tools/dirmd/linux-ppc64le
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
j1uo72ZQI58Y9w37WWgQPvVrUgtX-vJdInAfwsy5RTIC
infra/tools/dirmd/linux-s390x
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
3z0P7JnTe7de419_bKZLVHKKCuPumnZyEZq5NCAPaoYC
infra/tools/dirmd/mac-amd64
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
D8UPyFh9w9cOpIJ-vkupeNt3m7EOrPa6dKu8z_wdV-wC
infra/tools/dirmd/mac-arm64
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
0Q7jsI3PhOQ8G6P3OvexPQ6lRFm__77m6n1PpQEVPYQC
infra/tools/dirmd/windows-amd64
git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
NADSou2jQNoYyyeh0tpLCbcYpPyXcuJ0gbHiBLK3ZcEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-386
git_revision:297491c0babda68d84d8240c9d4504be671bc804
eP17h5YJMrU6hWBOvjZxWCz5h9SgkkW-vVF7W-L9qwIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-amd64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
Xf6nFp5RbFKQLUk7d3O5LKPmmdnAF8NU4NsoO0QGP1UC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-arm64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
owOKUdyWr11KyfuCRigGRsBM7uPnOMVrH_WOMYYCGJYC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-armv6l
git_revision:297491c0babda68d84d8240c9d4504be671bc804
iZa8O1smpKFTta3pQVz9TaIOlRIu31V4QPgGbIVkCgYC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-mips64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
s6dXt6MAJ8kreqm79HyghgHg9mk93u8ju303d1RIZ4cC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-mips64le
git_revision:297491c0babda68d84d8240c9d4504be671bc804
K2S9QpIR4701H7N2E6Fm9iGCOg8hwa3mY51S1CmrwdEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-mipsle
git_revision:297491c0babda68d84d8240c9d4504be671bc804
0jLzmuxOsRVyYofMKQfgivPZOtxsXv0Slcr1dRU78UgC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-ppc64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
7SK4rFVEOeA4CqHD0mKebTOCx7viE-dJMakFqE6W6BsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-ppc64le
git_revision:297491c0babda68d84d8240c9d4504be671bc804
ZruNFqBhC_reTL2dw3wf-t17dc_sPZJ_733R6BLBvMsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/linux-s390x
git_revision:297491c0babda68d84d8240c9d4504be671bc804
8q6NmriGR1GiT9e-UlHeau2VMkcN0UYumU8AVDLIsZMC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/mac-amd64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
pxk-T_GADDuTTtmbUsK3TlMHbsMD8jb5Dt383XPmeeYC
infra/tools/luci-auth/mac-arm64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
cR0PKTchP7f5iIXZdCSffnp_p1_ySee-16Gg56qhxqIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci-auth/windows-amd64
git_revision:297491c0babda68d84d8240c9d4504be671bc804
McEKBb2FM2gMj1og3guOfA_jd690eGivhdSbKP90ruwC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-386
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
fZcX6zaFjQHXD4vQDYUz3jwPK0IrERA3WgaTFA9kbCEC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-amd64
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
wypbr7ZdGG0jfvZlnoSGxseNQVA1ujVJ3tZRVdgsx7kC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-arm64
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
QSc2qjuNO3zeNakKD9IsbFOtU5L0oHJbdBlJQXJpBlQC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-armv6l
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
duJ_-lyEz2pjXQH_lNpv_KISiHac1MEjyQKIBzFU06oC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-mips64
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
_cMTfBNRoRpt2LFshptKYIe6v3NKiSsPAws2UVBpE8kC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-mips64le
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
ODs8cSS7KaYWdlNVzoJZ97W9l1I293H9IIgb5U2LV5UC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-mipsle
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
wlcr0xswWmcpU_WR4y8NqAnrop4JOMCiCVVqOcwFWHMC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-ppc64
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
5Fg_I6gzWdwWtzGmc5LOBoId2797UFr87TE4rNSQZgsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-ppc64le
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
KVaM3lyP3Xq1nMDL3fwrfG16xthJloBZh_CWtV5hStkC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/linux-s390x
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
ex018HJGjhePSqvAf1aZWSVVut9NDMq4lm1NCTx6Fi8C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/mac-amd64
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
2ABQYTR3WA2VlWASGGwnQxx-HKzZuV9zq2gb3RV4B2YC
infra/tools/luci/led/mac-arm64
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
ihIq8NwMBFRJCHX9uhMDCAiwCdOU7M_goTSNv8RMVS8C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/led/windows-amd64
git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
Nl7vxOlPVT1-YPAffbDewcUmdf2rjmC5EPtRpY3DIPYC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/lucicfg/linux-386
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
UDlypQLoJsoPsmJRx5G4RRlM5OMWMLgUdpdiM85MHusC
infra/tools/luci/lucicfg/linux-amd64
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
GbvGEB8JpWEk_KXPUfHQ3mmXzAhWKfKlYA6Qt6Ezml4C
infra/tools/luci/lucicfg/linux-arm64
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
ZCmcGRNPmeE9Lo0s1aXJyvf1oa5SUhAUo1ZwD4Xns-4C
infra/tools/luci/lucicfg/linux-armv6l
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
C_A-YmWBqYS6tQ-33FzELIiVozFK30VQUgE7iKIsOjAC
infra/tools/luci/lucicfg/linux-mips64
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
B_fnkKTmH__pEn5sCCSdKNyUPo7lzr7E5BHUNdk8qUUC
infra/tools/luci/lucicfg/linux-mips64le
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
HzBiRYLhz6kxMIiZ493GpOg_QwqwyiM7S1kWCFNSkDoC
infra/tools/luci/lucicfg/linux-mipsle
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
bWYhFQu0w6qY7mwdmDdIt0nf3mOZAgFTt_8Dyl8GjG8C
infra/tools/luci/lucicfg/linux-ppc64
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
cP0gbFeBZkcuEsXUPPVHyYHc9X_-lRXUuvVXSGxZwVEC
infra/tools/luci/lucicfg/linux-ppc64le
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
_WpbnlSUMFpSKJaWqiGLawIMmmRif6Wt4McoWPskk1YC
infra/tools/luci/lucicfg/linux-s390x
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
aaBTmjP3BzHQKiEeDBCHkYoW8LSQwKocGzgzSdM4pj0C
infra/tools/luci/lucicfg/mac-amd64
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
QzinIDwtRbykD-WprdZ5Krc2wU1CwClOpZK4196TCDgC
infra/tools/luci/lucicfg/mac-arm64
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
3C5xCLs7-XV5HJ6XQNMSw-Wg56nrfAnXtDCpDkAXM2cC
infra/tools/luci/lucicfg/windows-amd64
git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
GupSF9sqLV9kTvI68fbiIRdyI0NZC83OHGHvEONuZ_QC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-386
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
Kfwv-ninAitZN2lDaTLhjDkZSlxowo1Bb2pKqB0DKykC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-amd64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
0EmvufYSO4poeyc4HK9_HG6wT2UYDY-72RKTc6hyt2QC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-arm64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
B5Kx4gOi4nd7-KV7h7-Cpfv0xCp59O_VNvoOvnXF0XsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-armv6l
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
kQmD5w8uAfJd77Npyw43a7U05o1Tyd1vkCXjEs5f_B4C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-mips64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
0ADoqkLRY-7opXErUjdgZ5_wZPuDHjJE8_qUqUGsFbIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-mips64le
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
FDkkcfs8WCG-RN2j8w6oCoU3FpO_AUAL-K2Q4TDZTBcC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-mipsle
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
0kuTocrPzv19Ary4VvFs0aaIxhq_h64RJoFmf988f8sC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-ppc64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
e3QhhnuK9ShMXhvYFYJ_R7N_wdU92Xkr8laDuGXlIvUC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-ppc64le
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
E-jnGvKPR-SDDbcZxL6ek7k-8ls-xP0TUqwu7RuKDUsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/linux-s390x
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
iz_aI2P5MzFwInZ6JogXptvee2RiAqkdF3bNLyYXlw0C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/mac-amd64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
Bok7GiNkjMXhzME9k-0flydzzK-0hiNoqNTl1VUantAC
infra/tools/luci/vpython/mac-arm64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
H611WwzO3XAZO3GjA8sHVHHAn_yZCHaPyFRJaTuu2_sC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/luci/vpython/windows-amd64
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
ecbKVz8gqRIOf8HGdgBkp-2F7CLXV4nU9Knek2DAWukC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/mac_toolchain/mac-amd64
git_revision:723fc1a6c8cdf2631a57851f5610e598db0c1de1
2ozLryqklxu4fc7KZr_EqEpL66z0G0moWJef2qnPXXwC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/mac_toolchain/mac-arm64
git_revision:723fc1a6c8cdf2631a57851f5610e598db0c1de1
1VL13oNQ2PA-Ez2iYTQOWHFcXwA9UD_nhKdhqXsJw-MC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-386
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
0jh5WJiKY3YuD_Jb8PqwvoEpkIErWxDjPK1zHJt7AWsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-amd64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
ifuMgrBw52FZoNeCoOOBKJnEOVZissbo16oyfdNNFR4C
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-arm64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
37GBPQH01OFQ_mNexmZL4JXvTJrJZ6lupI2oipo7NygC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-armv6l
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
p5RXqsNOyauZgCE7fUiaJjjvfiyOaduXWxsPi79jSusC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-mips64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
5vO0g5QLGwZINTFQjnhKEEMDTaQ2geUUP16w3T7icicC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-mips64le
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
FV4lcmPr2Y3qx5dC85IxvN6j26tgBTIZY3KL3OO6ggQC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-mipsle
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
ZLw57efe_OTsHW_Sl5W2tK29zOx2xEi7m6XqQVEAS6EC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-ppc64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
1KLg18xHw43xbVYfPMPXBhqANzzRwP3aYRl0wi3qohIC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-ppc64le
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
hKB-qdoedy6YFlpMY_B2sNmhdoJzQbcRRU-ivr_nPZsC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/linux-s390x
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
Z8errTmVek00stSE8njJ4agFHThZWdziTgN5qpNDFbcC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/mac-amd64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
SyQL0RzHkWotXKicxXx49tVIBYW56N-NeDSB046eXwkC
infra/tools/prpc/mac-arm64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
M2wFOESsz-1S_BtbL2dKzUhxAspQa1OolA-J954ggjQC
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
infra/tools/prpc/windows-amd64
git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
pZ4PpzsgPaEjhtfUbbynrRQQ6e7zNBnEWnKn6aupqyQC
infra/tools/rdb/linux-386
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
POc40M6NUTlzhNhQIKC6DNm0XJmBil-7A8PiqjJnDGYC
infra/tools/rdb/linux-amd64
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
taDYc-RNOWpPQAdZ4TzFxrj0v1VVLDqXD_Kj41D1HyAC
infra/tools/rdb/linux-arm64
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
bKoR9uLEbuKWQ7JK_Z42eEIWjMqtlierza-R3QrccKMC
infra/tools/rdb/linux-armv6l
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
DTrNxafjtohjGDFvLtVb9meSGitdFq3s4VwzijxH4HkC
infra/tools/rdb/linux-mips64
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
cdds7XsMJUFz8CMGu0bChK3bjzgv_c1DP7stkOfNzb4C
infra/tools/rdb/linux-mips64le
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
Nf7zkHzLrlx39GGoUxo6p4N49bFHmU2aSpB8kJlqG9YC
infra/tools/rdb/linux-mipsle
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
a8MUAIPmN1w5pk_P0nxnjXHxJu0MDp7CsRZIfJuaL4wC
infra/tools/rdb/linux-ppc64
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
ICnAGWhXVVcERIRGnApxyN_XkjndWAGfgflJjOYc8cgC
infra/tools/rdb/linux-ppc64le
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
2DHyYdKyZ22woFqJBHsGybxZAwRcgbsJoQpQSw1jSIIC
infra/tools/rdb/linux-s390x
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
8cd3p9vSjQbuWe2_Fy8LUoPC7-FiXuJDVNSjxdK3pfkC
infra/tools/rdb/mac-amd64
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
ZSdslvhpl29W0eax9w177q7NXNHslf3hWIY_70KtrZ0C
infra/tools/rdb/mac-arm64
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
Ml5nEUUZRYdqvtV57KAx9TvTppkrQOhhduRLgLJd9soC
infra/tools/rdb/windows-amd64
git_revision:0fbf0c3c84a67bca202dd5002fb38bd93b08d0a1
2rVhnWGm0qwdXeZLoXy12hf-mG0aOOV3iTXgSI8vGTAC