Source code

Revision control

Other Tools

#!/usr/bin/env python3
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, # You can obtain one at
The purpose of this job is to run on autoland and ensure that any commits
made by the Updatebot bot account are reproducible. Patches that aren't
reproducible indicate some sort of error in this script, or represent
concerns about the integrity of the patch made by Updatebot.
More simply: If this job fails, any patches by Updatebot SHOULD NOT land
because they may represent a security indicent.
from __future__ import absolute_import, print_function
import re
import os
import sys
import requests
import subprocess
RE_BUG = re.compile("Bug (\d+)")
RE_COMMITMSG = re.compile("Update (.+) to ([^\s]+)(.*)")
class Revision:
def __init__(self, line):
self.node = None = None
self.desc = None
self.bug = None
line = line.strip()
if not line:
components = line.split(" | ")
self.node,, self.desc = components[0:3]
self.bug =[0]
except Exception:
def __str__(self):
bug_str = " (No Bug)" if not self.bug else " (Bug %s)" % self.bug
return self.node + " by " + + bug_str
# ================================================================================================
# Find all commits we are hopefully landing in this push
assert os.environ.get("GECKO_HEAD_REV"), "No revision head in the environment"
assert os.environ.get("GECKO_HEAD_REPOSITORY"), "No repository in the environment"
url = "%s/json-pushes?changeset=%s&version=2" % (
response = requests.get(url)
revisions_json = response.json()
assert len(revisions_json["pushes"]) >= 1, "Did not see a push in the autoland API"
pushid = list(revisions_json["pushes"].keys())[0]
rev_ids = revisions_json["pushes"][pushid]["changesets"]
revisions = []
for rev_id in rev_ids:
rev_detail = subprocess.check_output(
"{node} | {author} | {desc|firstline}\n",
if not revisions:
msg = """
Don't see any non-public revisions. This indicates that the mercurial
repositories may not be operating in an expected way, and a script
that performs security checks may fail to perform them properly.
Sheriffs: This _does not_ mean the changesets involved need to be backed
out. You can continue with your usual operation. However; if this occurs
during a mercurial upgrade, or a refactring of how we treat try/autoland
or the landing process, it means that we need to revisit the operation
of this script.
For now, we ask that you file a bug blocking 1618282 indicating the task
failed so we can investigate the circumstances that caused it to fail.
# ================================================================================================
# Find all the Updatebot Revisions (there might be multiple updatebot
# landings in a single push some day!)
i = 1
all_revisions = []
updatebot_revisions = []
print("There are %i revisions to be evaluated." % len(revisions))
for r in revisions:
revision = Revision(r)
if not revision.node:
print(" ", i, revision)
i += 1
if == "Updatebot <>":
if not revision.bug:
# Check to see if this is a ./mach try run, and if so exempt it.
is_try = (
os.environ.get("GECKO_HEAD_REPOSITORY") == ""
rev_detail = subprocess.check_output(
is_only_try_task = (
"try_task_config.json" == rev_detail.decode("utf-8").strip()
if is_try and is_only_try_task:
raise Exception(
"Could not find a bug for revision %s (Description: %s)"
% (revision.node, revision.desc)
# ================================================================================================
# Process each Updatebot revision
overall_failure = False
for u in updatebot_revisions:
print("=" * 80)
print("Processing the Updatebot revision %s for Bug %s" % (u.node, u.bug))
target_revision =[1]
except Exception:
print("Could not parse the bug description for the revision: %s" % u.desc)
overall_failure = True
# Get the moz.yaml file for the updatebot revision
files_changed = subprocess.check_output(["hg", "status", "--change", u.node])
files_changed = files_changed.decode("utf-8").split("\n")
moz_yaml_file = None
for f in files_changed:
if "moz.yaml" in f:
if moz_yaml_file:
msg = (
"Already had a moz.yaml file (%s) and then we found another? (%s)"
% (moz_yaml_file, f)
raise Exception(msg)
moz_yaml_file = f[2:]
# Find all the commits associated with this bug.
# They should be ordered with the first commit as the first element and so on.
all_commits_for_this_update = [r for r in all_revisions if r.bug == u.bug]
" Found %i commits associated with this bug."
% len(all_commits_for_this_update)
# Grab the updatebot commit and transform it into patch form
commitdiff = (
subprocess.check_output(["hg", "export", u.node])
start_index = 0
for i in range(len(commitdiff)):
if "diff --git" in commitdiff[i]:
start_index = i
patch_diff = commitdiff[start_index:]
# Okay, now go through in reverse order and backout all of the commits for this bug
all_commits_reversed = all_commits_for_this_update
for c in all_commits_reversed:
print(" Backing out", c.node)
# hg doesn't support the ability to commit a backout without prompting the
# user, but it does support not committing
subprocess.check_output(["hg", "backout", c.node, "--no-commit"])
"ui.username=Updatebot Verifier <>",
"Backed out changeset %s" % c.node,
# And now re-do the updatebot commit
print(" Vendoring", moz_yaml_file)
ret =
["./mach", "vendor", "--revision", target_revision, moz_yaml_file]
if ret:
print(" Vendoring returned code %i, but we're going to continue..." % ret)
# And now get the diff
recreated_diff = (
subprocess.check_output(["hg", "diff"]).decode("utf-8").split("\n")
# Now compare it, print if needed, and return.
this_failure = False
if len(recreated_diff) != len(patch_diff):
" The recreated diff is %i lines long and the original diff is %i lines long."
% (len(recreated_diff), len(patch_diff))
this_failure = True
for i in range(min(len(recreated_diff), len(patch_diff))):
if recreated_diff[i] != patch_diff[i]:
if not this_failure:
" Identified a difference between patches, starting on line %i."
% i
this_failure = True
# Cleanup so we can go to the next one
subprocess.check_output(["hg", "revert", "."])
"tip~" + str(len(all_commits_for_this_update) - 1),
# Now process the outcome
if not this_failure:
print(" This revision was recreated successfully.")
print("Original Diff:")
print("-" * 80)
for l in patch_diff:
print("-" * 80)
print("Recreated Diff:")
print("-" * 80)
for l in recreated_diff:
print("-" * 80)
overall_failure = True
except subprocess.CalledProcessError as e:
print("Caught an exception when running:", e.cmd)
print("Return Code:", e.returncode)
overall_failure = True
if overall_failure: