Details

The bug addresses an issue where Firefox installations from macOS .pkg files require a password prompt to update. This happens because the .pkg files were being built and signed as part of the build-mac-signing (iscript) pipeline, which bundled .pkg creation together with .tar.gz signing and other operations. The goal is to decouple the .pkg signing and notarization into its own dedicated pipeline that sources the .pkg from the repackage step instead, ensuring the .pkg is properly signed with the correct certificates and permissions so that subsequent updates don't require elevated privileges.

Solution

The changes introduce a new, separate pipeline for macOS .pkg signing and notarization that sources .pkg files from the repackage tasks rather than from the monolithic build-mac-signing/iscript step:

New task kinds: Four new task kinds are created — repackage-pkg-signing, repackage-pkg-notarization, repackage-l10n-pkg-signing, and repackage-l10n-pkg-notarization. The signing kinds depend on repackage (or repackage-l10n), and the notarization kinds depend on the corresponding signing kinds, forming a clean repackage → pkg-signing → pkg-notarization pipeline.

New transform modules: Two new transform files are added. repackage_pkg_signing.py builds the signing task description by collecting .pkg artifacts from upstream repackage dependencies, setting up iscript with a new mac_sign_pkg behavior, and handling both en-US and chunked l10n scenarios. repackage_pkg_notarization.py configures the notarization task by defining upstream artifacts filtered to .pkg files and using apple_notarization_stacked format.

Removed .pkg from old pipeline: The build-mac-notarization kind no longer includes target.pkg in its upstream artifacts, so the old notarization path only handles .tar.gz files.

Updated notarization kinds: The existing repackage-pkg-notarization and repackage-l10n-pkg-notarization kinds are updated to depend on the new signing kinds instead of build-mac-signing, and they include the new repackage_pkg_notarization transform.

Beetmover integration: The beetmover-repackage kind and the Firefox nightly/candidates manifests are updated to source .pkg files from the new repackage-pkg-notarization and repackage-l10n-pkg-notarization tasks instead of the old signing tasks.

Dependency grouping fix: The chunk-locales grouping logic in dependencies.py is updated to handle tasks that don't carry chunk_locales directly but do carry an l10n_chunk attribute, allowing per-locale repackage tasks to be correctly re-grouped into their original chunks for downstream consumption.

Signing scope update: The signing transform's condition for applying notarization signing type is broadened from kinds ending in -mac-notarization to any kind ending in -notarization on macOS platforms, so the new kinds are properly handled.

Configuration and documentation: Treeherder group symbols (pkg-Rpk), task configuration, and documentation in kinds.rst are all updated to reflect the new kinds.

Please use / reactions on inline comments to provide feedback. This will have a significant impact on the quality of future reviews.

taskcluster/gecko_taskgraph/transforms/repackage_pkg_notarization.py
26	This replaces the entire treeherder dict with only `symbol`, discarding any fields (like `tier`, `platform`) that prior transforms (`mac_notarization`, `from_deps`) may have set. It works today because the downstream `signing` transform refills them via `setdefault`, but this coupling is fragile. Safer to update the existing dict: `th["symbol"] = join_symbol(group, symbol)` instead of replacing it.
taskcluster/gecko_taskgraph/transforms/repackage_pkg_signing.py
70	Nit: When `l10n_chunk` is empty string (en-US builds), this produces `"MacOS pkg signing "` with a trailing space. Use `.strip()` or a conditional: `f"MacOS pkg signing{' ' + l10n_chunk if l10n_chunk else ''}"`.
taskcluster/gecko_taskgraph/util/dependencies.py
125	Note: `l10n_chunk` is a string (e.g., `"1"`) per the `chunk_locales` transform, while the default `()` is an empty tuple. The grouping keys are type-heterogeneous across the three cases (tuple-of-strings, string, empty-tuple), which works correctly as dict keys but is worth documenting in the comment.

ahal requested changes to this revision.Apr 2 2026, 11:46 PM

ahal added a subscriber: ahal.

ahal added inline comments.

taskcluster/gecko_taskgraph/transforms/beetmover_repackage.py
150–169	Please combine these for loops
taskcluster/gecko_taskgraph/transforms/repackage_pkg_notarization.py
26	I concur
taskcluster/gecko_taskgraph/transforms/repackage_pkg_signing.py
2	Are there not existing transforms we can use for these? I can't imagine they're that different than other repackage sigining tasks we have?

This revision now requires changes to proceed.Apr 2 2026, 11:46 PM

hneiva marked 3 inline comments as done.Apr 6 2026, 4:50 PM

hneiva added inline comments.

taskcluster/gecko_taskgraph/transforms/beetmover_repackage.py
150–169	will do
taskcluster/gecko_taskgraph/transforms/repackage_pkg_signing.py
2	The closest transform to this one would be `repackage_signing.py`. But it's only really meant for `signingscript`, where this one is specific for `iscript`. The payload structure is quite different. Upstream files, signing formats, chunking are all different. I intentionally chose not to try and bend the other transform to fit something it wasn't meant to do. On a bright note, if we ever move mac signing to signingscript, we might be able to just delete this transform and use the other one without much dissection.

hneiva requested review of this revision.Apr 6 2026, 4:53 PM

hneiva updated this revision to Diff 1241531.

hneiva marked an inline comment as done.

hneiva marked 3 inline comments as done.Apr 6 2026, 4:54 PM

hneiva added inline comments.

taskcluster/gecko_taskgraph/transforms/repackage_pkg_notarization.py
26	updated

NOTE: Tasks were added or removed in diff 1241531.

The following parameter sets have differences:

NOTE: A documentation file was modified in diff 1241531

It can be previewed for one week:

file taskcluster/docs/kinds.rst

If you see a problem in this automated review, please report it here.

Harbormaster completed remote builds in B942398: Diff 1241531.Apr 6 2026, 5:19 PM

I am not familiar enough with these scripts to add much of value here and will defer to everyone else.

ahal accepted this revision.Apr 7 2026, 7:04 PM

ahal added a project: testing-exception-unchanged (Doesn't change behavior for users).

ahal added inline comments.

taskcluster/gecko_taskgraph/transforms/repackage_pkg_signing.py
2	Ah ok, that makes more sense. Thanks for clarifying.
12	suggestion: Optional, but would be nice to include a schema here to be clear what's expected of tasks using this transform.
47	nitpick: `bool(dep.attributes.get("shippable"))` I know it's the same difference, but anytime I see an `is_` variable, I assume it's a bool.
taskcluster/kinds/repackage-pkg-signing/kind.yml
2	thought: I know it has nothing to do with you and isn't related to this revision.. but I hate all these kind names 😢
24	nitpick: `[hg, git]` is the default already so you can drop this (ditto for the other kind.yml)

This revision is now accepted and ready to land.Apr 7 2026, 7:04 PM

hneiva updated this revision to Diff 1246596.Apr 10 2026, 8:40 PM

hneiva retitled this revision from Bug 1812480 - Switch mac pkg source to repackaged instead of iscript r?#releng,spohl to Bug 1812480 - Switch mac pkg source to repackaged instead of iscript r?#releng.

hneiva marked 6 inline comments as done.

hneiva added inline comments.Apr 10 2026, 8:45 PM