geckodriver-v0.33.0-linux-aarch64.tar.gz.asc AuthenticationFailed

[stefandrissen]

System

• Version: 0.33.0
• Platform: linux-aarch64
• Firefox: n/a
• Selenium: n/a

While rather annoyed with github's default release artifact presentation showing only 12 items with a 13th line indicating 'Show all 13 assets' resulting in me missing the win64 driver, accidentally grabbing the win-aarch64.zip driver, failing, accidentally grabbing the win32 driver resulting in me wondering why it was complaining about not being able to find a Firefox binary, I wondered why the Linux releases get two files each. The second being the asc file, which I then found is a signature.

As can be discovered by looking at the file size discrepancy (it is not 833 bytes), the linux-aarch64.tar.gz.asc is broken:

{
  "code": "AuthenticationFailed",
  "message": "Unauthorized: Access expired\n\n---\n\n* method:     findArtifactFromTask\n* errorCode:  AuthenticationFailed\n* statusCode: 401\n* time:       2023-04-03T11:09:45.107Z",
  "requestInfo": {
    "method": "findArtifactFromTask",
    "params": {
      "0": "public/build/geckodriver.tar.gz.asc",
      "indexPath": "gecko.v2.mozilla-central.revision.a80e5fd61076eda50fbf755f90bd30440ad12cc7.geckodriver.linux64-aarch64",
      "name": "public/build/geckodriver.tar.gz.asc"
    },
    "payload": {},
    "time": "2023-04-03T11:09:45.107Z"
  }
}

[whimboo]

Thank you for filing the issue! That is interesting that the file doesn't actually contain the PGP signature given that all the jobs were fine at the time when we released geckodriver. Sadly the indexed artifacts of the geckodriver release are no longer available. As such I don't think that we can do anything here beside removing this file from the release artifacts.

@bhearsum do you have an idea?

[bhearsum]

The task expired and the artifact went away - everything is working as expected here. Taskcluster is not meant to be linked to for long term archive purposes.

I'm guessing this came from a Status check (as opposed to a Release?) If so, the Taskcluster team might have thoughts on how they want to deal with that.

[whimboo]

Well, I'm fetching the artifacts per script for each geckodriver release and upload them to GitHub. So whatever happened here we don't seem to get a proper PGP signature for this particular binary.

As such I would propose we remove the .asc file and explicitly check the contents for upcoming releases.

[bhearsum]

Well, I'm fetching the artifacts per script for each geckodriver release and upload them to GitHub. So whatever happened here we don't seem to get a proper PGP signature for this particular binary.

As such I would propose we remove the .asc file and explicitly check the contents for upcoming releases.

Oh, I see. When I saw the error I assumed I was being linked to the Taskcluster server, since we see it a lot there.

It sounds like you have an issue in your download script in that case? There's no reason the ascs on the tasks should be invalid when the tasks still exist.

[whimboo]

Not really given that all the other asc files are fine. Given that the artifacts no longer exists there is no way to reproduce.

[whimboo]

I've removed the asc file now for this release.