{"action":"opened","issue":{"url":"https://api.github.com/repos/mozilla-releng/signingscript/issues/15","repository_url":"https://api.github.com/repos/mozilla-releng/signingscript","labels_url":"https://api.github.com/repos/mozilla-releng/signingscript/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/mozilla-releng/signingscript/issues/15/comments","events_url":"https://api.github.com/repos/mozilla-releng/signingscript/issues/15/events","html_url":"https://github.com/mozilla-releng/signingscript/issues/15","id":187159243,"number":15,"title":"modify task schema to allow for multiple signing formats","user":{"login":"escapewindow","id":826343,"avatar_url":"https://avatars.githubusercontent.com/u/826343?v=3","gravatar_id":"","url":"https://api.github.com/users/escapewindow","html_url":"https://github.com/escapewindow","followers_url":"https://api.github.com/users/escapewindow/followers","following_url":"https://api.github.com/users/escapewindow/following{/other_user}","gists_url":"https://api.github.com/users/escapewindow/gists{/gist_id}","starred_url":"https://api.github.com/users/escapewindow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/escapewindow/subscriptions","organizations_url":"https://api.github.com/users/escapewindow/orgs","repos_url":"https://api.github.com/users/escapewindow/repos","events_url":"https://api.github.com/users/escapewindow/events{/privacy}","received_events_url":"https://api.github.com/users/escapewindow/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-03T18:55:21Z","updated_at":"2016-11-03T18:55:21Z","closed_at":null,"body":"Right now, we determine signing cert... level (i.e., `dep-signing`, `nightly-signing`, `release-signing`) and signing formats (e.g., gpg, mar, jar) via scopes.  Only a single cert type is allowed, but multiple signing formats are allowed.  However, all signing formats are applied to all files.\r\n\r\nThere's a requirement for being able to sign multiple files in multiple *different* signing formats.  We can keep the single signing cert level requirement.\r\n\r\nI'm currently thinking changing\r\n\r\n`unsignedArtifacts: [url1, url2, ...]`\r\n\r\nto\r\n\r\n```python\r\nunsignedArtifacts: {\r\n    url1: [signing_formats],\r\n    url2: [signing_formats],\r\n    ...\r\n}\r\n```\r\n\r\nIf this is done before we're tier1 ready on linux+android, we might be able to do a hard cutover.  Otherwise we may have to support both styles and deprecate the first if and when desired."}}
{"actor":{"display_login":"escapewindow"}}