Bug 1490119 - Set override_certs in update verify config creator. r=nthomas

Imports the changes to the UpdateVerifyConfig class, and sets --override-certs for staging releases.

Differential Revision: https://phabricator.services.mozilla.com/D5705

--HG--
extra : moz-landing-system : lando

python/mozrelease/mozrelease/update_verify.py

@@ -15,20 +15,21 @@ class UpdateVerifyConfig(object):
     key_write_order = ("release", "product", "platform", "build_id", "locales",
                        "channel", "patch_types", "from", "aus_server",
                        "ftp_server_from", "ftp_server_to", "to",
-                       "mar_channel_IDs", "to_build_id", "to_display_version",
-                       "to_app_version", "updater_package")
+                       "mar_channel_IDs", "override_certs", "to_build_id",
+                       "to_display_version", "to_app_version", "updater_package")
     global_keys = ("product", "channel", "aus_server", "to", "to_build_id",
-                   "to_display_version", "to_app_version")
+                   "to_display_version", "to_app_version", "override_certs")
     release_keys = ("release", "build_id", "locales", "patch_types", "from",
                     "ftp_server_from", "ftp_server_to", "mar_channel_IDs",
                     "platform", "updater_package")
     first_only_keys = ("from", "aus_server", "to", "to_build_id",
-                       "to_display_version", "to_app_version")
+                       "to_display_version", "to_app_version", "override_certs")
     compare_attrs = global_keys + ("releases",)
 
     def __init__(self, product=None, channel=None,
                  aus_server=None, to=None, to_build_id=None,
-                 to_display_version=None, to_app_version=None):
+                 to_display_version=None, to_app_version=None,
+                 override_certs=None):
         self.product = product
         self.channel = channel
         self.aus_server = aus_server
@@ -36,6 +37,7 @@ class UpdateVerifyConfig(object):
         self.to_build_id = to_build_id
         self.to_display_version = to_display_version
         self.to_app_version = to_app_version
+        self.override_certs = override_certs
         self.releases = []
 
     def __eq__(self, other):
@@ -170,7 +172,8 @@ class UpdateVerifyConfig(object):
                                        self.aus_server, self.to,
                                        self.to_build_id,
                                        self.to_display_version,
-                                       self.to_app_version)
+                                       self.to_app_version,
+                                       self.override_certs)
         for t in allTests:
             build_id, locale, from_path = t
             if from_path == "None":

taskcluster/ci/release-secondary-update-verify-config/kind.yml

@@ -42,6 +42,10 @@ job-defaults:
          by-release-level:
             staging: "https://aus4.stage.mozaws.net"
             production: "https://aus5.mozilla.org"
+      override-certs:
+         by-release-level:
+            staging: dep
+            production: null
       include-version:
          by-project:
             birch: beta

taskcluster/ci/release-update-verify-config/kind.yml

@@ -40,6 +40,10 @@ job-defaults:
          by-release-level:
             staging: "https://aus4.stage.mozaws.net"
             production: "https://aus5.mozilla.org"
+      override-certs:
+         by-release-level:
+            staging: dep
+            production: null
       # This is overridden for devedition to exclude 58.0b1
       # because of the special case added by
       # https://bugzilla.mozilla.org/show_bug.cgi?id=1419189

taskcluster/taskgraph/transforms/update_verify_config.py

@@ -47,6 +47,7 @@ def add_command(config, tasks):
         "archive-prefix",
         "previous-archive-prefix",
         "aus-server",
+        "override-certs",
         "include-version",
         "mar-channel-id-override",
         "last-watershed",

testing/mozharness/scripts/release/update-verify-config-creator.py

@@ -117,6 +117,13 @@ class UpdateVerifyConfigCreator(BaseScript):
                     "'firefox-mozilla-release for x.y and x.y.z versions. "
                     "May be passed multiple times"
         }],
+        [["--override-certs"], {
+            "dest": "override_certs",
+            "default": None,
+            "help": "Certs to override the updater with prior to running update verify."
+                    "If passed, should be one of: dep, nightly, release"
+                    "If not passed, no certificate overriding will be configured"
+        }],
         [["--platform"], {
             "dest": "platform",
             "help": "The platform to generate the update verify config for, in FTP-style",
@@ -347,6 +354,7 @@ class UpdateVerifyConfigCreator(BaseScript):
             to_build_id=self.config["to_buildid"],
             to_app_version=self.config["to_app_version"],
             to_display_version=to_display_version,
+            override_certs=self.config.get("override_certs"),
         )
 
         to_shipped_locales_url = urljoin(