Bug 1305139 - schedule checksums related tasks in nightly graph. r=aki draft
authorMihai Tabara <mtabara@mozilla.com>
Tue, 07 Feb 2017 22:44:12 -0500
changeset 480297 25e25a415129be3f7568ea6f74aaaf5e64b02c4b
parent 480238 f4f374622111022d41dd8d5eb9220624135c534a
child 544922 10918869d014c35de1e8cffef89c97801f023ca2
push id44511
push userbmo:mtabara@mozilla.com
push dateWed, 08 Feb 2017 03:45:12 +0000
reviewersaki
bugs1305139
milestone54.0a1
Bug 1305139 - schedule checksums related tasks in nightly graph. r=aki MozReview-Commit-ID: 659wCXm3ob5
taskcluster/ci/beetmover-checksums/kind.yml
taskcluster/ci/beetmover-l10n/kind.yml
taskcluster/ci/beetmover/kind.yml
taskcluster/ci/checksums-signing/kind.yml
taskcluster/docs/kinds.rst
taskcluster/taskgraph/task/beetmover.py
taskcluster/taskgraph/task/beetmover_checksums.py
taskcluster/taskgraph/task/checksums_signing.py
taskcluster/taskgraph/transforms/beetmover.py
taskcluster/taskgraph/transforms/beetmover_checksums.py
taskcluster/taskgraph/transforms/beetmover_l10n.py
taskcluster/taskgraph/transforms/checksums_signing.py
taskcluster/taskgraph/transforms/signing.py
taskcluster/taskgraph/transforms/task.py
new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/beetmover-checksums/kind.yml
@@ -0,0 +1,12 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+implementation: taskgraph.task.beetmover_checksums:BeetmoverChecksumsTask
+
+transforms:
+   - taskgraph.transforms.beetmover_checksums:transforms
+   - taskgraph.transforms.task:transforms
+
+kind-dependencies:
+  - checksums-signing
--- a/taskcluster/ci/beetmover-l10n/kind.yml
+++ b/taskcluster/ci/beetmover-l10n/kind.yml
@@ -5,10 +5,9 @@
 implementation: taskgraph.task.beetmover:BeetmoverTask
 
 transforms:
    - taskgraph.transforms.beetmover_l10n:transforms
    - taskgraph.transforms.beetmover:transforms
    - taskgraph.transforms.task:transforms
 
 kind-dependencies:
-  - nightly-l10n
   - nightly-l10n-signing
--- a/taskcluster/ci/beetmover/kind.yml
+++ b/taskcluster/ci/beetmover/kind.yml
@@ -4,10 +4,9 @@
 
 implementation: taskgraph.task.beetmover:BeetmoverTask
 
 transforms:
    - taskgraph.transforms.beetmover:transforms
    - taskgraph.transforms.task:transforms
 
 kind-dependencies:
-  - build
   - build-signing
new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/checksums-signing/kind.yml
@@ -0,0 +1,13 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+implementation: taskgraph.task.checksums_signing:ChecksumsSigningTask
+
+transforms:
+   - taskgraph.transforms.checksums_signing:transforms
+   - taskgraph.transforms.task:transforms
+
+kind-dependencies:
+  - beetmover
+  - beetmover-l10n
--- a/taskcluster/docs/kinds.rst
+++ b/taskcluster/docs/kinds.rst
@@ -183,8 +183,20 @@ process determines the final location an
 beetmover-l10n
 --------------
 
 Beetmover L10n, takes specific artifacts, "Beets", and pushes them to a location outside
 of Taskcluster's task artifacts, (archive.mozilla.org as one place) and in the
 process determines the final location and a "pretty" name (versioned product name)
 This separate kind uses logic specific to localized artifacts, such as including
 the language in the final artifact names.
+
+checksums-signing
+----------------
+Checksums-signing take as input the checksums file generated by beetmover tasks
+and sign it via the signing scriptworkers. Returns the same file signed and
+additional detached signature.
+
+beetmover-checksums
+-------------------
+Beetmover, takes specific artifact checksums and pushes it to a location outside
+of Taskcluster's task artifacts (archive.mozilla.org as one place) and in the
+process determines the final location and "pretty" names it (version product name)
--- a/taskcluster/taskgraph/task/beetmover.py
+++ b/taskcluster/taskgraph/task/beetmover.py
@@ -4,30 +4,25 @@
 
 from __future__ import absolute_import, print_function, unicode_literals
 
 from . import transform
 
 
 class BeetmoverTask(transform.TransformTask):
     """
-    A task implementing a signing job.  These depend on nightly build jobs and
-    sign the artifacts after a build has completed.
-
-    We use a dictionary to create the input to the transforms.
-    It will have added to it keys `build-label`, the label for the build task,
-    and `build-platform` / `build-type`, its platform and type.
+    A task implementing a beetmover job.  These depend on nightly build and signing
+    jobs and transfer the artifacts to S3 after build and signing are completed.
     """
 
     @classmethod
     def get_inputs(cls, kind, path, config, params, loaded_tasks):
-        if config.get('kind-dependencies', []) != ["build", "build-signing"] and \
-           config.get('kind-dependencies', []) != ["nightly-l10n", "nightly-l10n-signing"]:
+        if config.get('kind-dependencies', []) != ["build-signing"] and \
+           config.get('kind-dependencies', []) != ["nightly-l10n-signing"]:
             raise Exception("Beetmover kinds must depend on builds or signing builds")
         for task in loaded_tasks:
             if not task.attributes.get('nightly'):
                 continue
             if task.kind not in config.get('kind-dependencies'):
                 continue
-            beetmover_task = {}
-            beetmover_task['dependent-task'] = task
+            beetmover_task = {'dependent-task': task}
 
             yield beetmover_task
new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/task/beetmover_checksums.py
@@ -0,0 +1,28 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from . import transform
+
+
+class BeetmoverChecksumsTask(transform.TransformTask):
+    """
+    A task implementing a beetmover job specific for checksums.These depend on
+    the checksums signing jobs and transfer the checksums files to S3 after
+    it's being generated and signed.
+    """
+
+    @classmethod
+    def get_inputs(cls, kind, path, config, params, loaded_tasks):
+        if config.get('kind-dependencies', []) != ["checksums-signing"]:
+            raise Exception("Beetmover checksums tasks depend on checksums signing tasks")
+        for task in loaded_tasks:
+            if not task.attributes.get('nightly'):
+                continue
+            if task.kind not in config.get('kind-dependencies'):
+                continue
+            beetmover_checksums_task = {'dependent-task': task}
+
+            yield beetmover_checksums_task
new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/task/checksums_signing.py
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from . import transform
+
+
+class ChecksumsSigningTask(transform.TransformTask):
+    """
+    A task implementing a checksums signing job.  These depend on beetmover jobs
+    and sign the checksums after its being generated by beetmover
+    """
+
+    @classmethod
+    def get_inputs(cls, kind, path, config, params, loaded_tasks):
+        if (config.get('kind-dependencies', []) != ["beetmover", "beetmover-l10n"]):
+            raise Exception("Checksums signing tasks must depend on beetmover tasks")
+        for task in loaded_tasks:
+            if not task.attributes.get('nightly'):
+                continue
+            if task.kind not in config.get('kind-dependencies'):
+                continue
+            checksums_signing_task = {'dependent-task': task}
+
+            yield checksums_signing_task
--- a/taskcluster/taskgraph/transforms/beetmover.py
+++ b/taskcluster/taskgraph/transforms/beetmover.py
@@ -169,156 +169,123 @@ def validate(config, jobs):
 
 
 @transforms.add
 def make_task_description(config, jobs):
     for job in jobs:
         dep_job = job['dependent-task']
 
         treeherder = job.get('treeherder', {})
+        treeherder.setdefault('symbol', 'tc(BM-S)')
         dep_th_platform = dep_job.task.get('extra', {}).get(
             'treeherder', {}).get('machine', {}).get('platform', '')
         treeherder.setdefault('platform',
                               "{}/opt".format(dep_th_platform))
         treeherder.setdefault('tier', 1)
         treeherder.setdefault('kind', 'build')
-
         label = job.get('label', "beetmover-{}".format(dep_job.label))
         dependent_kind = str(dep_job.kind)
         dependencies = {dependent_kind: dep_job.label}
-        # taskid_of_manifest always refers to the unsigned task
-        if "signing" in dependent_kind:
-            if len(dep_job.dependencies) > 1:
-                raise NotImplementedError(
-                    "can't beetmove a signing task with multiple dependencies")
-            signing_dependencies = dep_job.dependencies
-            dependencies.update(signing_dependencies)
-            treeherder.setdefault('symbol', 'tc(BM-S)')
-        else:
-            treeherder.setdefault('symbol', 'tc(BM)')
+
+        if len(dep_job.dependencies) > 1:
+            raise NotImplementedError(
+                "Can't beetmove a signing task with multiple dependencies")
+        signing_dependencies = dep_job.dependencies
+        dependencies.update(signing_dependencies)
 
         attributes = {
-                'nightly': dep_job.attributes.get('nightly', False),
-                'build_platform': dep_job.attributes.get('build_platform'),
-                'build_type': dep_job.attributes.get('build_type'),
+            'nightly': dep_job.attributes.get('nightly', False),
+            'build_platform': dep_job.attributes.get('build_platform'),
+            'build_type': dep_job.attributes.get('build_type'),
         }
         if job.get('locale'):
             attributes['locale'] = job['locale']
 
         task = {
             'label': label,
             'description': "{} Beetmover".format(
                 dep_job.task["metadata"]["description"]),
-            # do we have to define worker type somewhere?
             'worker-type': 'scriptworker-prov-v1/beetmoverworker-v1',
-            # bump this to nightly / release when applicable+permitted
             'scopes': ["project:releng:beetmover:nightly"],
             'dependencies': dependencies,
             'attributes': attributes,
             'run-on-projects': dep_job.attributes.get('run_on_projects'),
             'treeherder': treeherder,
         }
 
         yield task
 
 
-def generate_upstream_artifacts(taskid_to_beetmove, platform, locale=None, signing=False):
-    task_type = "build"
-    mapping = UPSTREAM_ARTIFACT_UNSIGNED_PATHS
-    if signing:
-        task_type = "signing"
-        mapping = UPSTREAM_ARTIFACT_SIGNED_PATHS
+def generate_upstream_artifacts(signing_task_ref, build_task_ref, platform,
+                                locale=None):
+    build_mapping = UPSTREAM_ARTIFACT_UNSIGNED_PATHS
+    signing_mapping = UPSTREAM_ARTIFACT_SIGNED_PATHS
 
     artifact_prefix = 'public/build'
     if locale:
         artifact_prefix = 'public/build/{}'.format(locale)
         platform = "{}-l10n".format(platform)
 
     upstream_artifacts = [{
-        "taskId": {"task-reference": taskid_to_beetmove},
-        "taskType": task_type,
-        "paths": ["{}/{}".format(artifact_prefix, p) for p in mapping[platform]],
+        "taskId": {"task-reference": build_task_ref},
+        "taskType": "build",
+        "paths": ["{}/{}".format(artifact_prefix, p)
+                  for p in build_mapping[platform]],
+        "locale": locale or "en-US",
+        }, {
+        "taskId": {"task-reference": signing_task_ref},
+        "taskType": "signing",
+        "paths": ["{}/{}".format(artifact_prefix, p)
+                  for p in signing_mapping[platform]],
         "locale": locale or "en-US",
     }]
+
     if not locale and "android" in platform:
         # edge case to support 'multi' locale paths
         multi_platform = "{}-multi".format(platform)
-        upstream_artifacts.append({
-            "taskId": {"task-reference": taskid_to_beetmove},
-            "taskType": task_type,
-            "paths": ["{}/{}".format(artifact_prefix, p) for p in mapping[multi_platform]],
+        upstream_artifacts.extend([{
+            "taskId": {"task-reference": build_task_ref},
+            "taskType": "build",
+            "paths": ["{}/{}".format(artifact_prefix, p)
+                      for p in build_mapping[multi_platform]],
             "locale": "multi",
-        })
-
-    return upstream_artifacts
-
+            }, {
+            "taskId": {"task-reference": signing_task_ref},
+            "taskType": "signing",
+            "paths": ["{}/{}".format(artifact_prefix, p)
+                      for p in signing_mapping[multi_platform]],
+            "locale": "multi",
+        }])
 
-def generate_signing_upstream_artifacts(taskid_to_beetmove, taskid_of_manifest, platform,
-                                        locale=None):
-    upstream_artifacts = generate_upstream_artifacts(taskid_to_beetmove, platform, locale,
-                                                     signing=True)
-    if locale:
-        artifact_prefix = 'public/build/{}'.format(locale)
-    else:
-        artifact_prefix = 'public/build'
-    manifest_path = "{}/balrog_props.json".format(artifact_prefix)
-    upstream_artifacts.append({
-        "taskId": {"task-reference": taskid_of_manifest},
-        "taskType": "build",
-        "paths": [manifest_path],
-        "locale": locale or "en-US",
-    })
-
-    return upstream_artifacts
-
-
-def generate_build_upstream_artifacts(taskid_to_beetmove, platform, locale=None):
-    upstream_artifacts = generate_upstream_artifacts(taskid_to_beetmove, platform, locale,
-                                                     signing=False)
     return upstream_artifacts
 
 
 @transforms.add
 def make_task_worker(config, jobs):
     for job in jobs:
-        valid_beetmover_signing_job = (len(job["dependencies"]) == 2 and
-                                       any(['signing' in j for j in job['dependencies']]))
-        valid_beetmover_build_job = len(job["dependencies"]) == 1
-        if not valid_beetmover_build_job and not valid_beetmover_signing_job:
-            raise NotImplementedError(
-                "beetmover tasks must have either 1 or 2 dependencies. "
-                "If 2, one of those must be a signing task"
-            )
+        valid_beetmover_job = (len(job["dependencies"]) == 2 and
+                               any(['signing' in j for j in job['dependencies']]))
+        if not valid_beetmover_job:
+            raise NotImplementedError("Beetmover must have two dependencies.")
 
-        build_kind = None
-        signing_kind = None
         locale = job["attributes"].get("locale")
         platform = job["attributes"]["build_platform"]
+        build_task = None
+        signing_task = None
         for dependency in job["dependencies"].keys():
             if 'signing' in dependency:
-                signing_kind = dependency
+                signing_task = dependency
             else:
-                build_kind = dependency
+                build_task = dependency
 
-        if signing_kind:
-            taskid_to_beetmove = "<" + str(signing_kind) + ">"
-            taskid_of_manifest = "<" + str(build_kind) + ">"
-            update_manifest = True
-            upstream_artifacts = generate_signing_upstream_artifacts(
-                taskid_to_beetmove, taskid_of_manifest, platform, locale
-            )
-        else:
-            taskid_to_beetmove = "<" + str(build_kind) + ">"
-            update_manifest = False
-            upstream_artifacts = generate_build_upstream_artifacts(
-                taskid_to_beetmove, platform, locale
-            )
+        signing_task_ref = "<" + str(signing_task) + ">"
+        build_task_ref = "<" + str(build_task) + ">"
+        upstream_artifacts = generate_upstream_artifacts(
+            signing_task_ref, build_task_ref, platform, locale
+        )
 
         worker = {'implementation': 'beetmover',
-                  'update_manifest': update_manifest,
                   'upstream-artifacts': upstream_artifacts}
-
         if locale:
             worker["locale"] = locale
-
         job["worker"] = worker
 
         yield job
new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/transforms/beetmover_checksums.py
@@ -0,0 +1,149 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+Transform the checksums signing task into an actual task description.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.util.schema import validate_schema
+from taskgraph.transforms.task import task_description_schema
+from voluptuous import Schema, Any, Required, Optional
+
+# Voluptuous uses marker objects as dictionary *keys*, but they are not
+# comparable, so we cast all of the keys back to regular strings
+task_description_schema = {str(k): v for k, v in task_description_schema.schema.iteritems()}
+
+transforms = TransformSequence()
+
+taskref_or_string = Any(
+    basestring,
+    {Required('task-reference'): basestring})
+
+beetmover_checksums_description_schema = Schema({
+    Required('dependent-task'): object,
+    Required('depname', default='build'): basestring,
+    Optional('label'): basestring,
+    Optional('treeherder'): task_description_schema['treeherder'],
+    Optional('locale'): basestring,
+})
+
+
+@transforms.add
+def validate(config, jobs):
+    for job in jobs:
+        label = job.get('dependent-task', object).__dict__.get('label', '?no-label?')
+        yield validate_schema(
+            beetmover_checksums_description_schema, job,
+            "In checksums-signing ({!r} kind) task for {!r}:".format(config.kind, label))
+
+
+@transforms.add
+def make_beetmover_checksums_description(config, jobs):
+    for job in jobs:
+        dep_job = job['dependent-task']
+
+        treeherder = job.get('treeherder', {})
+        treeherder.setdefault('symbol', 'tc-BMcs(N)')
+        dep_th_platform = dep_job.task.get('extra', {}).get(
+            'treeherder', {}).get('machine', {}).get('platform', '')
+        treeherder.setdefault('platform',
+                              "{}/opt".format(dep_th_platform))
+        treeherder.setdefault('tier', 1)
+        treeherder.setdefault('kind', 'build')
+
+        label = job.get('label', "beetmover-{}".format(dep_job.label))
+        dependent_kind = str(dep_job.kind)
+        dependencies = {dependent_kind: dep_job.label}
+        for k, v in dep_job.dependencies.items():
+            if k.startswith('beetmover'):
+                dependencies[k] = v
+
+        attributes = {
+            'nightly': dep_job.attributes.get('nightly', False),
+            'build_platform': dep_job.attributes.get('build_platform'),
+            'build_type': dep_job.attributes.get('build_type'),
+        }
+        if dep_job.attributes.get('locale'):
+            treeherder['symbol'] = 'tc-BMcs({})'.format(dep_job.attributes.get('locale'))
+            attributes['locale'] = dep_job.attributes.get('locale')
+
+        task = {
+            'label': label,
+            'description': "Beetmover {} ".format(
+                dep_job.task["metadata"]["description"]),
+            'worker-type': 'scriptworker-prov-v1/beetmoverworker-v1',
+            'scopes': ["project:releng:beetmover:nightly"],
+            'dependencies': dependencies,
+            'attributes': attributes,
+            'run-on-projects': dep_job.attributes.get('run_on_projects'),
+            'treeherder': treeherder,
+        }
+
+        yield task
+
+
+def generate_upstream_artifacts(refs, platform, locale=None):
+    common_paths = [
+        "public/target.checksums",
+        "public/target.checksums.asc",
+    ]
+
+    upstream_artifacts = [{
+        "taskId": {"task-reference": refs["signing"]},
+        "taskType": "signing",
+        "paths": common_paths,
+        "locale": locale or "en-US",
+    }, {
+        "taskId": {"task-reference": refs["beetmover"]},
+        "taskType": "beetmover",
+        "paths": ["public/balrog_props.json"],
+        "locale": locale or "en-US",
+    }]
+
+    if not locale and "android" in platform:
+        # edge case to support 'multi' locale paths
+        upstream_artifacts.extend([{
+            "taskId": {"task-reference": refs["signing"]},
+            "taskType": "signing",
+            "paths": common_paths,
+            "locale": "multi"
+        }])
+
+    return upstream_artifacts
+
+
+@transforms.add
+def make_beetmover_checksums_worker(config, jobs):
+    for job in jobs:
+        valid_beetmover_job = (len(job["dependencies"]) == 2)
+        if not valid_beetmover_job:
+            raise NotImplementedError("Beetmover checksums must have two dependencies.")
+
+        locale = job["attributes"].get("locale")
+        platform = job["attributes"]["build_platform"]
+
+        refs = {
+            "beetmover": None,
+            "signing": None,
+        }
+        for dependency in job["dependencies"].keys():
+            if dependency.startswith("beetmover"):
+                refs['beetmover'] = "<{}>".format(dependency)
+            else:
+                refs['signing'] = "<{}>".format(dependency)
+        if None in refs.values():
+            raise NotImplementedError("Beetmover checksums must have a beetmover and signing dependency!")
+
+        upstream_artifacts = generate_upstream_artifacts(refs,
+                                                         platform, locale)
+
+        worker = {'implementation': 'beetmover',
+                  'upstream-artifacts': upstream_artifacts}
+        if locale:
+            worker["locale"] = locale
+        job["worker"] = worker
+
+        yield job
--- a/taskcluster/taskgraph/transforms/beetmover_l10n.py
+++ b/taskcluster/taskgraph/transforms/beetmover_l10n.py
@@ -20,20 +20,17 @@ def make_beetmover_description(config, j
         for locale in dep_job.attributes.get('chunk_locales', []):
 
             label = job.get('label',
                             "beetmover-{}-{}".format(locale, dep_job.label))
 
             group = 'tc-BM-L10n'
 
             # add the locale code
-            if 'signing' in label:
-                symbol = 'S{}'.format(locale)
-            else:
-                symbol = locale
+            symbol = locale
 
             treeherder = {
                 'symbol': join_symbol(group, symbol),
             }
 
             beet_description = {
                 'dependent-task': dep_job,
                 'treeherder': treeherder,
new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/transforms/checksums_signing.py
@@ -0,0 +1,95 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+Transform the checksums signing task into an actual task description.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.util.schema import validate_schema
+from taskgraph.transforms.task import task_description_schema
+from voluptuous import Schema, Any, Required, Optional
+
+# Voluptuous uses marker objects as dictionary *keys*, but they are not
+# comparable, so we cast all of the keys back to regular strings
+task_description_schema = {str(k): v for k, v in task_description_schema.schema.iteritems()}
+
+transforms = TransformSequence()
+
+taskref_or_string = Any(
+    basestring,
+    {Required('task-reference'): basestring})
+
+checksums_signing_description_schema = Schema({
+    Required('dependent-task'): object,
+    Required('depname', default='beetmover'): basestring,
+    Optional('label'): basestring,
+    Optional('treeherder'): task_description_schema['treeherder'],
+})
+
+
+@transforms.add
+def validate(config, jobs):
+    for job in jobs:
+        label = job.get('dependent-task', object).__dict__.get('label', '?no-label?')
+        yield validate_schema(
+            checksums_signing_description_schema, job,
+            "In checksums-signing ({!r} kind) task for {!r}:".format(config.kind, label))
+
+
+@transforms.add
+def make_checksums_signing_description(config, jobs):
+    for job in jobs:
+        dep_job = job['dependent-task']
+
+        treeherder = job.get('treeherder', {})
+        treeherder.setdefault('symbol', 'tc-cs(N)')
+        dep_th_platform = dep_job.task.get('extra', {}).get(
+            'treeherder', {}).get('machine', {}).get('platform', '')
+        treeherder.setdefault('platform',
+                              "{}/opt".format(dep_th_platform))
+        treeherder.setdefault('tier', 1)
+        treeherder.setdefault('kind', 'build')
+
+        label = job.get('label', "checksumssigning-{}".format(dep_job.label))
+        dependencies =  {"beetmover": dep_job.label}
+
+        attributes = {
+            'nightly': dep_job.attributes.get('nightly', False),
+            'build_platform': dep_job.attributes.get('build_platform'),
+            'build_type': dep_job.attributes.get('build_type'),
+        }
+        if dep_job.attributes.get('locale'):
+            treeherder['symbol'] = 'tc-cs({})'.format(dep_job.attributes.get('locale'))
+            attributes['locale'] = dep_job.attributes.get('locale')
+
+        upstream_artifacts = [{
+            "taskId": {"task-reference": "<beetmover>"},
+            "taskType": "beetmover",
+            "paths": [
+                "public/target.checksums",
+            ],
+            "formats": ["gpg"]
+        }]
+
+        task = {
+            'label': label,
+            'description': "Checksum signing {} ".format(
+                dep_job.task["metadata"]["description"]),
+            'worker-type': "scriptworker-prov-v1/signing-linux-v1",
+            'worker': {'implementation': 'scriptworker-signing',
+                       'upstream-artifacts': upstream_artifacts,
+                       'max-run-time': 3600},
+            'scopes': [
+                "project:releng:signing:cert:nightly-signing",
+                "project:releng:signing:format:gpg"
+            ],
+            'dependencies': dependencies,
+            'attributes': attributes,
+            'run-on-projects': dep_job.attributes.get('run_on_projects'),
+            'treeherder': treeherder,
+        }
+
+        yield task
--- a/taskcluster/taskgraph/transforms/signing.py
+++ b/taskcluster/taskgraph/transforms/signing.py
@@ -95,19 +95,19 @@ def make_task_description(config, jobs):
             'treeherder', {}).get('machine', {}).get('platform', '')
         treeherder.setdefault('platform', "{}/opt".format(dep_th_platform))
         treeherder.setdefault('tier', 1)
         treeherder.setdefault('kind', 'build')
 
         label = job.get('label', "{}-signing".format(dep_job.label))
 
         attributes = {
-                'nightly': dep_job.attributes.get('nightly', False),
-                'build_platform': dep_job.attributes.get('build_platform'),
-                'build_type': dep_job.attributes.get('build_type'),
+            'nightly': dep_job.attributes.get('nightly', False),
+            'build_platform': dep_job.attributes.get('build_platform'),
+            'build_type': dep_job.attributes.get('build_type'),
         }
         if dep_job.attributes.get('chunk_locales'):
             # Used for l10n attribute passthrough
             attributes['chunk_locales'] = dep_job.attributes.get('chunk_locales')
 
         task = {
             'label': label,
             'description': "{} Signing".format(
--- a/taskcluster/taskgraph/transforms/task.py
+++ b/taskcluster/taskgraph/transforms/task.py
@@ -291,20 +291,16 @@ task_description_schema = Schema({
             Required('formats'): [basestring],
         }],
     }, {
         Required('implementation'): 'beetmover',
 
         # the maximum time to spend signing, in seconds
         Required('max-run-time', default=600): int,
 
-        # taskid of task with artifacts to beetmove
-        # beetmover template key
-        Required('update_manifest'): bool,
-
         # locale key, if this is a locale beetmover job
         Optional('locale'): basestring,
 
         # list of artifact URLs for the artifacts that should be beetmoved
         Required('upstream-artifacts'): [{
             # taskId of the task with the artifact
             Required('taskId'): taskref_or_string,
 
@@ -361,16 +357,18 @@ GROUP_NAMES = {
     'tc-VP': 'VideoPuppeteer tests executed by TaskCluster',
     'tc-W': 'Web platform tests executed by TaskCluster',
     'tc-W-e10s': 'Web platform tests executed by TaskCluster with e10s',
     'tc-X': 'Xpcshell tests executed by TaskCluster',
     'tc-X-e10s': 'Xpcshell tests executed by TaskCluster with e10s',
     'tc-L10n': 'Localised Repacks executed by Taskcluster',
     'tc-BM-L10n': 'Beetmover for locales executed by Taskcluster',
     'tc-Up': 'Balrog submission of updates, executed by Taskcluster',
+    'tc-cs': 'Checksum signing executed by Taskcluster',
+    'tc-BMcs': 'Beetmover checksums, executed by Taskcluster',
     'Aries': 'Aries Device Image',
     'Nexus 5-L': 'Nexus 5-L Device Image',
     'Cc': 'Toolchain builds',
     'SM-tc': 'Spidermonkey builds',
 }
 UNKNOWN_GROUP_NAME = "Treeherder group {} has no name; add it to " + __file__
 
 V2_ROUTE_TEMPLATES = [
@@ -559,17 +557,16 @@ def build_scriptworker_signing_payload(c
 
 @payload_builder('beetmover')
 def build_beetmover_payload(config, task, task_def):
     worker = task['worker']
 
     task_def['payload'] = {
         'maxRunTime': worker['max-run-time'],
         'upload_date': config.params['build_date'],
-        'update_manifest': worker['update_manifest'],
         'upstreamArtifacts':  worker['upstream-artifacts']
     }
     if worker.get('locale'):
         task_def['payload']['locale'] = worker['locale']
 
 
 @payload_builder('balrog')
 def build_balrog_payload(config, task, task_def):