bug 1423081 - desktop release update/final verify support. r=callek draft
authorAki Sasaki <asasaki@mozilla.com>
Tue, 05 Dec 2017 19:21:21 -0800
changeset 711427 cb400e98c6341924b6593577882f686bf31c098d
parent 711426 6d5db22bc8d25197f6c1a1f9a1418f335f2c55a3
child 711428 e529b52f200c2174dfae691f5bab2298f889652c
push id93069
push userasasaki@mozilla.com
push dateWed, 13 Dec 2017 22:57:07 +0000
reviewerscallek
bugs1423081
milestone59.0a1
bug 1423081 - desktop release update/final verify support. r=callek MozReview-Commit-ID: AJsterLOwYg
taskcluster/ci/release-buildbot-update-verify/kind.yml
taskcluster/ci/release-final-verify/kind.yml
taskcluster/ci/release-secondary-final-verify/kind.yml
taskcluster/ci/release-update-verify/kind.yml
taskcluster/docker/update-verify/Dockerfile
taskcluster/docs/kinds.rst
taskcluster/taskgraph/morph.py
taskcluster/taskgraph/transforms/buildbot_update_verify.py
taskcluster/taskgraph/transforms/final_verify.py
taskcluster/taskgraph/transforms/job/buildbot.py
taskcluster/taskgraph/transforms/update_verify.py
new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/release-buildbot-update-verify/kind.yml
@@ -0,0 +1,291 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.transform:loader
+
+kind-dependencies:
+   - post-balrog-dummy
+   - post-beetmover-dummy
+   - release-updates-builder
+
+transforms:
+   - taskgraph.transforms.release_deps:transforms
+   - taskgraph.transforms.buildbot_update_verify:transforms
+   - taskgraph.transforms.job:transforms
+   - taskgraph.transforms.task:transforms
+
+job-defaults:
+   name: update-verify
+   run-on-projects: []  # to make sure this never runs in CI
+   shipping-phase: promote
+   worker-type: buildbot-bridge/buildbot-bridge
+   run:
+      using: buildbot
+      release-promotion: true
+   worker:
+      properties:
+         NO_BBCONFIG: "1"
+   extra:
+      chunks: 12
+   notifications:
+      completed:
+         subject: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect"]
+               mozilla-release: ["log_collect"]
+               default: []
+
+      failed:
+         subject: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+      exception:
+         subject: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+jobs:
+   firefox-win64:
+      description: win64 update verify
+      shipping-product: firefox
+      attributes:
+         build_platform: win64
+      run:
+         product: firefox
+      worker:
+         properties:
+            platform: win64
+            CHANNEL:
+               by-project:
+                  jamun: "beta-localtest"
+                  maple: "beta-localtest"
+                  mozilla-beta: "beta-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "beta-firefox-win64.cfg"
+                  maple: "beta-firefox-win64.cfg"
+                  mozilla-beta: "beta-firefox-win64.cfg"
+                  mozilla-release: "release-firefox-win64.cfg"
+                  mozilla-esr52: "esr-firefox-win64.cfg"
+                  default: "none"
+
+   firefox-win32:
+      description: win32 update verify
+      shipping-product: firefox
+      attributes:
+         build_platform: win32
+      run:
+         product: firefox
+      worker:
+         properties:
+            platform: win32
+            CHANNEL:
+               by-project:
+                  jamun: "beta-localtest"
+                  maple: "beta-localtest"
+                  mozilla-beta: "beta-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "beta-firefox-win32.cfg"
+                  maple: "beta-firefox-win32.cfg"
+                  mozilla-beta: "beta-firefox-win32.cfg"
+                  mozilla-release: "release-firefox-win32.cfg"
+                  mozilla-esr52: "esr-firefox-win32.cfg"
+                  default: "none"
+
+   firefox-macosx64:
+      description: macosx64 update verify
+      shipping-product: firefox
+      attributes:
+         build_platform: macosx64
+      run:
+         product: firefox
+      worker:
+         properties:
+            platform: macosx64
+            CHANNEL:
+               by-project:
+                  jamun: "beta-localtest"
+                  maple: "beta-localtest"
+                  mozilla-beta: "beta-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "beta-firefox-macosx64.cfg"
+                  maple: "beta-firefox-macosx64.cfg"
+                  mozilla-beta: "beta-firefox-macosx64.cfg"
+                  mozilla-release: "release-firefox-macosx64.cfg"
+                  mozilla-esr52: "esr-firefox-macosx64.cfg"
+                  default: "none"
+
+   firefox-secondary-win64:
+      description: win64 secondary channel update verify
+      shipping-product: firefox
+      attributes:
+         build_platform: win64
+      run:
+         product: firefox
+      worker:
+         properties:
+            platform: win64
+            CHANNEL:
+               by-project:
+                  mozilla-release: "beta-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  mozilla-release: "beta-firefox-win64.cfg"
+                  default: "none"
+
+   firefox-secondary-win32:
+      description: win32 secondary channel update verify
+      shipping-product: firefox
+      attributes:
+         build_platform: win32
+      run:
+         product: firefox
+      worker:
+         properties:
+            platform: win32
+            CHANNEL:
+               by-project:
+                  mozilla-release: "beta-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  mozilla-release: "beta-firefox-win32.cfg"
+                  default: "none"
+
+   firefox-secondary-macosx64:
+      description: macosx64 secondary channel update verify
+      shipping-product: firefox
+      attributes:
+         build_platform: macosx64
+      run:
+         product: firefox
+      worker:
+         properties:
+            platform: macosx64
+            CHANNEL:
+               by-project:
+                  mozilla-release: "beta-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  mozilla-release: "beta-firefox-macosx64.cfg"
+                  default: "none"
+
+   devedition-win64:
+      description: win64 update verify
+      shipping-product: devedition
+      attributes:
+         build_platform: win64-devedition
+      run:
+         product: devedition
+      worker:
+         properties:
+            platform: win64
+            CHANNEL:
+               by-project:
+                  jamun: "aurora-localtest"
+                  maple: "aurora-localtest"
+                  mozilla-aurora: "aurora-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "aurora-devedition-win64.cfg"
+                  maple: "aurora-devedition-win64.cfg"
+                  mozilla-aurora: "aurora-devedition-win64.cfg"
+                  mozilla-release: "release-devedition-win64.cfg"
+                  mozilla-esr52: "esr-devedition-win64.cfg"
+                  default: "none"
+
+   devedition-win32:
+      description: win32 update verify
+      shipping-product: devedition
+      attributes:
+         build_platform: win32-devedition
+      run:
+         product: devedition
+      worker:
+         properties:
+            platform: win32
+            CHANNEL:
+               by-project:
+                  jamun: "aurora-localtest"
+                  maple: "aurora-localtest"
+                  mozilla-aurora: "aurora-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "aurora-devedition-win32.cfg"
+                  maple: "aurora-devedition-win32.cfg"
+                  mozilla-aurora: "aurora-devedition-win32.cfg"
+                  mozilla-release: "release-devedition-win32.cfg"
+                  mozilla-esr52: "esr-devedition-win32.cfg"
+                  default: "none"
+
+   devedition-macosx64:
+      description: macosx64 update verify
+      shipping-product: devedition
+      attributes:
+         build_platform: macosx64-devedition
+      run:
+         product: devedition
+      worker:
+         properties:
+            platform: macosx64
+            CHANNEL:
+               by-project:
+                  jamun: "aurora-localtest"
+                  maple: "aurora-localtest"
+                  mozilla-aurora: "aurora-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "aurora-devedition-macosx64.cfg"
+                  maple: "aurora-devedition-macosx64.cfg"
+                  mozilla-aurora: "aurora-devedition-macosx64.cfg"
+                  mozilla-release: "release-devedition-macosx64.cfg"
+                  mozilla-esr52: "esr-devedition-macosx64.cfg"
+                  default: "none"
new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/release-final-verify/kind.yml
@@ -0,0 +1,112 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.transform:loader
+
+kind-dependencies:
+   - release-uptake-monitoring
+
+transforms:
+   - taskgraph.transforms.release_deps:transforms
+   - taskgraph.transforms.final_verify:transforms
+   - taskgraph.transforms.task:transforms
+
+job-defaults:
+   name: final-verify
+   run-on-projects: []  # to make sure this never runs as part of CI
+   worker-type: aws-provisioner-v1/gecko-{level}-b-linux
+   worker:
+      implementation: docker-worker
+      os: linux
+      docker-image: mozillareleases/python-test-runner@sha256:0729c2e6e7bc0d6a4cbccb2e66a78e1d8e8cbb5e44105d56e3c9c610230ebd69
+      max-run-time: 7200
+      retry-exit-status: 1
+      env:
+         BUILD_TOOLS_REPO:
+            by-project:
+               jamun: https://hg.mozilla.org/users/stage-ffxbld/tools
+               maple: https://hg.mozilla.org/users/asasaki_mozilla.com/tools
+               default: https://hg.mozilla.org/build/tools
+   notifications:
+      completed:
+         subject: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect"]
+               mozilla-release: ["log_collect"]
+               default: []
+
+      failed:
+         subject: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+      exception:
+         subject: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+jobs:
+   firefox:
+      description: final verify
+      shipping-phase: push
+      shipping-product: firefox
+      worker:
+         env:
+            FINAL_VERIFY_CONFIGS:
+               by-project:
+                  jamun: "beta-firefox-linux.cfg beta-firefox-linux64.cfg beta-firefox-macosx64.cfg beta-firefox-win32.cfg beta-firefox-win64.cfg"
+                  maple: "beta-firefox-linux.cfg beta-firefox-linux64.cfg beta-firefox-macosx64.cfg beta-firefox-win32.cfg beta-firefox-win64.cfg"
+                  mozilla-beta: "beta-firefox-linux.cfg beta-firefox-linux64.cfg beta-firefox-macosx64.cfg beta-firefox-win32.cfg beta-firefox-win64.cfg"
+                  mozilla-release: "release-firefox-linux.cfg release-firefox-linux64.cfg release-firefox-macosx64.cfg release-firefox-win32.cfg release-firefox-win64.cfg"
+                  mozilla-esr52: "esr-firefox-linux.cfg esr-firefox-linux64.cfg esr-firefox-macosx64.cfg esr-firefox-win32.cfg esr-firefox-win64.cfg"
+                  default: ""
+      treeherder:
+         platform: linux64/opt
+         kind: test
+         symbol: Rel(FV)
+         tier: 1
+
+   devedition:
+      description: final verify
+      shipping-phase: push
+      shipping-product: devedition
+      worker:
+         env:
+            FINAL_VERIFY_CONFIGS:
+               by-project:
+                  jamun: "aurora-devedition-linux.cfg aurora-devedition-linux64.cfg aurora-devedition-macosx64.cfg aurora-devedition-win32.cfg aurora-devedition-win64.cfg"
+                  maple: "aurora-devedition-linux.cfg aurora-devedition-linux64.cfg aurora-devedition-macosx64.cfg aurora-devedition-win32.cfg aurora-devedition-win64.cfg"
+                  mozilla-aurora: "aurora-devedition-linux.cfg aurora-devedition-linux64.cfg aurora-devedition-macosx64.cfg aurora-devedition-win32.cfg aurora-devedition-win64.cfg"
+                  mozilla-release: "release-devedition-linux.cfg release-devedition-linux64.cfg release-devedition-macosx64.cfg release-devedition-win32.cfg release-devedition-win64.cfg"
+                  mozilla-esr52: "esr-devedition-linux.cfg esr-devedition-linux64.cfg esr-devedition-macosx64.cfg esr-devedition-win32.cfg esr-devedition-win64.cfg"
+                  default: ""
+      treeherder:
+         platform: linux64-devedition/opt
+         kind: test
+         symbol: Rel(FV)
+         tier: 1
new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/release-secondary-final-verify/kind.yml
@@ -0,0 +1,90 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.transform:loader
+
+kind-dependencies:
+   - post-balrog-dummy
+   - post-beetmover-dummy
+   - release-updates-builder
+
+transforms:
+   - taskgraph.transforms.release_deps:transforms
+   - taskgraph.transforms.final_verify:transforms
+   - taskgraph.transforms.task:transforms
+
+job-defaults:
+   name: secondary-final-verify
+   run-on-projects: []  # to make sure this never runs as part of CI
+   worker-type: aws-provisioner-v1/gecko-{level}-b-linux
+   worker:
+      implementation: docker-worker
+      os: linux
+      docker-image: mozillareleases/python-test-runner@sha256:0729c2e6e7bc0d6a4cbccb2e66a78e1d8e8cbb5e44105d56e3c9c610230ebd69
+      max-run-time: 7200
+      retry-exit-status: 1
+      env:
+         BUILD_TOOLS_REPO:
+            by-project:
+               jamun: https://hg.mozilla.org/users/stage-ffxbld/tools
+               maple: https://hg.mozilla.org/users/asasaki_mozilla.com/tools
+               default: https://hg.mozilla.org/build/tools
+   notifications:
+      completed:
+         subject: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect"]
+               mozilla-release: ["log_collect"]
+               default: []
+
+      failed:
+         subject: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+      exception:
+         subject: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+jobs:
+   firefox:
+      description: secondary final verify
+      shipping-phase: promote
+      shipping-product: firefox
+      worker:
+         env:
+            FINAL_VERIFY_CONFIGS:
+               by-project:
+                  mozilla-beta: "beta-firefox-linux.cfg beta-firefox-linux64.cfg beta-firefox-macosx64.cfg beta-firefox-win32.cfg beta-firefox-win64.cfg"
+                  default: ""
+      treeherder:
+         platform: linux64/opt
+         kind: test
+         symbol: Rel(FVS)
+         tier: 1
new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/release-update-verify/kind.yml
@@ -0,0 +1,238 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.transform:loader
+
+kind-dependencies:
+   - post-balrog-dummy
+   - post-beetmover-dummy
+   - release-updates-builder
+
+transforms:
+   - taskgraph.transforms.release_deps:transforms
+   - taskgraph.transforms.update_verify:transforms
+   - taskgraph.transforms.task:transforms
+
+job-defaults:
+   name: update-verify
+   run-on-projects: []  # to make sure this never runs as part of CI
+   shipping-phase: promote
+   worker-type: aws-provisioner-v1/gecko-{level}-b-linux
+   worker:
+      implementation: docker-worker
+      os: linux
+      docker-image:
+         in-tree: "update-verify"
+      max-run-time: 7200
+      retry-exit-status:
+         - 255
+      env:
+         NO_BBCONFIG: "1"
+         BUILD_TOOLS_REPO:
+            by-project:
+               jamun: https://hg.mozilla.org/users/stage-ffxbld/tools
+               maple: https://hg.mozilla.org/users/asasaki_mozilla.com/tools
+               default: https://hg.mozilla.org/build/tools
+   extra:
+      chunks: 12
+   notifications:
+      completed:
+         subject: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "COMPLETED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect"]
+               mozilla-release: ["log_collect"]
+               default: []
+
+      failed:
+         subject: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "FAILED: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+      exception:
+         subject: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         message: "EXCEPTION: [{task[shipping-product]} {release_config[version]} build{release_config[build_number]}/{config[params][project]}] {task_def[metadata][name]} task"
+         plugins:
+            by-project:
+               mozilla-beta: ["log_collect", "ses"]
+               mozilla-release: ["log_collect", "ses"]
+               default: ["ses"]
+         emails:
+            by-project:
+               mozilla-beta: ["release-automation-notifications@mozilla.com"]
+               mozilla-release: ["release-automation-notifications@mozilla.com"]
+               try: ["{task_def[metadata][owner]}"]
+               maple: ["release+tcstaging@mozilla.com"]
+               default: []
+
+jobs:
+   firefox-linux64:
+      description: linux64 update verify
+      shipping-product: firefox
+      worker:
+         env:
+            CHANNEL:
+               by-project:
+                  jamun: "beta-localtest"
+                  maple: "beta-localtest"
+                  mozilla-beta: "beta-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "beta-firefox-linux64.cfg"
+                  maple: "beta-firefox-linux64.cfg"
+                  mozilla-beta: "beta-firefox-linux64.cfg"
+                  mozilla-release: "release-firefox-linux64.cfg"
+                  mozilla-esr52: "esr-firefox-linux64.cfg"
+                  default: "none"
+      treeherder:
+         symbol: UV
+         platform: linux64/opt
+         kind: test
+         tier: 1
+      attributes:
+         build_platform: linux64
+
+   firefox-linux:
+      description: linux update verify
+      shipping-product: firefox
+      worker:
+         env:
+            CHANNEL:
+               by-project:
+                  jamun: "beta-localtest"
+                  maple: "beta-localtest"
+                  mozilla-beta: "beta-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "beta-firefox-linux.cfg"
+                  maple: "beta-firefox-linux.cfg"
+                  mozilla-beta: "beta-firefox-linux.cfg"
+                  mozilla-release: "release-firefox-linux.cfg"
+                  mozilla-esr52: "esr-firefox-linux.cfg"
+                  default: "none"
+      treeherder:
+         symbol: UV
+         platform: linux/opt
+         kind: test
+         tier: 1
+      attributes:
+         build_platform: linux
+
+   firefox-secondary-linux64:
+      description: linux64 secondary channel update verify
+      shipping-product: firefox
+      worker:
+         env:
+            CHANNEL:
+               by-project:
+                  mozilla-release: "beta-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  mozilla-release: "beta-firefox-linux64.cfg"
+                  default: "none"
+      treeherder:
+         symbol: UVS
+         platform: linux64/opt
+         kind: test
+         tier: 1
+      attributes:
+         build_platform: linux64
+
+   firefox-secondary-linux:
+      description: linux secondary channel update verify
+      shipping-product: firefox
+      worker:
+         env:
+            CHANNEL:
+               by-project:
+                  mozilla-release: "beta-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  mozilla-release: "beta-firefox-linux.cfg"
+                  default: "none"
+      treeherder:
+         symbol: UVS
+         platform: linux/opt
+         kind: test
+         tier: 1
+      attributes:
+         build_platform: linux
+
+   devedition-linux64:
+      description: linux64 update verify
+      shipping-product: devedition
+      worker:
+         env:
+            CHANNEL:
+               by-project:
+                  jamun: "aurora-localtest"
+                  maple: "aurora-localtest"
+                  mozilla-aurora: "aurora-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "aurora-devedition-linux64.cfg"
+                  maple: "aurora-devedition-linux64.cfg"
+                  mozilla-aurora: "aurora-devedition-linux64.cfg"
+                  mozilla-release: "release-devedition-linux64.cfg"
+                  mozilla-esr52: "esr-devedition-linux64.cfg"
+                  default: "none"
+      treeherder:
+         symbol: UV
+         platform: linux64-devedition/opt
+         kind: test
+         tier: 1
+      attributes:
+         build_platform: linux64-devedition
+
+   devedition-linux:
+      description: linux update verify
+      shipping-product: devedition
+      worker:
+         env:
+            CHANNEL:
+               by-project:
+                  jamun: "aurora-localtest"
+                  maple: "aurora-localtest"
+                  mozilla-aurora: "aurora-localtest"
+                  mozilla-release: "release-localtest"
+                  mozilla-esr52: "esr-localtest"
+                  default: "default"
+            VERIFY_CONFIG:
+               by-project:
+                  jamun: "aurora-devedition-linux.cfg"
+                  maple: "aurora-devedition-linux.cfg"
+                  mozilla-aurora: "aurora-devedition-linux.cfg"
+                  mozilla-release: "release-devedition-linux.cfg"
+                  mozilla-esr52: "esr-devedition-linux.cfg"
+                  default: "none"
+      treeherder:
+         symbol: UV
+         platform: linux-devedition/opt
+         kind: test
+         tier: 1
+      attributes:
+         build_platform: linux-devedition
--- a/taskcluster/docker/update-verify/Dockerfile
+++ b/taskcluster/docker/update-verify/Dockerfile
@@ -1,11 +1,11 @@
 FROM python:2-slim-stretch
 
 MAINTAINER release@mozilla.com
 
-RUN apt-get -q update \
+RUN dpkg --add-architecture i386 && apt-get -q update \
     # p7zip-full is for extracting Windows and OS X packages
-    # Mercurial and Git are for cloning required repositories
+    # Mercurial is for cloning required repositories
     # wget is for downloading update.xml, installers, and MARs
     # libgtk-3-0 is required to run the Firefox updater
-    && apt-get -q --yes install p7zip-full git mercurial wget libgtk-3-0 \
+    && apt-get -q --yes install p7zip-full mercurial wget libgtk-3-0 libgtk-3.0:i386 \
     && apt-get clean
--- a/taskcluster/docs/kinds.rst
+++ b/taskcluster/docs/kinds.rst
@@ -239,16 +239,36 @@ Submits bouncer updates for releases.
 release-mark-as-shipped
 -----------------------
 Marks releases as shipped in Ship-It.
 
 release-bouncer-aliases
 ------------------------------
 Update Bouncers (download.mozilla.org) "latest" aliases.
 
+release-final-verify
+---------------------
+Verifies the contents and package of release update MARs.
+
+release-secondary-final-verify
+---------------------
+Verifies the contents and package of release update MARs.
+
+release-update-verify
+---------------------
+Verifies the contents and package of release update MARs.
+
+release-buildbot-update-verify
+---------------------
+Verifies the contents and package of release update MARs.
+
+release-updates-builder
+-----------------------
+Top level Balrog blob submission & patcher/update verify config updates.
+
 release-uptake-monitoring
 -------------------------
 Run uptake monitoring for releases.
 
 release-version-bump
 --------------------
 Bumps to the next version.
 
--- a/taskcluster/taskgraph/morph.py
+++ b/taskcluster/taskgraph/morph.py
@@ -236,17 +236,17 @@ def update_test_tasks(taskid, build_task
 def add_s3_uploader_task(taskgraph, label_to_taskid):
     """The S3 uploader task is used by mozharness to upload buildbot artifacts."""
     for task in taskgraph.tasks.itervalues():
         if 'upload_to_task_id' in task.task.get('payload', {}).get('properties', {}):
             added = make_s3_uploader_task(task)
             taskgraph, label_to_taskid = amend_taskgraph(
                 taskgraph, label_to_taskid, [added])
             update_test_tasks(added.task_id, task.task_id, taskgraph)
-            logger.info('Added s3-uploader task')
+            logger.info('Added s3-uploader task for %s' % task.task_id)
     return taskgraph, label_to_taskid
 
 
 class apply_jsone_templates(object):
     """Apply a set of JSON-e templates to each task's `task` attribute.
 
     :param templates: A dict with the template name as the key, and extra context
                       to use (in addition to task.to_json()) as the value.
new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/transforms/buildbot_update_verify.py
@@ -0,0 +1,57 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+Transform the beetmover task into an actual task description.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from copy import deepcopy
+
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.util.schema import resolve_keyed_by
+from taskgraph.util.scriptworker import get_release_config
+
+transforms = TransformSequence()
+
+
+@transforms.add
+def add_command(config, tasks):
+    for task in tasks:
+        release_config = get_release_config(config)
+        total_chunks = task["extra"]["chunks"]
+        platform = task["attributes"]["build_platform"]
+        # We git rid of -devedition (if it exists here) because we're
+        # only using this in the buildername, and buildbot doesn't use
+        # -devedition.
+        platform = platform.replace('-devedition', '')
+        product = task["shipping-product"]
+        buildername = "release-{branch}_" + product + "_" + platform + \
+            "_update_verify"
+        release_tag = "{}_{}_RELEASE_RUNTIME".format(
+            task["shipping-product"].upper(),
+            release_config["version"].replace(".", "_")
+        )
+
+        for this_chunk in range(1, total_chunks+1):
+            chunked = deepcopy(task)
+            chunked["scopes"] = [
+                "project:releng:buildbot-bridge:builder-name:{}".format(
+                    # In scopes, "branch" is called "project"
+                    buildername.replace("branch", "project")
+                )
+            ]
+            chunked["label"] = "release-update-verify-{}-{}/{}".format(
+                chunked["name"], this_chunk, total_chunks
+            )
+            chunked["run"]["buildername"] = buildername
+            chunked.setdefault("worker", {}).setdefault("properties", {})
+            chunked["worker"]["properties"]["script_repo_revision"] = \
+                release_tag
+            chunked["worker"]["properties"]["THIS_CHUNK"] = str(this_chunk)
+            chunked["worker"]["properties"]["TOTAL_CHUNKS"] = str(total_chunks)
+            for thing in ("CHANNEL", "VERIFY_CONFIG"):
+                thing = "worker.properties.{}".format(thing)
+                resolve_keyed_by(chunked, thing, thing, **config.params)
+            yield chunked
new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/transforms/final_verify.py
@@ -0,0 +1,40 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+Transform the beetmover task into an actual task description.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.util.schema import resolve_keyed_by
+from taskgraph.util.scriptworker import get_release_config
+
+transforms = TransformSequence()
+
+
+@transforms.add
+def add_command(config, tasks):
+    for task in tasks:
+        release_config = get_release_config(config)
+        release_tag = "{}_{}_RELEASE_RUNTIME".format(
+            task["shipping-product"].upper(),
+            release_config["version"].replace(".", "_")
+        )
+
+        if not task["worker"].get("env"):
+            task["worker"]["env"] = {}
+        task["worker"]["command"] = [
+            "/bin/bash",
+            "-c",
+            "hg clone $BUILD_TOOLS_REPO tools && cd tools &&" +
+            "hg up -r {} && cd release && ".format(
+                release_tag,
+            ) +
+            "./final-verification.sh $FINAL_VERIFY_CONFIGS"
+        ]
+        for thing in ("FINAL_VERIFY_CONFIGS", "BUILD_TOOLS_REPO"):
+            thing = "worker.env.{}".format(thing)
+            resolve_keyed_by(task, thing, thing, **config.params)
+        yield task
--- a/taskcluster/taskgraph/transforms/job/buildbot.py
+++ b/taskcluster/taskgraph/transforms/job/buildbot.py
@@ -36,19 +36,22 @@ def bb_release_worker(config, worker, ru
     # props
     release_props = get_release_config(config, force=True)
     repo_path = urlparse(config.params['head_repository']).path.lstrip('/')
     revision = config.params['head_rev']
     release_props.update({
         'release_promotion': True,
         'repo_path': repo_path,
         'revision': revision,
-        'script_repo_revision': revision,
     })
     worker['properties'].update(release_props)
+    # Setting script_repo_revision to the gecko revision doesn't work for
+    # jobs that clone build/tools or other repos instead of gecko.
+    if 'script_repo_revision' not in worker['properties']:
+        worker['properties']['script_repo_revision'] = revision
 
 
 def bb_ci_worker(config, worker):
     worker['properties'].update({
         'who': config.params['owner'],
         'upload_to_task_id': slugid.nice(),
     })
 
new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/transforms/update_verify.py
@@ -0,0 +1,53 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+Transform the beetmover task into an actual task description.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from copy import deepcopy
+
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.util.schema import resolve_keyed_by
+from taskgraph.util.scriptworker import get_release_config
+
+transforms = TransformSequence()
+
+
+@transforms.add
+def add_command(config, tasks):
+    for task in tasks:
+        total_chunks = task["extra"]["chunks"]
+        release_config = get_release_config(config)
+        release_tag = "{}_{}_RELEASE_RUNTIME".format(
+            task["shipping-product"].upper(),
+            release_config["version"].replace(".", "_")
+        )
+
+        for this_chunk in range(1, total_chunks+1):
+            chunked = deepcopy(task)
+            chunked["treeherder"]["symbol"] += str(this_chunk)
+            chunked["label"] = "release-update-verify-{}-{}/{}".format(
+                chunked["name"], this_chunk, total_chunks
+            )
+            if not chunked["worker"].get("env"):
+                chunked["worker"]["env"] = {}
+            chunked["worker"]["command"] = [
+                "/bin/bash",
+                "-c",
+                "hg clone $BUILD_TOOLS_REPO tools && cd tools && " +
+                "hg up -r {} && cd .. && ".format(
+                    release_tag,
+                ) +
+                "tools/scripts/release/updates/chunked-verify.sh " +
+                "UNUSED UNUSED {} {}".format(
+                    total_chunks,
+                    this_chunk,
+                )
+            ]
+            for thing in ("CHANNEL", "VERIFY_CONFIG", "BUILD_TOOLS_REPO"):
+                thing = "worker.env.{}".format(thing)
+                resolve_keyed_by(chunked, thing, thing, **config.params)
+            yield chunked