--- a/taskcluster/scripts/run-task
+++ b/taskcluster/scripts/run-task
@@ -20,17 +20,28 @@ import datetime
 import errno
 import json
 import os
 import re
 import socket
 import stat
 import subprocess
 import sys
-import urllib2
+
+try:
+    import urllib.error
+    import urllib.request
+
+    urlopen = urllib.request.urlopen
+    URLError = urllib.error.URLError
+except ImportError:
+    import urllib2
+
+    urlopen = urllib2.urlopen
+    URLError = urllib2.URLError
 
 
 FINGERPRINT_URL = 'http://taskcluster/secrets/v1/secret/project/taskcluster/gecko/hgfingerprint'
 FALLBACK_FINGERPRINT = {
     'fingerprints':
         "sha256:8e:ad:f7:6a:eb:44:06:15:ed:f3:e4:69:a6:64:60:37:2d:ff:98:88:37"
         ":bf:d7:b8:40:84:01:48:9c:26:ce:d9"}
 
@@ -387,24 +398,24 @@ def vcs_checkout(source_repo, dest, stor
     ]
 
     # Obtain certificate fingerprints.  Without this, the checkout will use the fingerprint
     # on the system, which is managed some other way (such as puppet)
     if fetch_hgfingerprint:
         try:
             print_line(b'vcs', 'fetching hg.mozilla.org fingerprint from %s\n' %
                        FINGERPRINT_URL)
-            res = urllib2.urlopen(FINGERPRINT_URL, timeout=10)
+            res = urlopen(FINGERPRINT_URL, timeout=10)
             secret = res.read()
             try:
                 secret = json.loads(secret, encoding='utf-8')
             except ValueError:
                 print_line(b'vcs', 'invalid JSON in hg fingerprint secret')
                 sys.exit(1)
-        except (urllib2.URLError, socket.timeout):
+        except (URLError, socket.timeout):
             print_line(b'vcs', 'Unable to retrieve current hg.mozilla.org fingerprint'
                                'using the secret service, using fallback instead.')
             # XXX This fingerprint will not be accurate if running on an old
             #     revision after the server fingerprint has changed.
             secret = {'secret': FALLBACK_FINGERPRINT}
 
         hgmo_fingerprint = secret['secret']['fingerprints'].encode('ascii')
         args.extend([
@@ -495,17 +506,17 @@ def main(args):
             print('error: run-task must be run as root on POSIX platforms')
             return 1
     else:
         uid = gid = gids = None
 
     if os.path.exists("/dev/kvm"):
         # Ensure kvm permissions for worker, required for Android x86
         st = os.stat("/dev/kvm")
-        os.chmod("/dev/kvm", st.st_mode | 0666)
+        os.chmod("/dev/kvm", st.st_mode | 0o666)
 
     # Validate caches.
     #
     # Taskgraph should pass in a list of paths that are caches via an
     # environment variable (which we don't want to pass down to child
     # processes).
 
     if 'TASKCLUSTER_CACHES' in os.environ:
@@ -626,17 +637,17 @@ def main(args):
 
     if IS_POSIX and running_as_root:
         # Drop permissions to requested user.
         # This code is modeled after what `sudo` was observed to do in a Docker
         # container. We do not bother calling setrlimit() because containers have
         # their own limits.
         print_line(b'setup', b'running as %s:%s\n' % (args.user, args.group))
         os.setgroups(gids)
-        os.umask(022)
+        os.umask(0o22)
         os.setresgid(gid, gid, gid)
         os.setresuid(uid, uid, uid)
 
     # Checkout the repository, setting the GECKO_HEAD_REV to the current
     # revision hash. Revision hashes have priority over symbolic revisions. We
     # disallow running tasks with symbolic revisions unless they have been
     # resolved by a checkout.
     if args.vcs_checkout: