mozilla-releng / balrog / #5615

90%

main: 90%

Pull #3836

circleci

fix: require signoff when modifying only a base release or only adding a new asset

We received a report that demonstrated that assets can be inserted or modified for protected releases could be inserted without signoff. It turns out that the check being fix here was broken in two ways:
1) It only required signoff if the base blob _and_ and an asset were being modified
2) It didn't compare assets correctly at all, so `current_assets != new_assets` was always true (this meant that #1 was mitigated...but only because of this bug).

This addresses both issues, and fixes https://bugzilla.mozilla.org/show_bug.cgi?id=2047458.

2192 of 2574 branches covered (85.16%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

5770 of 6278 relevant lines covered (91.91%)

0.92 hits per line