Use github artifact attestations for the prebuilt artifacts

[jschwe]

I tested this on my local fork (changed line 908 to point to jschwe/mozjs.
On my work machine the attestation takes around 500ms, but network is generally slow (downloading the 16MB artifact via curl takes somewhere between 20 and 60s for some reason)

[mukilan]

This looks good to me, but I guess someone more familiar with the prebuilt artifact feature can also review. cc @sagudev, @wusyong

[jschwe]

I would love to see this merged, simply since it would allow servo builds for OH to work on windows. If there are objections to using gh to verify the OH shared library, then I can also remove that for now.

[sagudev]

Shouldn't prebuilt artifacts already work?

[jschwe]

true, I guess the issue is that we never cut a release after #501. Should i open a seperate PR which just bumps the version?

[sagudev]

Ah we didn't bump mozjs-sys ver in #501, so that's why there is no ohos release. So what this PR actually does is use attestation for ohos artifact. If we decide to introduce attestation, we should introduce it for all targets.

[sagudev]

Should i open a seperate PR which just bumps the version?

That would be ideal.

[jschwe]

If we decide to introduce attestation, we should introduce it for all targets.

I remember someone on zulip had reservations about potential influence on runtime of the build-script, so I thought perhaps we should first get some real-world experience on one target, before affecting the commonly used ones

[sagudev]

I remember someone on zulip had reservations about potential influence on runtime of the build-script, so I thought perhaps we should first get some real-world experience on one target, before affecting the commonly used ones

That was me :). I think we should make make it for all platforms but let it be disabled by default (enabled via MOZJS_ATTESTATION), this way we can test it reasonably faster and then decide.

[jschwe]

MOZJS_ATTESTATION

How fancy do we want to make this switch? I guess having an option like MOZJS_ATTESTATION=force, which causes the build-script to exit with an error if gh is not found would be nice. I personally would say we could just differentiate between the variants "force", "variable not set" and "set to something !=force" and wouldn't bother with checking for values like false, off, no, 0 etc. What do you think?

[sagudev]

MOZJS_ATTESTATION

How fancy do we want to make this switch? I guess having an option like MOZJS_ATTESTATION=force, which causes the build-script to exit with an error if gh is not found would be nice. I personally would say we could just differentiate between the variants "force", "variable not set" and "set to something !=force" and wouldn't bother with checking for values like false, off, no, 0 etc. What do you think?

Sounds good.

[jschwe]

Is it possible we need to update the upstream mozjs COMMIT again? seems like the artifact download is failing.

[sagudev]

Is it possible we need to update the upstream mozjs COMMIT again? seems like the artifact download is failing.

We need to update SM to new minor release. I will do it later today.

[sagudev]

I will review this at the end of the week.

[sagudev]

Generally LGTM, still need to test this on my machine.

[mrobinson]

Seems good to me. Let's give this a shot.