wtf is tooltool?

ToolTool is a tool that helps teams reliably share and download large binary files, things like compiled software packages, SDKs, or other pre-built artifacts. Instead of everyone building these files from source or passing them around manually, ToolTool stores them in a central server so they can be fetched on demand. It was built by Mozilla for their release engineering workflow. At its core, ToolTool uses a manifest file, a simple list written in JSON, that describes each file by its name, size, and a cryptographic fingerprint called a hash. When someone runs a fetch command, the client downloads the files listed in the manifest and verifies each one by checking that its hash matches what the manifest expects. This way, if a file was corrupted or tampered with, the mismatch is caught before it causes problems. Uploading files works similarly. A user adds files to a manifest, marking each as either public or internal. Internal files are available only to people with the right permissions, useful for things like proprietary SDKs that can't be freely redistributed but shouldn't contain secrets like passwords. Uploads require authentication through Mozilla's Taskcluster system. The project includes a client, an API, a frontend, and everything needed to run the service. In practice, it's used by release engineers and build automation systems that need to pull specific pre-built binaries into their pipelines. A compiler toolchain, for example, might be stored as a tarball in ToolTool so that build jobs can download and use a known-good version without compiling it themselves. Mozilla runs staging and production environments, deploying from corresponding branches with each push.