1001151 - Marketplace should pass through trust/verfication from repos

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: Consumer Pages, enhancement, P5)

Description

[jvasile]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:29.0) Gecko/20100101 Firefox/29.0 Iceweasel/29.0 (Beta/Release)
Build ID: 20140412111753

Steps to reproduce:

Browsed for apps in the marketplace.


Actual results:

Found apps but had no idea how to evaluate whether I wanted to run that code on my own phone.


Expected results:

In looking at the marketplace, Karl Fogel and I have wished for an icon on packages that indicate an amount of trustworthiness.  We'd love to see an icon that says "This package is built from freely-licensed, publicly available sources."  Basically, we want app developers to be able to take advantage of open trust mechanics so users know they're getting the right code.  They can go look at the repo and make decisions about whether to trust a project and run its code.

There are two ways to accomplish this.  The first is with deterministic builds.  In the Android context, that's hard, but for most HTML5 apps, it's pretty easy.  All we have to do is look in the zip file and verify the text files and images match a repo.

The second way is with build servers, which is pretty trivial for HTML5 apps. The server could pull a repo, and the manifest or standards could specify locations for things.  Zipping it all up isn't hard.  Moz could grab the repo, build the app, sign and ship.  The only thing missing would be a signature from the original developer.

Comment 1

[Tony Santos [:tsmuse]]

We believe the majority of Marketplace users are not looking for this kind of information, and we are unsure how many app developers in the Marketplace are putting their code in public repos, so we don't know how many apps we would be able to verify in this way. All apps in the Marketplace are reviewed by our review team and the packages served from the Marketplace are the reviewed packages.