1004571 - support add-on hot fixes

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect)

Comment 1

[Wesley Johnston (:wesj)]

Attachment: Patch

Comment 2

[Wesley Johnston (:wesj)]

I think this is all we'd really need (based on bug 914225), but I need to test it locally. I think we (like TB) can probably use the same cert Desktop is using eventually. I wonder if there's a better way to keep the fingerprints in sync.

Comment 3

[Mark Banner (:standard8)]

Comment on attachment 8430345 [details] [diff] [review]
Patch

Not sure I can officially review here, but it looks good to me.

Comment 4

[Wesley Johnston (:wesj)]

https://hg.mozilla.org/integration/fx-team/rev/c14df983ff08

Do we want to uplift this?

Comment 5

[Mark Finkle (:mfinkle) (use needinfo?)]

(In reply to Wesley Johnston (:wesj) from comment #4)
> https://hg.mozilla.org/integration/fx-team/rev/c14df983ff08
> 
> Do we want to uplift this?

Yes. Aurora should be fine. If it's really safe, then Beta too. Hotfix add-ons give us a way to tweak releases, so sooner this is released the better.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c14df983ff08

Comment 7

[Wesley Johnston (:wesj)]

Comment on attachment 8430345 [details] [diff] [review]
Patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Not a regression
User impact if declined: We can't send hotfixes
Testing completed (on m-c, etc.): This is on nightly now, but hasn't been used yet. Its the exact same code (and even the same signing key) desktop uses though. It would give us a nice non-chem-spill option a little quicker to uplift it.
Risk to taking this patch (and alternatives if risky): If the security key was ever compromised, hotfixes could be used to do some awful stuff. The exact same risk exists on desktop right now. 
String or IDL/UUID changes made by this patch: none.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/a8541c156993