1059546 - Update for Stage marketplace cannot be installed

Status: VERIFIED FIXED

(Firefox OS Graveyard :: Gaia::Build, defect, P1)

Description

[Johan Lorenzo [:jlorenzo]]

Build info
Gaia      d72f8ad53448aed577c01ff6e11d958463f261e7
Gecko     https://hg.mozilla.org/releases/mozilla-b2g32_v2_0/rev/2a18149b3ae8
BuildID   20140827000204
Version   32.0
ro.build.version.incremental=110
ro.build.date=Fri Jun 27 15:57:58 CST 2014
B1TC00011230

STR
1. Flash your device to the latest eng build
2. Open settings, Device info and check for update
3. When the update notification appears, download the stage update

Actual result:
The stage app shows the error icon and you get this single line in logcat:
> E/GeckoConsole( 291): Content JS INFO at app://system.gaiamobile.org/js/updatable.js:106 in AppUpdatable.prototype.errorCallBack: downloadError event, error code is NO_DOWNLOAD_AVAILABLE

Comment 1

[krupa raj[:krupa]]

This is blocking all testing on Marketplace. Fabrice, any ideas?

Comment 2

[:gerard-majax]

So, several things: NO_DOWNLOAD_AVAILABLE only comes after a first error and retrying. The first error I got doing the STRs was: INVALID_SIGNATURE. This was fixed by toggling the use of reviewers certificates in the developper options. Then, I got a new error: INSTALL_FROM_DENIED. This one is coming from: http://hg.mozilla.org/mozilla-central/annotate/5bd6e09f074e/dom/apps/Webapps.jsm#l3561

In this case, aIsSigned=true and isSignedAppOrigin=false

Comment 3

[:gerard-majax]

With Marketplace reviewer certificates AND adding the pref:

> user_pref("dom.mozApps.signed_apps_installable_from", "https://marketplace.firefox.com,https://marketplace.allizom.org");

I can download and apply the update properly.

Comment 4

[Johan Lorenzo [:jlorenzo]]

(In reply to Alexandre LISSY :gerard-majax from comment #3)
These prefs work for me. I am able to download the lastest Marketplace and go to the new homepage.

Krupa, do you know who we should ping to make this kind of changes? Thanks!

Comment 5

[Andy McKay]

If the pref fixes it, we can add it to the add-on we use for testing already: https://addons.mozilla.org/en-US/firefox/addon/dev-marketplace/

Comment 6

[krupa raj[:krupa]]

(In reply to Andy McKay [:andym] from comment #5)
> If the pref fixes it, we can add it to the add-on we use for testing
> already: https://addons.mozilla.org/en-US/firefox/addon/dev-marketplace/

We don't use the add-on on FirefoxOS. We should have that pref automatically set for eng builds.

Comment 7

[:gerard-majax]

This will make all eng build allowing signed apps from the dev instance of marketplace.

Comment 8

[Johan Lorenzo [:jlorenzo]]

Would setting the prefs in comment 3 in the engineering build be a security issue?

Comment 9

[Paul Theriault [:pauljt] (no longer reading bugmail)]

(In reply to Johan Lorenzo [:jlorenzo] from comment #8)
> Would setting the prefs in comment 3 in the engineering build be a security
> issue?

The only risk would be that if someone compromised apps on the marketplace.allizom.org, they could issue compromised updates to phones with engineering builds. This would only affect eng phones which apps installed from https://marketplace.allizom.org, and only if they enabled the reviewer certificate (iiuc the above comments correctly). So seems like low risk for what is essential functionality - i.e I don't see any reason not to enable the prefs in comment 3 by default for eng builds.

Comment 10

[:gerard-majax]

Thanks paul, I'll implement this.

Comment 11

[:gerard-majax]

Attachment: Add settings/pref mapping for signed apps origins

For testing purpose, we need to add the stage marketplace instance as a
valid source for signed apps. We do this by setting the pref value when
building the Gaia engineering profile.

Comment 12

[:gerard-majax]

Attachment: Add settings/pref mapping for signed apps origins r=fabrice

For testing purpose, we need to add the stage marketplace instance as a
valid source for signed apps. We do this by setting the pref value when
building the Gaia engineering profile.

Comment 13

[:gerard-majax]

Attachment: Gaia build system PR

Comment 14

[:gerard-majax]

Attachment: Add settings/pref mapping for signed apps origins r=fabrice

For testing purpose, we need to add the stage marketplace instance as a
valid source for signed apps. We do this by setting the pref value when
building the Gaia engineering profile.

Comment 15

[Ricky Chien [:rickychien] (inactive)]

Comment on attachment 8496767 [details] [review]
Gaia build system PR

It looks good to me. r=@RickyChien thanks!

Comment 16

[:gerard-majax]

Flagging for cross checking by QA once landed. Please note that we will first checkin the Gecko patch and then merge the Gaia code.

Comment 17

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/b2g-inbound/rev/b5c8b9632730

Comment 18

[Carsten Book [:Tomcat]]

(In reply to Alexandre LISSY :gerard-majax from comment #16)
> Flagging for cross checking by QA once landed. Please note that we will
> first checkin the Gecko patch and then merge the Gaia code.

also gaia pr has landed now in https://github.com/mozilla-b2g/gaia/commit/b9d5e5cda6e9fe38fd2b6c25699b3d249e2ea8a7

Comment 19

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/b5c8b9632730

Comment 20

[Johan Lorenzo [:jlorenzo]]

Verified (Stage app can now be update if you check the option "Use Marketplace reviewer certs") on:
Gaia-Rev        0e280591881d44b80f456bc27e12d9114c218868
Gecko-Rev       https://hg.mozilla.org/mozilla-central/rev/14665b1de5ee
Build-ID        20141001040205
Version         35.0a1
Device-Name     flame
FW-Release      4.4.2
FW-Incremental  eng.cltbld.20141001.071459
FW-Date         Wed Oct  1 07:15:10 EDT 2014
Bootloader      L1TC10011800

When it was found on 2.0, Krupa, you marked that bug as blocker. I don't think we can uplift to that branch anymore. Do you still want an uplift to 2.1? If so, please toggle the blocking-b2g flag.

Comment 21

[Andy McKay]

[Blocking Requested - why for this release]: we can't test for updates to 2.1 devices, which means QA can't sign off on the update mechanism for the Marketplace.

Comment 22

[krupa raj[:krupa]]

(In reply to Andy McKay [:andym] from comment #21)
> [Blocking Requested - why for this release]: we can't test for updates to
> 2.1 devices, which means QA can't sign off on the update mechanism for the
> Marketplace.

agreed. This needs to be uplifted for 2.1

Comment 23

[bhavana bajaj [:bajaj]]

How did we test this on 2.0 given 2.0 is affected?

Comment 24

[bhavana bajaj [:bajaj]]

(In reply to krupa raj[:krupa] from comment #22)
> (In reply to Andy McKay [:andym] from comment #21)
> > [Blocking Requested - why for this release]: we can't test for updates to
> > 2.1 devices, which means QA can't sign off on the update mechanism for the
> > Marketplace.
> 
> agreed. This needs to be uplifted for 2.1

Please seek aurora approval on this to get this landed on 2.1

Comment 25

[Ryan VanderMeulen [:RyanVM]]

(In reply to bhavana bajaj [:bajaj] from comment #24)
> Please seek aurora approval on this to get this landed on 2.1

b2g34 now

Comment 26

[:gerard-majax]

Comment on attachment 8496767 [details] [review]
Gaia build system PR

[Approval Request Comment]
[Bug caused by] (feature/regressing bug #):
[User impact] if declined: QA cannot update the Stage Marketplace app
[Testing completed]: verified by QA, landed on master for two weeks and not regressing
[Risk to taking this patch] (and alternatives if risky): low, it just set a pref for PRODUCTION=0 builds used by QA
[String changes made]: none

Comment 27

[:gerard-majax]

Comment on attachment 8496808 [details] [diff] [review]
Add settings/pref mapping for signed apps origins r=fabrice

NOTE: Please see https://wiki.mozilla.org/Release_Management/B2G_Landing to better understand the B2G approval process and landings.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 
User impact if declined: QA cannot apply Stage marketplace update
Testing completed: landed on master for two weeks, no regression
Risk to taking this patch (and alternatives if risky): low, we just add a new pref/setting mapping that is being used by PRODUCTION=0 gaia builds to add new origin from which we allow signed apps
String or UUID changes made by this patch: none

Comment 28

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g34_v2_1/rev/0472a3cba746

v2.1: https://github.com/mozilla-b2g/gaia/commit/5ef3450cc608b6048fce2dfe3480cbc8e1efa237

Comment 29

[Kevin Grandon :kgrandon]

The build test covers this IMO.