1122622 - Overwrite addon file with signed file during signing

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Admin/Editor Tools, defect)

Description

[Mathieu Agopian [:magopian]]

At the moment, when an addon file is signed, a new file is created with the .signed.xpi extension:

- https://github.com/mozilla/olympia/blob/3b9d128b04ac85d01c204feb61be9f67ae91d11e/apps/files/models.py#L285
- https://github.com/mozilla/olympia/blob/3b9d128b04ac85d01c204feb61be9f67ae91d11e/lib/crypto/packaged.py#L88

However, this is not ideal and causes several concerns, like adding code paths to serve the signed version if it exists, moving it to the "guarded_addons" folder if needed, and so on.

Instead, we want to overwrite the addon file with the newly signed version, and have a "signed" field on the File model, which can have three values:
1/ unsigned
2/ full signed
3/ prelim signed

Comment 2

[Mathieu Agopian [:magopian]]

PR: https://github.com/mozilla/olympia/pull/425

Comment 3

[Mathieu Agopian [:magopian]]

Fixed in https://github.com/mozilla/olympia/commit/e344cb23efd699dd4fa8168daab0c4fa040b4638

STR:
1/ submit a new addon (or new version of an addon)
2/ review it (prelim or full)
3/ download it
4/ make sure the filename ends with the ".xpi" extension and not the ".signed.xpi" extension
5/ unzip the downloaded xpi file, it should have a META-INF folder with three files: zigbert.rsa, zigbert.sf and manifest.mf

Comment 4

[Madalin Cotetiu]

Verified as fixed in FF35(Win7) in addons-dev.allizom.org
Postfix screencast: http://screencast.com/t/N1aAsVKmFg
Closing bug.