1152102 - Rename the .rsa files when we sign add-ons

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Add-on Validation, defect, P1)

Description

[Wil Clouser [:clouserw]]

One concern that was raised is that every time we run magopian's sign-everything script it will re-sign and re-increment the add-on version.  This means if we have to kill the script halfway through, or it crashes, or whatever when we re-run we could end up with $VERSION.1.1[etc].  Instead of blindly re-signing we're going to check inside the .zip first and see if we've signed it before and if so log and skip it (see bug 1152101).

Ryan says trunion can already support this if we include it in the POST.  If that's not the case we need to file a bug for that and let him know as soon as possible to get that cleared out.

It's been suggested the name of the file we use is fligtar.rsa.

Comment 1

[Mathieu Agopian [:magopian]]

The aim is to change the signature files names from:
- META-INF/manifest.mf: stays unchanged
- META-INF/zigbert.rsa: META-INF/fligtar.rsa
- META-INF/zigbert.sf: META-INF/fligtar.sf

From what I can see, this isn't supported by the "signing_client" lib for the moment, as the filenames are harcoded (see code starting https://github.com/mozilla/signing-clients/blob/master/signing_clients/apps.py#L309).

I've created bug 1152209

Comment 2

[Mathieu Agopian [:magopian]]

PR: https://github.com/mozilla/olympia/pull/500
(don't merge until the signing_clients library got updated)

Comment 3

[Mathieu Agopian [:magopian]]

Will use "mozilla" instead of "fligtar" (updated the PR)

Comment 4

[Mathieu Agopian [:magopian]]

Fixed in https://github.com/mozilla/olympia/commit/1cb3febd93de4e8686d0b7e1451657a9c33cb132

STR:
1/ submit a new addon (or version)
2/ have it signed by reviewing it
3/ download it, unzip it, and check the filenames in the META-INF folder: they should be named manifest.mf, mozilla.sf and mozilla.rsa

Comment 5

[Madalin Cotetiu]

Verified as fixed in FF37(Win7) in addons-dev.allizom.org
Postfix screencast: http://screencast.com/t/uPsbxZVdpEm
Closing bug.