Closed Bug 1153432 (nsec-installing) Opened 9 years ago Closed 7 years ago

[META] Tracking bug for Installing and Updating implementation of New Security Model

Categories

(Firefox OS Graveyard :: General, defect, P1)

Product:
Firefox OS Graveyard
Component:
General
Platform:
x86
macOS
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: jgong, Unassigned)

References

(Depends on 1 open bug)

Details

(Whiteboard: [newsecurity])

User Story

This is a V3 initiative for a New Security Model.  https://wiki.mozilla.org/FirefoxOS/New_security_model

This Meta Bug is for tracking the "Installing and Updating" implementation, a sub-component of the bigger New Security Model project. https://wiki.mozilla.org/FirefoxOS/New_security_model#Installing_and_updating

*****
Installing and Updating

Signed packages follow normal http semantics. I.e. if the package still exists in our http cache when the user revisits a signed page, but the cache headers indicate that the content needs to be updated, we do a normal GET request to see if a new version needs to be downloaded.

If a new version of the package is being sent, we follow the same behavior as when visiting a package for the first time. I.e. we need to reverify signatures as well as update any permissions in the nsIPermissionManager database.

However, we want to avoid having to download a whole package if just part of it has changed. In order to support that we hope to enable the server to respond to the GET request for an updated package with just a "diff" of what's changed between the previous and current version.

One possible way to do this would be to have gecko indicate that it supports a new type of content encoding as well as send the etag of the current package file. The server can then look at the etag and if it has (or can generate) a diff between the clients version and the latest version, it can respond with a special content-encoding as well as the package diff.

Gecko can then use the diff to patch the existing package.
This is a V3 initiative for a New Security Model.  https://wiki.mozilla.org/FirefoxOS/New_security_model

This Meta Bug is for tracking the "Installing and Updating" implementation, a sub-component of the bigger New Security Model project. https://wiki.mozilla.org/FirefoxOS/New_security_model#Installing_and_updating
User Story: (updated)
No longer depends on: nsec-isolation
Blocks: nsec
Blocks: nsec-signing
Blocks: nsec-origins
Blocks: nsec-isolation
Blocks: nsec-sw
Blocks: nsec-csp
Blocks: nsec-csp
No longer depends on: nsec-csp
Blocks: nsec-signing
No longer depends on: nsec-signing
Blocks: nsec-verify
No longer depends on: nsec-verify
Blocks: 1153449
Whiteboard: [NewSecurity] → [newsecurity]
Priority: -- → P1
Alias: nsec-installing
No longer depends on: nsec-isolation, nsec-sw, nsec-origins
blocking-b2g: --- → 2.5+
Depends on: 1202555
Depends on: 1212223
Depends on: 1212761
Depends on: 1216062
Component: Security → General
Product: Firefox → Firefox OS
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.