1172642 - Make sure distribution add-ons work when add-on signing is required by default

Status: RESOLVED WORKSFORME

(Firefox for Android Graveyard :: Add-on Manager, defect)

Description

[:Margaret Leibovic]

I don't think we currently have any active distributions that include add-ons, but we'll need a solution in the future to either sign distribution add-ons, or find a way to force allow these add-ons to be installed.

Comment 1

[:Margaret Leibovic]

Mossop, have you thought about this problem for desktop? Is there anything to do here, other than just making sure we sign add-ons that go into distribution bundles?

Comment 2

[Dave Townsend [:mossop]]

Yeah, they just need to be signed. AMO has an option to upload unlisted add-ons which should work.

Comment 3

[:Margaret Leibovic]

Karen, do you know if we have any active distributions that bundle add-ons? If not, I'm just going to close this bug and call things done!

Comment 4

[Karen Rudnitski [:kar]]

Active, live distros with add-ons? No.

Comment 5

[:Margaret Leibovic]

(In reply to Karen Rudnitski [:kar] from comment #4)
> Active, live distros with add-ons? No.

Huzzah!

We should just add this "make sure add-ons are signed" step to our checklist (do we have a checklist?) for creating distributions. I added a note to the distribution wiki page:
https://wiki.mozilla.org/Mobile/Distribution_Files#Add-ons

Comment 6

[:Margaret Leibovic]

Oh... I just realized that testDistribution uses an XPI that we include in out test assets. I may need to sign that, so that this test doesn't fail when we merge to beta/release.

Mossop, what's the best way for me to sign a test add-on? Should I also upload it to AMO as an unlisted add-on?

Comment 7

[Dave Townsend [:mossop]]

Either that, or filing a bug and getting jason to do it manually works. Or we're apparently going to be automatically signing test XPIs on the merge from aurora to beta

Comment 8

[:Margaret Leibovic]

I'll take this to update the test.

The distribution add-on we're testing is included in a .zip file, so it likely wouldn't be automatically signed. I can just do this manually to update the asset in the tree.

Comment 9

[:Margaret Leibovic]

I'll sign the add-on and update it in the tree.

Andy, what's the easiest way for me to sign the add-on?

Comment 10

[Andy McKay]

kmoir is setting up an account on AMO that releng and others can share, so lets use that account. It's probably better than using a personal account.

Once we've got that account, its just a matter of either using the API or just going to the submit addon page, using that account and submit it. You have to ensure its unlisted so it doesn't go through the review process. You can then download it from the review pages.

Comment 11

[Kim Moir [:kmoir] ET]

Bug 1239843 is for signing account for automation

Comment 12

[:Margaret Leibovic]

I haven't done anything to sign the bundled distribution add-on, but this is already on beta, and I haven't seen any failures happening, so I'm going to just close this out.