1190973 - Simulator install fails when add-on signatures required

Status: RESOLVED FIXED

(DevTools Graveyard :: WebIDE, defect)

Description

[J. Ryan Stinnett [:jryans] (Use needinfo, replies may be slow)]

WebIDE and its simulators are sort of a special case when it comes to add-on signing rules.

The main reason is that WebIDE does not need the add-ons to actually execute their JS at all, since we just need the binary blobs they contain.  So, installed but disabled simulators will still run, and are only a potential UX issue since they appear disabled in the Firefox add-on manager.

However, the signature check does block installing *new* simulators, since they are checked before install, as Jen noticed in bug 1181388 comment 2.

So, we need to make some kind of change to allow new users to install simulators moving forward.

Some possible options include:

A. WebIDE could temporarily disable the signing pref while installing a simulator
B. There may be some internal add-on manager API that will install an add-on without performing the signing check
C. Painfully get 18 simulator XPIs (6 versions * 3 platforms) signed through AMO
D. Stop using add-on manager to download simulators

Comment 1

[J. Ryan Stinnett [:jryans] (Use needinfo, replies may be slow)]

Mossop, would the add-on team be very unhappy with us if we attempt option A or B above?

Can you think of possible alternatives not listed above?

The main issue for us is prioritization, as we don't have anyone focused on simulators at the moment, so I am trying to find the simplest step we can take to get simulator installs working again.

Comment 2

[Dave Townsend [:mossop]]

(In reply to J. Ryan Stinnett [:jryans] (use ni?) from comment #0)
> WebIDE and its simulators are sort of a special case when it comes to add-on
> signing rules.
> 
> The main reason is that WebIDE does not need the add-ons to actually execute
> their JS at all, since we just need the binary blobs they contain.  So,
> installed but disabled simulators will still run, and are only a potential
> UX issue since they appear disabled in the Firefox add-on manager.
> 
> However, the signature check does block installing *new* simulators, since
> they are checked before install, as Jen noticed in bug 1181388 comment 2.
> 
> So, we need to make some kind of change to allow new users to install
> simulators moving forward.
> 
> Some possible options include:
> 
> A. WebIDE could temporarily disable the signing pref while installing a
> simulator

I'd really like to avoid this if we can, for obvious reasons.

> B. There may be some internal add-on manager API that will install an add-on
> without performing the signing check

There isn't anything that would work here.

> C. Painfully get 18 simulator XPIs (6 versions * 3 platforms) signed through
> AMO

Is this really painful? I uploaded a bunch of test XPIs to a bug and jason signed them in a matter of hours.

> D. Stop using add-on manager to download simulators

If you don't care about updates to the packages and they aren't running as actual add-on code anymore then you may not need the overhead of the add-ons manager for this.

Comment 3

[J. Ryan Stinnett [:jryans] (Use needinfo, replies may be slow)]

(In reply to Dave Townsend [:mossop] from comment #2)
> > C. Painfully get 18 simulator XPIs (6 versions * 3 platforms) signed through
> > AMO
> 
> Is this really painful? I uploaded a bunch of test XPIs to a bug and jason
> signed them in a matter of hours.

The main reason it's painful with simulators are:

* the files are quite large (~100 MB) and take a while to upload
* AMO's validator explodes after upload ("subpackage is invalid", among other errors)

I'll investigate this "file a bug and receive signed XPIs" approach.

> > D. Stop using add-on manager to download simulators
> 
> If you don't care about updates to the packages and they aren't running as
> actual add-on code anymore then you may not need the overhead of the add-ons
> manager for this.

We do occasionally release updates, so that's one aspect of using the add-on manager that is saving us time, since we don't have to worry about updating ourselves.

Comment 4

[J. Ryan Stinnett [:jryans] (Use needinfo, replies may be slow)]

Big thanks to Jason Thomas who signed the simulators for us in bug 1191933.

I've now deployed signed simulators for all existing FxOS versions and desktop platforms.  New installs should now be functioning again for users affected by the signature check, and the red signature error should disappear for existing users after updating.