1301143 - Provide an ESR update channel which does not switch major versions

Status: RESOLVED WONTFIX

(Release Engineering :: Release Requests, defect)

Description

[Andrew Swan [:aswan]]

+++ This bug was initially created as a clone of Bug #1268399 +++

The original summary is below, the original bug was since transformed into something unrelated.  APIs to block updates are not likely to ever be part of WebExtensions, so moving this here to cover the request at the end of the original summary below:


When I tried to migrate my addon "Only Minor Update" to WebExtensions, I realized that there are too few information under "chrome.PlatformInfo".

https://addons.mozilla.org/firefox/addon/only-minor-update/

The addon downloads Firefox's update information internally and blocks it if it includes a major update (like Firefox 38 to 45), to allow Firefox to apply only security fixes. The addon tries to complete the URL from "app.update.url" like "https://aus5.mozilla.org/update/3/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml".
In XUL-based addons we can use nsIURLFormatter ( http://mxr.mozilla.org/mozilla-central/source/toolkit/components/urlformatter/nsURLFormatter.js ) but currently there is no alternative in WebExtensions.

Otherwise, I simply need a new option of Firefox itself to ignore major update and apply only security fixes.

Comment 1

[Robert Strong (they/them - no direct email)]

I don't think we want this in product ever on the release channel since a major release on the release channel typically includes security fixes and I don't think we want an esr only in product feature.

Comment 2

[Kris Maglione [:kmag]]

(In reply to Robert Strong [:rstrong] (use needinfo to contact me) from comment #1)
> I don't think we want this in product ever on the release channel since a
> major release on the release channel typically includes security fixes and I
> don't think we want an esr only in product feature.

I think this actually makes some amount of sense for ESR, given the overlap window for ESR major releases. I don't think there's a good justification for it in normal release channels.

Comment 3

[Robert Strong (they/them - no direct email)]

Not going to provide an esr only in product option for this so resolving -> wontfix

Comment 4

[Kris Maglione [:kmag]]

Could we provide a separate ESR update channel that needs to be explicitly switched to the next major version before it updates to it, instead?

Comment 5

[Robert Strong (they/them - no direct email)]

Providing a separate update channel would be up to release engineering.

Comment 6

[Rail Aliiev [:rail]]

(In reply to Kris Maglione [:kmag] from comment #4)
> Could we provide a separate ESR update channel that needs to be explicitly
> switched to the next major version before it updates to it, instead?

Can you elaborate on this? What would be UX in this case?

When we start shipping a new ESR release, we still have the old one around for 2 overlapping releases (~12 weeks) and we do not advertise updates to the newer release. We believe it gives enough time for corporate users to test the new version.

Comment 7

[Kris Maglione [:kmag]]

I'm not the best person to ask. We were asked by the author of the Only Minor Update[1] add-on to add support for this for the sake of enterprise users.

[1]: https://addons.mozilla.org/firefox/addon/only-minor-update/

Comment 8

[Rail Aliiev [:rail]]

Ah, thanks for the redirect!

Comment 9

[YUKI "Piro" Hiroshi]

> When we start shipping a new ESR release, we still have the old one around for 2 overlapping releases (~12 weeks) and we do not advertise updates to the newer release. We believe it gives enough time for corporate users to test the new version.

Basically our customers need a guaranty: the Firefox (ESR) won't be updated to the next major version unexpectedly *without his decision*.

They trust minor updates because minor updates won't break existing custom settings and their (internal) web apps. However, major updates have higher risks about compatibility. Of course we (support provider) recommend updating to the next major ESR to them, but by some reasons, some customers may not complete updating to everything for the next ESR until the old ESR ends its life. Thus they sometimes make decision that they keep using old (unsupported) versions and keep it safe with some other methods like content filters.

Currently, because ESR can be updated to the next ESR by Mozilla implicitly, we have to disable all auto-update for such customers and provide minor updates in other way (and the addon "Only Minor Update" is one of those solutions.) Most our customer request us to do the customization, so I think that major ESR users (enterprise, company users) have same requirement.

Comment 10

[Rail Aliiev [:rail]]

Sylvestre, what you say? I almost ready to WONTFIX it again :)

Comment 11

[Kris Maglione [:kmag]]

Before WONTFIXing, please at least discuss this with the enterprise group. I don't especially like this idea, but if we don't support it in some way, then enterprise users are going to find some other way of doing it. This is how we wind up with enterprises disabling updates, or MITMing the update servers.

Comment 12

[Rail Aliiev [:rail]]

Sure. Shall we CC/NI someone else here?

Comment 13

[Rail Aliiev [:rail]]

CC Robert, who's been pushing hard updating old versions.

Comment 14

[Sylvestre Ledru [:Sylvestre]]

I understand both points. However, I believe that we should continue the way we do things. I think we are providing enough options for our users currently.

Comment 15

[Rail Aliiev [:rail]]

Closing. We can reopen it or open a new one if we decide to revisit this.