1314710 - support manifest.json as well as install.rdf for bootstrap.js addons

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect, P5)

Description

[Robert Helmer [:rhelmer]]

Right now AddonManager assumes that the presence of `manifest.json` means WebExtension and `install.rdf` is a bootstrap.js type.

Let's instead add a flag in `applications.gecko` to allow bootstrap.js extensions to be loaded, they can use the new manifest format and `install.rdf` can be more easily dropped in the future.

Comment 1

[Kris Maglione [:kmag]]

I think I'd lean more toward supporting manifest.json for hybrid WebExtensions, and letting them specify a bootstrap.js file to run at startup.

Comment 2

[Robert Helmer [:rhelmer]]

(In reply to Kris Maglione [:kmag] from comment #1)
> I think I'd lean more toward supporting manifest.json for hybrid
> WebExtensions, and letting them specify a bootstrap.js file to run at
> startup.

Hm well we will continue to have bootstrap.js extensions without WebExtension bits for the foreseeable future, especially for system addons - is it possible to have a "hybrid" extension that doesn't actually include the embedded WebExtension?

Comment 3

[Kris Maglione [:kmag]]

(In reply to Robert Helmer [:rhelmer] from comment #2)
> Hm well we will continue to have bootstrap.js extensions without
> WebExtension bits for the foreseeable future, especially for system addons -
> is it possible to have a "hybrid" extension that doesn't actually include
> the embedded WebExtension?

Yeah. I don't think we'd include the webextension/ directory in this case, so the only difference that would actually matter would be if you included a manifest directive that invoked some WebExtension functionality.

Comment 4

[Andy McKay]

I'm not quite following why we'd want to do this. 

Also if an add-on is a WebExtension we are on pretty solid ground with knowing what it can and can't do, is an add-on using this a WebExtension or bootstrapped add-on? The hybrid or embedded webextension has a clear security policy around it (its a bootstrapped extension).

Comment 5

[Kris Maglione [:kmag]]

(In reply to Andy McKay [:andym] from comment #4)
> I'm not quite following why we'd want to do this. 

Because it would allow us to throw away a huge chunk of add-on manager code.

Comment 6

[Robert Helmer [:rhelmer]]

(In reply to Kris Maglione [:kmag] from comment #5)
> (In reply to Andy McKay [:andym] from comment #4)
> > I'm not quite following why we'd want to do this. 
> 
> Because it would allow us to throw away a huge chunk of add-on manager code.

+1. Removing a dependency on RDF is important long-term too.

Comment 7

[:shell escalante]

future clean-up of code bug - could take sooner, but not blocking

Comment 8

[Robert Helmer [:rhelmer]]

(In reply to Andy McKay [:andym] from comment #4)
> I'm not quite following why we'd want to do this. 
> 
> Also if an add-on is a WebExtension we are on pretty solid ground with
> knowing what it can and can't do, is an add-on using this a WebExtension or
> bootstrapped add-on? The hybrid or embedded webextension has a clear
> security policy around it (its a bootstrapped extension).

I don't think this implies any kind of change in the security policy, basically there would only be what we now call the "hybrid webextension" type, no standalone install.rdf+bootstrap.js type anymore.

Comment 9

[Andrew Swan [:aswan]]

We've chosen webextensions with bundled experiments to handle extensions that need to run privileged code.