1441352 - manually test AMO submission process for new addon, to figure out APIs needed

Status: RESOLVED FIXED

(Release Engineering :: General, enhancement)

Description

[Justin Wood (:Callek)]

Releng needs to manually test API's available for submitting language packs for signing.

Comment 1

[Justin Wood (:Callek)]

I've now tested this with one locale, once.

Notes:

* Use python3
* Python-jose for JWT
* Tested on allizom
   * en-GB on allizom had metadata missing, license, summary, and category of the addon, prevented submission via API. Once set on web was ok.
* Authorization Docs: https://addons-server.readthedocs.io/en/latest/topics/api/auth.html
* Signing Docs: https://addons-server.readthedocs.io/en/latest/topics/api/signing.html

* Downloading a signed file may redirect to CDN, c.f. Location: header.
* Need to query status and look for 'files' with a signed:true.

* JWT token can only be max expiry of 5 minutes
* JWT should have a nonce token, where subsequent API calls with the same token fail, but failure was not observed with same token in local testing. [Don't assume this to be true in production]

* Submission of multiple copies of the same Addon version fails (e.g. 58.0b16 where langpack is ver 58.0, and then again for 58.0 release fails)
  * This is related to https://bugzilla.mozilla.org/show_bug.cgi?id=1441359

Comment 2

[Andreas Wagner [:TheOne] [use NI]]

We have a few tools that might make signing (and partly submission) easier:

web-ext: https://github.com/mozilla/web-ext
Caveats: web-ext only officially supports "signing" (meaning unlisted) and it doesn't handle unlisted/listed distinction in any official way. Nevertheless it could work if you are not mixing channels. There are a few known issues and relevant tasks currently being worked on:
* https://github.com/mozilla/web-ext/issues/877
* https://github.com/mozilla/web-ext/issues/804

If you come across other issues, the team would be eager to hear about them.

sign-addon: https://github.com/mozilla/sign-addon
A library used by web-ext to deal with the signing API calls.

Hope that helps.