1827265 - Verify content signatures for RemoteSettings attachments, but allow for offline support

Status: NEW

(Firefox :: Translations, task, P3)

Description

[Greg Tatum [:gregtatum] (REO Fx132)]

RemoteSettings allows for checking content signatures, but it involves hitting the network. This takes time, and can fail. It also blocks the offline-capabilities of the translations feature. In Bug 1825349 we were dealing with this check failing. For now we are disabling the check, but in the future it would be nice to check it, and add logic for detecting if a user is offline, and ignoring it in that case. For the translations MVP we'll do the simpler thing of not checking.

This bug is for tracking turning it back on.

Comment 1

[Greg Tatum [:gregtatum] (REO Fx132)]

It's also important to handle invalid signatures if/when we re-enable:

See: https://bugzilla.mozilla.org/show_bug.cgi?id=1740519#c2

Comment 2

[Greg Tatum [:gregtatum] (REO Fx132)]

Attachment: Bug 1827265 - Skip content verification for translations attachments; r?nordzilla!