248218 - Updates don't display xpi cert information

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[Ben Goodger (use ben at mozilla dot org for email)]

The update wizard does not show any cert information that may exist for the
update xpis it finds....

The UI that lists the available updates needs to be changed to show certs
associated with the updates, and the new nsIXPInstallManager interface method
initManagerFromChrome needs to be updated to take a list of certs as well so
that the manager can verify when install occurs.

Comment 1

[Asa Dotzler [:asa]]

This seems like something we need to get for 1.1. Can we plus it?

Comment 2

[Daniel Veditz [:dveditz]]

I'd like to plus it.

Comment 3

[Benjamin Smedberg]

In fact, I think we should go farther and check the particular signing cert
against the original cert used to install the extension (+app?). But we at least
need a way to view the cert. Helpwanted, I'm not sure either Ben or I has time
to get to this in the next 6 weeks.

Comment 4

[Asa Dotzler [:asa]]

This isn't going to block our app update work but may be something that dougt
and dveditz want to be involved with around the extension signing issue. 

Comment 5

[Chris Beard]

We've talked about this in terms of the shift to signing of Extensions in the
1.5.x timeframe (dougt, beng, darin, shaver, gerv et al.).  Is someone
reasonably going to be able to get to this in the next week in order for it to
make 1.5?  Otherwise, I think we need to defer this work.

/cb

Comment 6

[Doug Turner (:dougt)]

no one is working on this at the moment.  this is _not_ going to make the 1.5
train if work is needed to be complete in one week.

Comment 7

[tinywizard]

This is quite a serious issue, because it means that unsigned xpi files can be
installed without the user's knowledge:  The Update procedure happily downloads
and installs unsigned updates such as
/pub/mozilla.org/firefox/releases/1.0.6/update/win32/en-US/update-1.0.6.xpi

That brings us to another problem - major firefox updates such as this, should
be signed.
 

Comment 8

[Robert Strong (they/them - no direct email)]

We no longer use xpi's for app update so resolving -> invalid

Comment 9

[Dave Townsend [:mossop]]

Rob this seems valid for the Add-ons manager. Some of the comments do look like app updated related but I think it's sensible to consider showing xpi certs for extension updates.

Comment 10

[Robert Strong (they/them - no direct email)]

You are right and sorry about that... I was going on this bug blocking bug 292163 which is for app update.

Comment 11

[Dave Townsend [:mossop]]

How useful is this considering that we now only accept updates over reasonably secure channels?

Comment 12

[Blair McBride [:Unfocused] (UNAVAILABLE)]

(In reply to Dave Townsend (:Mossop) from comment #11)
> How useful is this considering that we now only accept updates over
> reasonably secure channels?

dveditz: Ping?

Comment 13

[Robert Helmer [:rhelmer]]

As of Firefox 43, we require all add-ons (including updates) to be signed by a Mozilla cert:
https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox

Since there's only one acceptable certificate and it's always verified before install or update, a UI to show cert information doesn't seem as helpful anymore.