306474 - Plugin finder should support and use xpinstall crypto hashes

Status: RESOLVED INVALID

(Toolkit Graveyard :: Plugin Finder Service, defect)

Description

[Daniel Veditz [:dveditz]]

bug 302284 added support for crypto hashes to validate xpis downloaded from our
mirror network. As part of that we added initManagerWithHashes() to
nsIXPInstallManager as a replacement for initManagerFromChrome(). There would be
three parts to this:

Get hashes into the database
Write hashes into the rdf files (presumably ignored by previous versions)
Change pluginInstallService.js in the client to call the new API

This is most important for any plugins hosted on our mirror network. If we point
to a vendor's download site and trust it we can pass null for the hash to skip
hash checking. If we point to the vendor and the vendor makes silent in-place
security updates (e.g. we point to a "latest" directory) then we MUST NOT use
hashing for those files.

Comment 1

[Daniel Veditz [:dveditz]]

The client part of this was fixed in bug 384925 (pfs "supports" it); the server part ("using" it) is in bug 385037

Comment 2

[:Gavin Sharp [email: [e-mail]]]

It looks to me like this was fixed in bug 384925. Is there anything left to do here?

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Oh, I guess I missed comment 2. Is this a tracking bug, then?

Comment 4

[Justin Dolske [:Dolske]]

XPI plugins are long dead. Next up: non-XPI plugins. ;-)