395243 - Reject add-ons with em:updateKey

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Dave Townsend [:mossop]]

Bug 378216 enforces certain security restrictions on the add-on update process. In particular add-ons can include an updateKey property in the install.rdf which if present requires that the update.rdf includes a signature signed by a matching key.

Since AMO delivers update.rdf over SSL it does not need to use signatures, and indeed cannot deliver signatures. So you should reject any add-ons developers upload with an updateKey specified since they will be unable to receive updates through AMO.

Comment 1

[Reed Loden [:reed]]

Attachment: patch - v1

Comment 2

[Reed Loden [:reed]]

Can I get this reviewed? Pretty please? :)

Comment 3

[Justin Scott [:fligtar]]

Attachment: trimmed patch

Original patch not working for me, probably because of all the gettext files. We don't include those in patches - the English strings are merged to the other locales before or after commit and .mo files updated before a push.

Manually patched the relevant files and am reviewing now.

Comment 4

[Justin Scott [:fligtar]]

Comment on attachment 283511 [details] [diff] [review]
trimmed patch

r=fligtar

Thanks for the patch, tested and works as it should.

Comment 5

[Justin Scott [:fligtar]]

Checked in with gettext updates.