639601 - "Downloaded file hash did not match provided hash" installing some add-ons on MAMO

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect)

Description

[Matt Brubeck (:mbrubeck)]

When I try to install Show Tooltips 2.0.2 from this page using a trunk build of mobile Firefox (Fennec):
https://addons.mozilla.org/mobile/addon/show-tooltips/versions

I get an "Installation failed" error, and the following log message:

WARN addons.xpi: Download failed: Downloaded file hash (ba8b778770ad3e5d8491bd411bea8b9f584a588a62b044c7d2e0a650476b3014) did not match provided hash (d25433d9e5e2d69b816a5eea64b6292cb8d6ce4711564f65f085931a2fa4aac4)

Installing the same XPI by downloading it from a web server works without problems.

Comment 1

[Matt Brubeck (:mbrubeck)]

The source to that page contains:

<a class="button download caution "
data-hash="sha256:d25433d9e5e2d69b816a5eea64b6292cb8d6ce4711564f65f085931a2fa4aac4"
href="/en-US/mobile/addon/show-tooltips/"
data-realurl="https://addons.mozilla.org/mobile/downloads/file/113502/show_tooltips-2.0.2-fn.xpi?src=version-history">

When I download the file on my PC, the checksum matches the one in the data-hash attribute:

$ wget https://addons.mozilla.org/mobile/downloads/file/113502/show_tooltips-2.0.2-fn.xpi -O - | sha256sum
d25433d9e5e2d69b816a5eea64b6292cb8d6ce4711564f65f085931a2fa4aac

Comment 2

[Matt Brubeck (:mbrubeck)]

When I press the "View Full Site" link and try this from the non-mobile AMO site, the installation is successful.

When I switch back to the Mobile AMO site again, it fails again with the same error.

According to "View source," the link attributes are the same in both versions of the site.

Comment 3

[Matt Brubeck (:mbrubeck)]

It looks like InstallTrigger.install is not getting the correct download URL.  When I log its arguments:

javascript:void(window.InstallTrigger.install=function(){for (var i=0;i<arguments.length;i++) console.log(JSON.stringify(arguments[i]))})

The log output on MAMO is:

{"Show Tooltips":{"URL":"/en-US/mobile/addon/show-tooltips/","IconURL":"https://static.addons.mozilla.net/media//img/addon-icons/default-32.png","Hash":"sha256:d25433d9e5e2d69b816a5eea64b6292cb8d6ce4711564f65f085931a2fa4aac4"}}

On the non-mobile AMO, the output is:

{"Show Tooltips":{"URL":"https://addons.mozilla.org/mobile/downloads/file/113502/show_tooltips-2.0.2-fn.xpi?src=version-history","IconURL":"https://static.addons.mozilla.net/media//img/addon-icons/default-32.png","Hash":"sha256:d25433d9e5e2d69b816a5eea64b6292cb8d6ce4711564f65f085931a2fa4aac4"}}

Comment 4

[Matt Brubeck (:mbrubeck)]

This is happening only for unreviewed add-ons.  It looks like MAMO is ignoring the "data-realurl" attribute (present only for unreviewed add-ons) and always uses the href attribute instead.

Comment 5

[[:fabrice] Fabrice Desré]

(In reply to comment #4)
> This is happening only for unreviewed add-ons.  It looks like MAMO is ignoring
> the "data-realurl" attribute (present only for unreviewed add-ons) and always
> uses the href attribute instead.

I'm not sure about this. Personas has a review for instance.

Comment 6

[Potch [:potch]]

http://github.com/jbalogh/zamboni/commit/90b6269