681379 - Don't watermark signed addons

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Andy McKay]

I would be surprised if an add-on could get through validation and review without the install.rdf file being able to watermarked successfully. But let's think of one: unicode, because that always fun.

It would really suck for an end user if they paid for an app, then we generate the watermark only to find we can't because of some unforeseen problem.

Before an app goes on sale we need to do a dry run of the watermark and make sure it can be applied successfully otherwise it can't be done.

Perhaps this should be part of the validation process?

Comment 1

[Wil Clouser [:clouserw]]

How about we make the code so we can always apply a watermark no matter what? :)

Getting an error back about "unable to apply watermark" sounds like our problem, not the developers.

Comment 2

[Andy McKay]

+1 on that. What if the install.rdf is completely corrupt though? We assuming it won't get past validation / upload?

Comment 3

[Wil Clouser [:clouserw]]

validation is pretty strict, I'd say so.  If not, that's a bug in the validator.

Comment 4

[Justin Scott [:fligtar]]

The main concern with watermarking will be signed add-ons. We can't tamper with signed add-ons and will either need to disallow them from being sold or exclude install.rdf from the signing.

Mossop, do you have any thoughts on what we can do here?

Comment 5

[Dave Townsend [:mossop]]

(In reply to Justin Scott [:fligtar] from comment #4)
> The main concern with watermarking will be signed add-ons. We can't tamper
> with signed add-ons and will either need to disallow them from being sold or
> exclude install.rdf from the signing.
> 
> Mossop, do you have any thoughts on what we can do here?

This is a good point, I think right now the only choice is to disallow signed add-ons, we have code that verifies that in a signed add-on every single file is signed I think.

Comment 6

[Justin Scott [:fligtar]]

Can you tell us the easiest way to identify an .xpi package as signed?

Comment 7

[Dave Townsend [:mossop]]

(In reply to Justin Scott [:fligtar] from comment #6)
> Can you tell us the easiest way to identify an .xpi package as signed?

Signed XPIs have two files in the META-INF directory <name>.sf and <name>.rsa. The name can be anything as long as it is the same for the sf and rsa files but is commonly "zigbert".

Comment 8

[Justin Scott [:fligtar]]

Thanks. Some example signed add-ons (from memory), for testing purposes, are Adblock Plus, Offer Assistant, WOT, NoScript.

Comment 9

[Andy McKay]

Can now detect signed add-ons: http://github.com/jbalogh/zamboni/commit/44182d

We should put this in the marketplace signup and file upload for signed addons (will file bugs for this).