758733 - Integrate mozmarket.js receipt verification into deploy process

Status: RESOLVED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect)

Description

[Kumar McMillan [:kumar]]

Integrate the git submodule for receipt verification into the marketplace so the latest version always gets served as mozmarket.js

https://github.com/ianb/openwebapps-helpers/

Comment 1

[Ian Bicking (:ianbicking)]

Moved to: https://github.com/mozilla/receiptverifier

Comment 2

[Jason Smith [:jsmith]]

Nominating for k9o per the same rationale for bug 755006

Comment 3

[Ian Bicking (:ianbicking)]

Even right now application developers could use the library to check receipts, and I would welcome the feedback.  They would simply have to host the library themselves.  Deploying the library to a public includable location does not itself compel application developers to use the library, it just makes it easier for them to do the right thing.  Bug 755309 is also related, as it gives reviewers the tools to see when an application is not hitting the receipt verifier.

Comment 4

[Jason Smith [:jsmith]]

(In reply to Ian Bicking (:ianb) from comment #3)
> Even right now application developers could use the library to check
> receipts, and I would welcome the feedback.  They would simply have to host
> the library themselves.  Deploying the library to a public includable
> location does not itself compel application developers to use the library,
> it just makes it easier for them to do the right thing.  Bug 755309 is also
> related, as it gives reviewers the tools to see when an application is not
> hitting the receipt verifier.

We should evangelize this library out to the existing paid applications to get feedback (there's currently only 11 paid apps listed, so doing all of them wouldn't be too bad).

Comment 5

[Kumar McMillan [:kumar]]

Hey all, the receipt verifier has landed in mozmarket.js: https://github.com/mozilla/zamboni/commit/52a99af

Here are some things to note:
- You can find it right now at https://marketplace-dev-cdn.allizom.org/mozmarket.js (when we deploy live on Thursday it will be at https://marketplace-cdn.addons.mozilla.net/mozmarket.js ). Our CDN domain will change soon, FYI.
- We still need to add MDN docs (I'll file for that)
- There was a JS scoping issue when I tested it out (https://github.com/mozilla/receiptverifier/issues/7) but I pulled in a fix for that just now. Because of the CDN, it might take an hour to show up
- How does upgrading work? Right now someone needs to update the zamboni submodule. It's not automated. Maybe we will automate it one day.

Comment 6

[Kumar McMillan [:kumar]]

MDN docs will happen in bug 766711