794499 - [StubInstaller] Change Aurora download buttons to link to Stub Installer

Status: VERIFIED FIXED

(www.mozilla.org :: Bedrock, defect, P1)

Description

[Anthony Ricaud (:rik)]

Looks like we'll have to change download buttons from 
http://download.mozilla.org/?product=firefox-{version}&os={os}&lang={lang}
to
http://download.mozilla.org/?product=firefox-latest&os={os}&lang={lang}

We also need where to link to the full installer but we don't know the URL for this one. Robert, can you give us that information?

This will involve at least two paths of code, maybe 3.
1) On the bedrock side
2) The PHP en-US side
3) The PHP all-locales side.

Stephen, Raymond: Brace yourselves, huge testing of the download buttons is coming soon!

Comment 1

[Anthony Ricaud (:rik)]

Ok I misread some things.

Bringing some info from bug 794109 comment 14:
- Full installer is not moving but there's a new URL that replaces the version number with latest (tracked in bug 398366).
- This is Windows only and en-US only for now.

Robert: What is the URL for the stub installer then?

Comment 2

[Anthony Ricaud (:rik)]

Important to note: I will be out Thursday, Friday and most of Monday. As this is a critical part of our download story and we've had some bad bugs on those buttons recently, I'm asking that we don't launch this on Friday. We should give QA the time they need to test this.

Comment 3

[Robert Strong (they/them - no direct email)]

(In reply to Anthony Ricaud (:rik) from comment #1)
> Ok I misread some things.
> 
> Bringing some info from bug 794109 comment 14:
> - Full installer is not moving but there's a new URL that replaces the
> version number with latest (tracked in bug 398366).
Note that you can still use the version number.

> - This is Windows only and en-US only for now.
> 
> Robert: What is the URL for the stub installer then?
Not sure yet. I'll reply to Mike's email regarding this.

Comment 4

[Chris More [:cmore]]

Mike Alexis/Rik/Rstrong:

Can you please put whatever details we know for sure about URLs and/or logic for buttons into this bug? I want to make sure that critical information is not hidden away in email where not all parties are CC'd.

Thanks

Comment 5

[Robert Strong (they/them - no direct email)]

(In reply to Chris More [:cmore] from comment #4)
> Mike Alexis/Rik/Rstrong:
> 
> Can you please put whatever details we know for sure about URLs and/or logic
> for buttons into this bug? I want to make sure that critical information is
> not hidden away in email where not all parties are CC'd.
I don't have that info and was just getting people in touch with Paxton so it could be figured out.

Comment 6

[Jesse Ruderman]

To get the full security benefit, pages with download buttons also need to be SSL.  (Otherwise, a MITM attacker can give you a different download, with no UI difference in some browsers.)

I assume our front & download pages are the most popular pages on www.mozilla.org, so we might as well make it all SSL-only, and turn on HSTS to win back some performance.

Should that be a separate bug?

Comment 7

[Jake Maul [:jakem]]

Forcing all of www.mozilla.org to be SSL (might as well be all, since the homepage would need to change anyway and all is easier than some) should be a separate bug... I'll file one and link it here.

Comment 8

[Chris More [:cmore]]

This won't need needed for the release of stub installer since :jakem is going to do some apache magic and we won't have to point buttons to different URLs... for now.

Comment 9

[Anthony Ricaud (:rik)]

I have a Pull Request up for this https://github.com/mozilla/bedrock/pull/419

I'm now working on the PHP side to get the same setting.

Comment 10

[Anthony Ricaud (:rik)]

Attachment: Patch against the stage branch

This is a patch to enable this for the PHP side too.

Comment 11

[Anthony Ricaud (:rik)]

If those patches are r+ed, here is how to enable this in production:

- Bedrock: Change in settings/local.py : AURORA_STUB_INSTALLER = True. Reboot the Python app
- PHP: Add $config['aurora_stub_installer'] = true; on top of includes/config.inc.php

Currently, those links go to 17.0a2 which does not have a stub installer so we need to release Aurora 18 to make that work.

Comment 12

[Osmose [:osmose, :mkelly]]

Comment on attachment 670997 [details] [diff] [review]
Patch against the stage branch

Review of attachment 670997 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good!

Comment 13

[Anthony Ricaud (:rik)]

Pushed the PHP part to stage with r110030.

Comment 14

[[github robot]]

Commit pushed to master at https://github.com/mozilla/bedrock

https://github.com/mozilla/bedrock/commit/9d2928ae728081bcbd04b09a322dd027ef93876a
Allow linking to Aurora stub installer

- Add a global setting to toggle this
- Add a per-download button setting to force the full installer
- Only enabled for en-US

bug 794499

Comment 15

[Osmose [:osmose, :mkelly]]

The bedrock piece in https://github.com/mozilla/bedrock/pull/419 has been merged and pushed to stage.

To test, we'll first have to test stage to make sure none of the download buttons point to the stub installer, then we'll have IT flip the settings, and check again to see if they point to the stub installer after.

retornam: Can you test stage for the normal installer?

Comment 16

[raymond [:retornam] (inactive)]

Mkelly,
I checked https://wwww.allizom.org/en-US/firefox/channel
https:/www.mozilla.org/en-US/firefox/aurora and we do not have any stub installer buttons enabled

Comment 17

[Osmose [:osmose, :mkelly]]

jakem enabled the stub installer buttons on stage in bug 801881, it's ready for testing.

Comment 18

[Osmose [:osmose, :mkelly]]

We ran into some issues with HTTPS -> HTTP warnings in IE7 and IE6, but we don't believe they will be an issue on production and QA has given the goahead to push to prod.

Production has been pushed on Bedrock and the PHP side was merged in r110032. It should appear on production within 15 minutes.

I've updated but 801881 asking to enable the stub installer download on production. Will update this bug when it's ready for QA.

Comment 19

[Osmose [:osmose, :mkelly]]

Prod is updated with the stub installer and ready for QA.

Comment 20

[[github robot]]

Commit pushed to master at https://github.com/mozilla/bedrock

https://github.com/mozilla/bedrock/commit/11b85f7bfa6acb28b15d8072f426e83add2ed91c
Switch FTP links to https

bug 794499

Comment 21

[Anthony Ricaud (:rik)]

Pushed a fix for https with r110033.

Comment 22

[Anthony Ricaud (:rik)]

And pushed to production with r110034.

Please note that given the work that has been done in bug 725545, the code for download.old.js has not been backported to trunk.

Comment 23

[raymond [:retornam] (inactive)]

I'm able to download the Aurora stub on  https://www.mozilla.org/aurora and https://www.mozilla.org/firefox/channel/#aurora . The IE6 security dialog is still shown as mentioned in bug 801881