811337 - Add a hash to the mini manifest

Status: RESOLVED FIXED

(Marketplace Graveyard :: API, defect, P2)

Description

[Wil Clouser [:clouserw]]

Our apps have mini-manifests, for example: https://marketplace-dev.allizom.org/app/hawshansperif-bogiki-pencou/manifest.webapp

Please add a "hash" field (sha256 is fine) to the manifest which contains a hash of the package.  You can add a comment that says sha256 was arbitrary and it is currently an unused field.  If someone eventually needs a different hash we can change it, just some hash is needed.

We're adding this so the etag changes with each package update.  It's possible a package could be uploaded with the same file size right now and an update wouldn't be detected by the platform.

Comment 1

[Rob Hudson [:robhudson]]

It's true we currently md5 the mini manifest contents to generate the etag. But we could md5 the contents + package hash without the need to add an unused field to the manifest if we'd rather...
https://github.com/mozilla/zamboni/blob/master/mkt/detail/views.py#L86

Comment 2

[Wil Clouser [:clouserw]]

(In reply to Rob Hudson [:robhudson] from comment #1)
> It's true we currently md5 the mini manifest contents to generate the etag.
> But we could md5 the contents + package hash without the need to add an
> unused field to the manifest if we'd rather...
> https://github.com/mozilla/zamboni/blob/master/mkt/detail/views.py#L86

That works too.  There is discussion about removing any extra fields from the manifest already, so sure, let's keep it all in the etag for now.  Thanks.

Comment 3

[Matt Basta [:basta]]

Done

https://github.com/mozilla/zamboni/commit/0b5fc4d454f3dfe875f8ee00e3ca44a2e35151a7