817624 - Update blocklisting with unique app/version IDs

Status: RESOLVED FIXED

(Marketplace Graveyard :: Consumer Pages, defect, P2)

Description

[Rob Hudson [:robhudson]]

Once bugs 814131 and 814136 land blocklisting needs to be updated...

Since we need a unique version ID we need to actually create a version/file in the database for these now. The file status can be STATUS_BLOCKED (15). Also make sure versions/files with this status cannot be deleted by the developer.

We need to copy the blocklisted app file (the generic one under /media) to the app/ver file path.

And add the app/ver to the META-INF/ folder.

I believe we can avoid signing the blocklisted app since it does not request access to privileged APIs.

Comment 1

[Wil Clouser [:clouserw]]

(In reply to Rob Hudson [:robhudson] from comment #0)
> I believe we can avoid signing the blocklisted app since it does not request
> access to privileged APIs.

Does that make it inconsistent with all our other packages?  Your logic makes sense, but I like consistency a lot. :)

Comment 2

[Rob Hudson [:robhudson]]

(In reply to Wil Clouser [:clouserw] from comment #1)
> (In reply to Rob Hudson [:robhudson] from comment #0)
> > I believe we can avoid signing the blocklisted app since it does not request
> > access to privileged APIs.
> 
> Does that make it inconsistent with all our other packages?  Your logic
> makes sense, but I like consistency a lot. :)

It does make it inconsistent. I figured out we can't do this anyway since the META-INF/ ids.json is also part of the signing/verification that takes place. So we'll sign the blocklisted app as well, which makes it consistent.

Comment 3

[Rob Hudson [:robhudson]]

Don't think I'll wrap this up today so bumping to next week.

Comment 4

[Rob Hudson [:robhudson]]

Mostly done and reviewed but needs some updates. Bumping to next week.

https://github.com/robhudson/zamboni/compare/817624-blocklisting

Comment 5

[Rob Hudson [:robhudson]]

Final commit:
https://github.com/mozilla/zamboni/commit/b1185d8