[Project_owners] Online version of McCoy

[Douglas E. Warner]

On Tuesday 05 February 2008, Eric H. Jung wrote:
> I don't know, but the point is mozdev should have an upload tool which
> preps XPIs for auto-updating when update.rdf isn't hosted at AMO (it's
> probably hosted at mozdev, but not necessarily). I believe updateHash is
> the only install.rdf entry required for this. updateKey, updateLink are not
> required. Anyone confirm?

I believe the relevant parts from the doc [1] is:

* The updateURL uses https, or there is no updateURL at all (which defaults to 
  addons.mozilla.org which is https) 
* The updateURL uses http and the updateKey entry is specified which will be 
  used to verify the data in the update manifest.

One of these must be satisfied in order for the update to be deemed "secure".

-Doug

[1] 
http://developer.mozilla.org/en/docs/Extension_Versioning,_Update_and_Compatibility#Update_Hashes

-- 
Douglas E. Warner    <silfreed at silfreed.net>    Site Developer
Mozdev.org           http://www.mozdev.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
Url : http://www.mozdev.org/pipermail/project_owners/attachments/20080205/6c1dfcae/attachment.bin