Updates from userscripts.org do not apply with require secure updates on #1555

Closed
arantius opened this Issue May 20, 2012 · 8 comments

Comments

Projects
None yet
2 participants
@arantius
Collaborator

arantius commented May 20, 2012

https://groups.google.com/forum/#!msg/greasemonkey-users/_8NsgV8gZeI/6k6Ry_AdvvUJ

New profile; install GM; install script; edit script on us.o; clear FF cache; restart FF.
Find Updates = nothing happens.
Turn off GM Secure Updates; Find Updates = update downloads and installs fine.

@ghost

This comment has been minimized.

Show comment
Hide comment
@ghost

ghost Jul 24, 2012

This issue is caused by the resolution to this issue: arantius/greasemonkey@7cefe18

This requires that the updateURL uses https when the CDN doesn't support it. The workaround I needed for my script was to use the bit.ly service. My scripts @updateurl points to https://bit.ly/PPzl0Y so it satisfies your check but is in no way more secure than just putting in the direct link to the CDN.

ghost commented Jul 24, 2012

This issue is caused by the resolution to this issue: arantius/greasemonkey@7cefe18

This requires that the updateURL uses https when the CDN doesn't support it. The workaround I needed for my script was to use the bit.ly service. My scripts @updateurl points to https://bit.ly/PPzl0Y so it satisfies your check but is in no way more secure than just putting in the direct link to the CDN.

@arantius

This comment has been minimized.

Show comment
Hide comment
@arantius

arantius Jul 24, 2012

Collaborator

Thanks for the diagnosis!

Collaborator

arantius commented Jul 24, 2012

Thanks for the diagnosis!

@arantius

This comment has been minimized.

Show comment
Hide comment
@arantius

arantius Aug 1, 2012

Collaborator

You'll notice that while 7cefe18 (Feb 16) does exist as you pointed out, f796428 (Feb 17) reverted it and then 94c976c was added.

Collaborator

arantius commented Aug 1, 2012

You'll notice that while 7cefe18 (Feb 16) does exist as you pointed out, f796428 (Feb 17) reverted it and then 94c976c was added.

@arantius

This comment has been minimized.

Show comment
Hide comment
@arantius

arantius Aug 1, 2012

Collaborator

To test for sure, I just:

  1. Blanked out a completely fresh Firefox profile.
  2. Installed Greasemonkey 0.9.20
  3. Created https://gist.github.com/3227121 with @version 1 and installed it by visiting https://gist.github.com/raw/3227121/update-test.user.js .
  4. Each page load now sends Update test version 1! to the console.
  5. Edited the gist to be @version 2 and dump a 2 in its message.
  6. Opened the Add-ons Manager and saw "Update Test 1" listed. Clicked the tools drop-down button at the top and did check for updates. In just a moment, the AOM now said "Update Test 2" was installed, and the next page load sent Update test version 2! to the console.

One critical difference is, of course, by using Gist as the host, I didn't hit the us.o/coral cache logic. I'll test that soon. (Right now, us.o is not loading for me.)

Collaborator

arantius commented Aug 1, 2012

To test for sure, I just:

  1. Blanked out a completely fresh Firefox profile.
  2. Installed Greasemonkey 0.9.20
  3. Created https://gist.github.com/3227121 with @version 1 and installed it by visiting https://gist.github.com/raw/3227121/update-test.user.js .
  4. Each page load now sends Update test version 1! to the console.
  5. Edited the gist to be @version 2 and dump a 2 in its message.
  6. Opened the Add-ons Manager and saw "Update Test 1" listed. Clicked the tools drop-down button at the top and did check for updates. In just a moment, the AOM now said "Update Test 2" was installed, and the next page load sent Update test version 2! to the console.

One critical difference is, of course, by using Gist as the host, I didn't hit the us.o/coral cache logic. I'll test that soon. (Right now, us.o is not loading for me.)

@arantius

This comment has been minimized.

Show comment
Hide comment
@arantius

arantius Aug 1, 2012

Collaborator

I've now repeated with:

  1. Blanked out a completely fresh Firefox profile.
  2. Installed Greasemonkey 0.9.20
  3. Created http://userscripts.org/scripts/show/139833 with @version 1 and installed it by visiting https://userscripts.org/scripts/source/139833.user.js (Note the scheme! This is not yet the default!).
  4. Each page load now sends Update test version 1! to the console.
  5. Edited the script to be @version 2 and dump a 2 in its message.
  6. Opened the Add-ons Manager and saw "Update Test 1" listed. Clicked the tools drop-down button at the top and did check for updates.

Got "no updates found". Problem reproduced.

Collaborator

arantius commented Aug 1, 2012

I've now repeated with:

  1. Blanked out a completely fresh Firefox profile.
  2. Installed Greasemonkey 0.9.20
  3. Created http://userscripts.org/scripts/show/139833 with @version 1 and installed it by visiting https://userscripts.org/scripts/source/139833.user.js (Note the scheme! This is not yet the default!).
  4. Each page load now sends Update test version 1! to the console.
  5. Edited the script to be @version 2 and dump a 2 in its message.
  6. Opened the Add-ons Manager and saw "Update Test 1" listed. Clicked the tools drop-down button at the top and did check for updates.

Got "no updates found". Problem reproduced.

@arantius

This comment has been minimized.

Show comment
Hide comment
@arantius

arantius Aug 1, 2012

Collaborator

When I restarted to diagnose, the next manual check told me it was fetching http://userscripts.org.nyud.net/scripts/source/139833.meta.js (correct) and offered the update. The display never showed the download finish, but when I switched to the user scripts tab, version 2 was installed and working.

Collaborator

arantius commented Aug 1, 2012

When I restarted to diagnose, the next manual check told me it was fetching http://userscripts.org.nyud.net/scripts/source/139833.meta.js (correct) and offered the update. The display never showed the download finish, but when I switched to the user scripts tab, version 2 was installed and working.

@arantius arantius closed this in be7f924 Aug 17, 2012

@nascentt

This comment has been minimized.

Show comment
Hide comment
@nascentt

nascentt Sep 5, 2012

Hi, I have a couple of quick questions. I'm a bit confused by this. Does this mean by default updates wont work unless a secure update option is ticked? So for most users the scripts wont update themselves or will?

The other question is in relation to the earlier proposed way to request greasemonkey addon metadata so that scripts could work out the version installed, and if less than 1.0 to do our own manual update checks. Is this possible in any way, or was the idea scrapped?

Edit: My apologies for putting this in the wrong place, thanks for the answer.

nascentt commented Sep 5, 2012

Hi, I have a couple of quick questions. I'm a bit confused by this. Does this mean by default updates wont work unless a secure update option is ticked? So for most users the scripts wont update themselves or will?

The other question is in relation to the earlier proposed way to request greasemonkey addon metadata so that scripts could work out the version installed, and if less than 1.0 to do our own manual update checks. Is this possible in any way, or was the idea scrapped?

Edit: My apologies for putting this in the wrong place, thanks for the answer.

@arantius

This comment has been minimized.

Show comment
Hide comment
@arantius

arantius Sep 5, 2012

Collaborator

Questions really belong on the mailing list ( https://groups.google.com/forum/#!msg/greasemonkey-users/ ). But this means that update will work where they did not before. And GM_info ( http://wiki.greasespot.net/GM_info ) has exposed GM version since before GM did updates.

Collaborator

arantius commented Sep 5, 2012

Questions really belong on the mailing list ( https://groups.google.com/forum/#!msg/greasemonkey-users/ ). But this means that update will work where they did not before. And GM_info ( http://wiki.greasespot.net/GM_info ) has exposed GM version since before GM did updates.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment