Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signing API for unlisted add-on does not work if the add-on has a listed version #642

Closed
mi-g opened this issue Feb 12, 2018 · 4 comments
Closed

Comments

@mi-g
Copy link

mi-g commented Feb 12, 2018

With the beta channel being removed, the solution proposed by Mozilla is for the developers to host self-signed beta versions on their site. This means an add-on would be distributed on amo with version 1.0.0 and on the developer's site with version 2.0.0a1 with the same ID. Fair enough.

The problem is that it is not currently possible to automate the build of a beta version (signed as unlisted from amo and distributed on the dev site) as the add-on signing API fails if the add-on (with same ID) is listed on amo, which is obviously the case here.

It is still possible to sign the unlisted add-on manually: login into the amo site, specifying the version is to be hosted on own site, upload the add-on ZIP, click one more button to download the signed XPI (if you forget to do so and change page, you cannot retrieve the file and you cannot redo the process with the same version as this one is remembered by amo and considered consumed).

However, this manual action is tedious, error-prone, and fits in the middle of a complex build path (between building the beta ZIP and modifying the update manifest for the new XPI) that is generally automated.

This should be fixed to permit signing unlisted add-on versions with a tool like web-ext even if a listed public version is present on amo.

@diox
Copy link
Member

diox commented Feb 12, 2018

The problem is that it is not currently possible to automate the build of a beta version (signed as unlisted from amo and distributed on the dev site) as the add-on signing API fails if the add-on (with same ID) is listed on amo, which is obviously the case here.

It should be possible, by specifying the channel. Does it not work for you?

Without specifying the channel, the API has to guess and actually uses the channel from the last submitted version, which happens to be a listed one in your case. That behavior is intended for users who never mix listed and unlisted versions - you should always use an explicit channel if you can.

(I know web-ext does not support that - that's mozilla/web-ext#877)

@mi-g
Copy link
Author

mi-g commented Feb 12, 2018

I have made an unsuccessful attempt with this a few days ago, but maybe i missed something.

The documentation states:

PUT /api/v3/addons/[string:addon-id]/versions/[string:version]/

with Parameters addon-id, version and optionally channel, and Form parameters upload.

If i want to specify a channel, where would it go ? in the URL query like https://addons.mozilla.org/api/v3/addons/@my-addon/versions/1.0/?channel=unlisted, in the URL path https://addons.mozilla.org/api/v3/addons/@my-addon/versions/1.0/unlisted, as a form parameter (i tried that and it returned an error saying the addon already existed) ?

@mi-g
Copy link
Author

mi-g commented Feb 12, 2018

Passing the channel as a form parameter finally worked.
I submitted PRs for both sign-addon and web-ext so that the channel can be passed to web-ext sign as a command-line parameter.

@diox
Copy link
Member

diox commented Feb 12, 2018

Thank you for those PRs. Since the API does provide what's needed here I'm going to close this.

@diox diox closed this as completed Feb 12, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants