Kris Maglione [:kmag] Reporter
	Description • 9 years ago

+++ This bug was initially created as a clone of Bug #1197876 +++

Bug 1197876 changes Firefox to require signatures on language packs. On the AMO side, we need to sign any new Firefox language packs to support this. Existing language packs won't need to be signed, since they're tied to a Firefox major version, and none of the existing ones are for versions which will require this.

An important point is that most language packs are uploaded via the admin language pack updater, and auto-approved without going through the normal validation/approval flow, so without specific changes, they won't currently trigger the signing flow.

	Mathieu Agopian [:magopian]
	Comment 1 • 9 years ago

Kris, can you tell me more about the admin language pack updater? Where is it (url or code)? Do we need to automatically sign those?

Regarding the lang packs that aren't uploaded via this admin language pack updater, how are they uploaded? As simple add-ons (and then they go through a manual review)?

	Kris Maglione [:kmag] Reporter
	Comment 2 • 9 years ago

(In reply to Mathieu Agopian [:magopian] from comment #1)
> Kris, can you tell me more about the admin language pack updater? Where is
> it (url or code)? Do we need to automatically sign those?

They're updated here:

https://github.com/mozilla/olympia/blob/master/apps/zadmin/tasks.py#L496

We do need to sign them, yes.

> Regarding the lang packs that aren't uploaded via this admin language pack
> updater, how are they uploaded? As simple add-ons (and then they go through
> a manual review)?

They're just uploaded via the normal add-on upload/review process. They're extremely rare these days, though.

	Mathieu Agopian [:magopian]
	Comment 3 • 9 years ago

PR: https://github.com/mozilla/olympia/pull/756

This PR doesn't change anything regarding the language packs that are submitted manually, as they're already being signed.

	[github robot]
	Comment 4 • 9 years ago

Commits pushed to master at https://github.com/mozilla/olympia

https://github.com/mozilla/olympia/commit/3303c73030b5e15a6753d28553c0d33330bb6c3d
Sign auto updated language packs (bug 1198425)

https://github.com/mozilla/olympia/commit/8d9f9c4431a0b2bc9790c625e6885e018411b319
Merge pull request #756 from magopian/1198425-sign-auto-updated-language-packs

Sign auto updated language packs (bug 1198425)

	Mathieu Agopian [:magopian]
	Comment 5 • 9 years ago

This needs to be tested on -dev and/or stage by using the admin auto updated. I'm not quite sure how this will play out though, because they'll need the locale packs to be present on the FTP folder.

:kmag do you have an idea how we could test that? Maybe by temporarily changing the LANGPACK_DOWNLOAD_BASE settings to something else?

	Andy McKay
	Comment 6 • 9 years ago

Marking as resolved fixed so we can get qa on the case.

	Kris Maglione [:kmag] Reporter
	Comment 7 • 9 years ago

I'm not sure what the problem is. Dev and stage shouldn't have language packs for the last few releases yet, so we should be easy enough to test.

	Mathieu Agopian [:magopian]
	Comment 8 • 9 years ago

Ah, that's right! Thanks for the heads up Kris.

Krupa, please let me know if you need help with testing/validating that. As a reminder, here's the URL for the langpack updater: https://addons-dev.allizom.org/en-us/admin/langpacks

	marius.santa
	Comment 9 • 7 years ago

I've tested that all the lang pacs from https://archive.mozilla.org/pub/firefox/candidates/60.0b13-candidates/build1/win64/xpi/ are signed and can be installed, is that enough to validate this bug? since they are all signed with the same automated process.

	Mathieu Agopian [:magopian]
	Comment 10 • 7 years ago

I don't work on AMO anymore, maybe someone from the current team can answer that question? Maybe ddurst can point you to the right person?

	marius.santa
	Comment 11 • 7 years ago

Can you please clarify if https://bugzilla.mozilla.org/show_bug.cgi?id=1198425#c9 is enough or if different/more testing is required to validate this?

	Kris Maglione [:kmag] Reporter
	Comment 12 • 7 years ago

I think that should be enough. Thanks!