Updating self-service extensions via HTTP

Question

I am transforming my SDK-based Firefox extension into WebExtensions, and I came up with a question about updating the extension. The current extension is hosted on my own domain (which is the HTTP domain) along with the update.rdf file.

Now for SDK-based add-ons, updates were available via HTTP until the update manifest was signed with McCoy and a valid hash of the update file was provided in the manifest. In addition to this, install.rdf will contain part of the public key of the key used to sign update.rdf.

There seems to be no option for this using web extensions (without writing a manifest for the public key and writing an update manifest (.json) for the signature).

Does this mean that Firefox will only allow self-service extensions to be updated via HTTPS? How will this affect the SDK extensions that are currently hosted on HTTP domains? Will they be able to get (at least one) update?

Answer 1

As you must have determined, the update.rdf add-ins for WebExtensions should be served via HTTPS, not HTTP. The URL of the update.rdf file must be https. The documentation for the update_url property is not explicitly specified in the manifest.json applications file :

• update_url is a link to the manifest for updating add-ons . Please note that the link must begin with "https". This key is intended for managing updates updates independently (i.e. Not through AMO).

You cannot use the alternative security method available for other types of add-ons to provide updateKey (and signing update.rdf) in the install.rdf file that came with the extension.

Additional SDK-based extensions and other types of add-ons not related to WebExtensions will still be able to receive their update.rdf via HTTP in the same way they did.

If your problem translates an add-in from an add-on based on the SDK as an add-on based on WebExtensions, you will need to have an update for this extension that changes the URL from which the updates are being serviced. It can be in any version before switching to WebExtensions or at the same time. In any case, this is just a new version of the add-in (specified using update.rdf, transmitted via HTTP and signed accordingly). This new version will have update_url (WebExtensions) or updateURL (all other types), where the URL uses the HTTPS scheme. Then, all subsequent update.rdf files will be served via HTTPS.