This is a straw-man client implementation plan that covers the main Client Requirements. The rough set of bugs needed to implement this are called out.
Running system add-ons
System add-ons will be installed in the user's profile. This assures that client code can install and update add-ons without needing special privileges and that there can only be one client application accessing the add-ons at a time.
They will be installed in a directory used as a regular add-on install location with a lower priority than the profile install location. This allows developers to test out new versions of system add-ons by installing them using the regular add-ons manager.
The specific path to the install location will be <profile>/features/<app path hash>. "app path hash" is a simple hash of the client's install directory. This means that if a user is using two different versions of the client application (say a developer version and a release version) with the same profile they will use two different directories for the system add-ons allowing them to be updated independently. When a single build updates to a new version it automatically retains the most recently downloaded system add-ons from the previous version. The majority of users use a single build and so will have just one directory in use.
The hash can be short to avoid causing path length problems and quick to generate. Collisions aren't a big problem, the client will recover gracefully automatically.
- Bug: Create a features install location with a lower priority to the profile location
- Bug: Hide system add-ons in the features location from the add-ons manager UI
If a user uninstalls an old build they will be left with a now useless set of system add-ons. Periodically we should check <profile>/features for unused directories. We can write the current time to the current location and for any locations that are older than a certain date delete them.
- Bug: Shortly after startup write the current time to the system add-on install location and purge older locations
Discovering system add-ons
Already installed system add-ons will use the regular add-on update check mechanism to download and install updates. The existing add-ons manager code should do this automatically.
- Bug: Test that automated updates for the system add-ons location function correctly
During runtime the client will periodically check for system add-ons to use with the current application version. It will do so by making a HTTPS request to a specific URL which will return a root manifest listing the system add-ons for that application, the versions they are compatible with and the URL of a normal update manifest for each add-on.
- Bug: Periodically download the system add-ons root manifest
For the returned system add-ons that aren't already installed and that are compatible with the current version of the application the update manifest will be used to find and install the most recent version of that add-on, this re-uses the normal add-on update check code.
- Bug: Download and install new system add-ons into the system add-ons install location
Any currently installed system add-ons that aren't listed as compatible with the current version of the application will be uninstalled.
- Bug: Uninstall system add-ons not listed as compatible with the current application version
The specific format of the manifest is open for debate but if we want to allow for the same manifest file for multiple client applications and assume that most system add-ons will only be compatible with a single application then something like this would make sense:
{
"<app-ID>": {
"<addon-ID>": {
"minVersion": "42.0",
"maxVersion": "45.*",
"updateManifest": "https://mozilla.com/foo/bar/update.rdf"
}
}
}
Here a specific maxVersion is present but we could equally use a maxVersion of "*" (or say that a missing maxVersion property defaults to "*") to say that a system add-on is compatible with all future versions and then change that at a later date.
The actual host of the update manifest and the XPIs that it points to doesn't matter to the client code. It could be AMO or something new.
There is some duplication of information here. The min/maxVersions are also present in the update manifest but including them in this root manifest allows us to decide what new add-ons need to be installed and which need to be removed without making any secondary requests.
Securing system add-ons
System add-ons will need to be signed in a way that differentiates them from regular add-ons. This means either using a custom signing certificate or using the AMO signing service. AMO currently has two signing servers set up two sign preliminarily reviewed add-ons and fully reviewed add-ons. Clients can distinguish between the two based on a special string added to the Organizational Unit (OU) of the signing certificate for each add-on. Adding a third signing server that adds a new string to the OU is straightforward but AMO would need some updates to know to pass certain add-ons to that server.
- Bug: Add-ons manager signature checks should enforce special rules for add-ons installed in the system add-ons location
The root manifest and update manifests should be protected by https at a minimum (no certificate overrides allowed). As they can only point to signed XPIs there may be no need to do any additional security here but we should consult with the security team.
Bootstrapping
In order to give a good experience to users using a new profile or updating after not having used the client in a while the application should ship with all system add-ons currently available for that build. This means including the add-ons in installers, packages, dmgs and the update mars for the application.
- Bug: Include system add-ons in application packages and updates
On the startup of a new version of an application the client will find the add-ons included with the application and compare them to those in the system add-ons install location. If the add-on doesn't exist in the install location or the version there is older than the shipped version then the shipped version will be copied to the install location.
- Bug: On startup with a new application version install any new or updated system add-ons into the system add-on install location"