通过HTTP更新自托管扩展 [英] Updating self-hosted extensions through HTTP

问题描述

我正在将基于SDK的Firefox扩展转换为WebExtensions，现在遇到了更新扩展的问题.当前扩展名和 update.rdf 文件一起托管在我自己的域(这是HTTP域)中.

I'm transforming my SDK-based Firefox extension to WebExtensions and I've come to the issue of updating the extension. The current extension is hosted on my own domain (which is an HTTP domain), along with the update.rdf file.

现在，对于基于SDK的附加组件，只要使用

Now, for SDK-based add-ons, updates were possible via HTTP as long as the update manifest was signed using the McCoy tool and the valid hash of the update file was provided in the manifest. In addition to that, install.rdf would hold the public key portion of the key used to sign the update.rdf.

似乎没有使用Web扩展名执行此操作的选项(没有用于公钥的清单条目，也没有用于签名的更新清单( .json )条目).

There seem to be no options to do this using the web extensions ( no manifest entry for public key, and no update manifest (.json) entry for the signature).

这是否意味着Firefox仅允许自托管扩展通过HTTPS更新?这将如何影响当前托管在HTTP域上的基于SDK的扩展?他们将能够接收(至少一个)更新吗?

Does this mean Firefox will only allow self-hosted extensions to update via HTTPS? How will this affect SDK-based extensions currently hosted on HTTP domains? Will they be able to receive (at least one) update?

推荐答案

您似乎已经确定，基于WebExtensions的加载项的 update.rdf 必须通过HTTPS而不是HTTP提供. update.rdf文件的URL必须为HTTPS. 中update_url属性的文档> manifest.json applications键在这一点上是明确的:

As you appear to have determined, the update.rdf for WebExtensions based add-ons must be served over HTTPS, not HTTP. The URL for the update.rdf file must be HTTPS. The documentation for the update_url property in the manifest.json applications key is explicit on this point:

• update_url是指向附加更新清单的链接.请注意，链接必须以"https"开头.该密钥用于自己管理扩展程序更新(即，不通过AMO).

• update_url is a link to an add-on update manifest. Note that the link must begin with "https". This key is for managing extension updates yourself (i.e. not through AMO).

无法使用其他类型的加载项可用的替代安全方法来提供

There is no way to use the alternate security method, which is available to other types of add-ons, of providing an updateKey (and signing the update.rdf) in an install.rdf file included with the extension.

基于附加SDK的扩展以及其他类型的非WebExtension附加组件将继续能够以与以前相同的方式通过HTTP接收其 update.rdf .

Add-on SDK based extensions, and other types of non-WebExtensions add-ons, will continue to be able to receive their update.rdf over HTTP in the same manner which they have been doing.

如果您的问题是将加载项从基于加载项SDK的加载项转换为基于WebExtensions的加载项，那么您将需要对该扩展程序进行更新，以更改更新的URL被送达.可以是转换到WebExtensions之前的某个版本，也可以同时.无论哪种方式，它都只是插件的新版本(通过HTTP提供并经过适当签名的 update.rdf 表示).然后，该新版本将具有 update_url (WebExtensions)或 updateURL (所有其他类型)，其中URL使用HTTPS方案.然后，所有后续的 update.rdf 文件将通过HTTPS提供服务.

If your issue is transitioning an add-on from being an Add-on SDK based add-on to being a WebExtensions based add-on, then you will need to have an update to that extension which changes the URL from which updates are served. This can either be in some version before transitioning to WebExtensions, or at the same time. Either way, it is just a new version of the add-on (indicated with the update.rdf served via HTTP and appropriately signed). That new version will then have an update_url (WebExtensions) or updateURL (all other types) where the URL is using the HTTPS scheme. All subsequent update.rdf files will then be served over HTTPS.

这篇关于通过HTTP更新自托管扩展的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！