3 ms·
Mozilla does (a). I just published my first Firefox extension and they require a zip of un-obfuscated source code if you minify or bundle in any way.
by apozem 3y ago
Mozilla does (a). I just published my first Firefox extension and they require a zip of un-obfuscated source code if you minify or bundle in any way.
- eviks 3y agohow do they verify it's the same as the bundled version? does it affect updates as well?
- gorhill 3y agoThey require to provide all the details of how the code was minified/bundled so that they probably try to reproduce the resulting code on their side, and if there is a mismatch you will not pass review.
- StayTrue 3y agoHow does this work? Do they publish your minified/bundled code and trust it’s a direct derivation of the un-obfuscated zip provided for review?
- palant 3y agoNote: I am the author of this article. Yes, Mozilla doesn’t publish the source code. Back when I was reviewing add-ons there (a long time ago), I did compile the supplied source and compared it with the submitted one. It was sometimes awkward when the tool in question didn’t produce reproducible builds but mostly ok.
- teddyh 3y agoDiffoscope should help with that nowadays.
- 3np 3y agoAnother Mozilla requirement is reproducible builds. This enables the to verify that a build from the supplied sources matches the release bit-by-bit.
- pabs3 3y agoHopefully they try to automatically reproduce the build and reject when it fails: https://reproducible-builds.org/ https://reproducible-builds.org/