3 ms·
How does this work? Do they publish your minified/bundled code and trust it’s a direct derivation of the un-obfuscated zip provided for review?
by StayTrue 3y ago
How does this work? Do they publish your minified/bundled code and trust it’s a direct derivation of the un-obfuscated zip provided for review?
- palant 3y agoNote: I am the author of this article. Yes, Mozilla doesn’t publish the source code. Back when I was reviewing add-ons there (a long time ago), I did compile the supplied source and compared it with the submitted one. It was sometimes awkward when the tool in question didn’t produce reproducible builds but mostly ok.
- teddyh 3y agoDiffoscope should help with that nowadays.
- 3np 3y agoAnother Mozilla requirement is reproducible builds. This enables the to verify that a build from the supplied sources matches the release bit-by-bit.
- pabs3 3y agoHopefully they try to automatically reproduce the build and reject when it fails: https://reproducible-builds.org/ https://reproducible-builds.org/