Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add public key to manifest to get consistent extension ID #170

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

lukaw3d
Copy link
Member

@lukaw3d lukaw3d commented Dec 6, 2021

No description provided.

pro-wh
pro-wh previously approved these changes Dec 6, 2021
Copy link
Contributor

@pro-wh pro-wh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh so that's how you do it

@@ -39,5 +39,6 @@
},
"web_accessible_resources": [
"oasis-xu-frame.html"
]
],
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAybK17ag+0PwHWbYEE36o+SmN35mcXj3RoM8ZBIlOjetdV3uqG8vdzv0YZ2Td21Y0il+1IKt/d9kslRT67C/S2fZ3XKAf96o+j+9/mgdOBwkL7m8XeALzBCYI3sSPnHf36iZu0w9FM9enUFHmq4HPNsT7BqTTEkdtDRRU4JHb+GGLjWvpyB1WIuv7UIJu64zUcZXsGVWZojRG2eISBJZxaItTuFS1210PebsS85++eeHLPWwMMp7d3UXOZpDYoyS07orZJd4c54hZaMNCKKZ5zbupwEuDvSANvEiuxpXe+hHLRnxOlpmhnj+XqkMBTgTFC57b75vhnvOCNbZ/ylW9xwIDAQAB"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This results in the same ID. If it was different for development, it won't be as easy to test with any dapps.

Are you worried about security?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, the security of experimental code having access to the same storage as the real one. actually is that the case? they'll be on the same origin, so I'd guess that they'll have access to the same storage. or does chrome enforce that you fully wipe one before you can install the other?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just tried:

  • if you install Chrome web store first, then you can load development version without removing, and storage is kept
  • if you go from development to Chrome web store, then that only shows "Remove" button

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aw darn that's like the opposite of what I wanted 😆

how about this:

  1. we enter a key to get a fixed dev ID here, separate from what the published extension uses
  2. we put this public key from the published extension in the documentation
  3. dapps should support other wallets anyway 🤞

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this worth generating different manifest.json with javascript based on env 😖

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

imo no. I'd rather edit a file than set an env var

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean env just as the difference between dev and build

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably not that either, if it were up to me. if someone needed to experiment with new changes and to interact with dapps, they'd perhaps use the real public key in a dev env. or if we need to share around a production build but not clobber the data from people's installation of the published version, we'd do it the other way around.

Copy link
Contributor

@pro-wh pro-wh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually what extension ID does this key result in? I feel like we should use a different ID for development

@pro-wh pro-wh dismissed their stale review December 6, 2021 20:30

need to ask follow up question

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants