Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add public key to manifest to get consistent extension ID #170

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add public key to manifest to get consistent extension ID #170

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7de70ce
Add public key to manifest to get consistent extension ID
lukaw3d Dec 6, 2021
ba1f33f
Link to extension
lukaw3d Dec 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,10 @@
[github-ci-lint-badge]: https://github.com/oasisprotocol/oasis-wallet-ext/workflows/ci-lint/badge.svg
[github-ci-lint-link]: https://github.com/oasisprotocol/oasis-wallet-ext/actions?query=workflow:ci-lint+branch:master

The official non-custodial browser extension wallet for the [Oasis Network].
The official non-custodial [browser extension] wallet for the [Oasis Network].

[Oasis Network]: https://docs.oasis.dev/general/oasis-network/overview
[browser extension]: https://chrome.google.com/webstore/detail/oasis-wallet/ppdadbejkmjnefldpcdjhnkpbjkikoip

## Introduction

Expand Down
3 changes: 2 additions & 1 deletion public/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,6 @@
},
"web_accessible_resources": [
"oasis-xu-frame.html"
]
],
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAybK17ag+0PwHWbYEE36o+SmN35mcXj3RoM8ZBIlOjetdV3uqG8vdzv0YZ2Td21Y0il+1IKt/d9kslRT67C/S2fZ3XKAf96o+j+9/mgdOBwkL7m8XeALzBCYI3sSPnHf36iZu0w9FM9enUFHmq4HPNsT7BqTTEkdtDRRU4JHb+GGLjWvpyB1WIuv7UIJu64zUcZXsGVWZojRG2eISBJZxaItTuFS1210PebsS85++eeHLPWwMMp7d3UXOZpDYoyS07orZJd4c54hZaMNCKKZ5zbupwEuDvSANvEiuxpXe+hHLRnxOlpmhnj+XqkMBTgTFC57b75vhnvOCNbZ/ylW9xwIDAQAB"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh cool

https://developer.chrome.com/docs/extensions/mv3/manifest/key/

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This results in the same ID. If it was different for development, it won't be as easy to test with any dapps.

Are you worried about security?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, the security of experimental code having access to the same storage as the real one. actually is that the case? they'll be on the same origin, so I'd guess that they'll have access to the same storage. or does chrome enforce that you fully wipe one before you can install the other?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just tried:

  • if you install Chrome web store first, then you can load development version without removing, and storage is kept
  • if you go from development to Chrome web store, then that only shows "Remove" button

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aw darn that's like the opposite of what I wanted 😆

how about this:

  1. we enter a key to get a fixed dev ID here, separate from what the published extension uses
  2. we put this public key from the published extension in the documentation
  3. dapps should support other wallets anyway 🤞

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this worth generating different manifest.json with javascript based on env 😖

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

imo no. I'd rather edit a file than set an env var

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean env just as the difference between dev and build

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably not that either, if it were up to me. if someone needed to experiment with new changes and to interact with dapps, they'd perhaps use the real public key in a dev env. or if we need to share around a production build but not clobber the data from people's installation of the published version, we'd do it the other way around.

}