mozilla / mozillavpn-product-details

Hosting product details json files for mozilla vpn repo

https://mozilla.github.io/mozillavpn-product-details

Hosts a product-details style json files for the vpn.

Automatically deploys to gh pages.

• schema.jtd.json contains the schema that all files must validate.

The product details files are currently (Oct-28-21) used to:

• Build links to http://archive.mozilla.org/pub/vpn/ to packages for download on vpn.mozilla.org

The constraints in the schema capture constraints we've coded elsewhere e.g. in code, or in the archives link structure.

Enforced restrictions

• No pushing to main
• Codeowners must approve production file changes
• Commits must be signed
• No exceptions

Changing schemas

This file is currently consumed by Guardian as a means of providing download URLs. If the schema requires changes, a Guardian contributor must be notified in advance so that code and tests can be updated to match.

Running locally

npm i
npm test

mozillavpn-product-details's Issues

Use timestamp validation for `date` field

Should be supported by Ajv and JDT but couldn't get it to parse first time round.

Add a test to verify logic of release information.

See https://github.com/mozilla/mozillavpn-product-details/pull/10/files

This PR added

"2.6.1": {
      "build": null,
      "date": "2021-11-22",
      "platforms": ["ANDROID", "IOS", "MACOS", "WINDOWS"]
    }

but did not update the latest version for iOS and Android

 "latest": {
    "ANDROID": "2.5.1",
    "IOS": "2.5.1",
    "LINUX": "2.6.0",
    "MACOS": "2.6.1",
    "WINDOW: "2.6.1"
    }

This issue is to add a test, unlikely to be doable with json validation to verify inconsistencies like this don't happen.

Add minimum required version

Product details should include installer hash

At present, the product details only contain version numbers and release dates. While this allows a consumer of this repository to construct the URL to archive.mozilla.org to download the installer file, it does not allow the user to validate that the contents of archive.mozilla.org haven't been tampered with and therefore might represent a break in the chain of trust.

To remedy this, we should be including a strong cryptographic hash (eg: SHA256/512) of the installer packages in this repository, in addition to the rest of the release details. This would allow a user to download the installer, and validate that they received the expected file.

Add validation check to ensure that all entries in latest and minimum have releases metadata

This issue was recently exposed in PSP-426 but could have bitten us before.