[tor-bugs] #5092 [TorBrowserButton]: Sign Torbutton XPI updates (was: "Disable updates during Tor usage" by default (AMO/Addons))

[Tor Bug Tracker & Wiki]

#5092: Sign Torbutton XPI updates
------------------------------+---------------------------------------------
 Reporter:  cypherpunks       |          Owner:  mikeperry                    
     Type:  defect            |         Status:  new                          
 Priority:  major             |      Milestone:  TorBrowserBundle 2.3.x-stable
Component:  TorBrowserButton  |        Version:                               
 Keywords:                    |         Parent:                               
   Points:                    |   Actualpoints:                               
------------------------------+---------------------------------------------
Changes (by mikeperry):

  * priority:  critical => major
  * component:  Torbutton => TorBrowserButton
  * milestone:  => TorBrowserBundle 2.3.x-stable


Comment:

 Mozilla does some half-assed cert pinning for AMO, so NoScript covered
 (sort of).

 We should probably also be signing the Torbutton xpi/rdf, though, as it
 does not use AMO.

 The https-everywhere xpi+rdf already is signed, afaik.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5092#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online