Intention to stop signing omni.ja

51 views
Skip to first unread message

Ben Hearsum

unread,
Jan 7, 2025, 9:16:30 AM1/7/25
to dev-pl...@mozilla.org

omni.ja signing was introduced in https://bugzilla.mozilla.org/show_bug.cgi?id=1533818 and https://bugzilla.mozilla.org/show_bug.cgi?id=1515173. For a time, we checked the signature, but that was removed awhile back. Even when it was enabled, we never stopped loading code from it upon failure - merely reported it back in Telemetry.

Seeing as we do no validation of this, and have never done any useful validation, we should stop signing omni.ja to avoid a false sense of security, and reduce the amount of work we do during signing.

We do not intend to remove support for signing altogether, so it can be re-enabled again in the future if we decide to do something useful with these signatures.

Reply all
Reply to author
Forward
0 new messages