[libvoikko] Mozvoikko needs to be signed and reviewed at addons.mozilla.org

[Sjur Moshagen]

19. aug. 2015 kl. 11:26 skrev Marko Wallin <marko.wallin at iki.fi>:
> 
> On 19.8.2015 9.57, Sjur Moshagen wrote:
>> 18. aug. 2015 kl. 22:54 skrev Marko Wallin <marko.wallin at iki.fi>:
>>> 
>>> On 18.8.2015 22.10, Harri Pitkänen wrote:
>>>> I really don't know yet how this will work. In theory for signing
>>>> to be effective the signature would need to cover at least all
>>>> code used by the extension and perhaps other resources too. And
>>>> the problem is that the extension at addons.m.o will never have
>>>> the identical code: JavaScript might be the same but it calls
>>>> native code that is platform dependent and cannot be the same on
>>>> Windows and Linux. The native code can do anything so if the
>>>> signature does not cover that it would defeat the purpose of
>>>> signing.
>>>> 
>>>> Additionally there is one question and answer at
>>>> https://wiki.mozilla.org/Addons/Extension_Signing that is
>>>> understandable but perhaps a bit problematic for Linux
>>>> distributions:
>>>> 
>>>> ====
>>>> 
>>>> * Will I need to sign the custom version of an existing add-on I
>>>> created with my own code changes, locale additions, etc.?
>>>> 
>>>> - If you use it on Release or Beta, yes. You will also need to
>>>> change the add-on ID in order to submit it for signing.
>>>> 
>>>> ====
>>>> 
>>>> Since Mozvoikko has already been submitted to addons.mozilla.org
>>>> (by Marko Wallin) I understand that nobody else can get a
>>>> signature for an extension with the same identifier. So if for
>>>> example I would want to sign my own version of Mozvoikko I would
>>>> need to change the identifier.
>>>> 
>>>> If this interpretation is correct we perhaps need to make the
>>>> extension identifier easily configurable. This is not a difficult
>>>> thing to do but I would first want to know if it is really
>>>> needed. There is very little information available at the moment
>>>> it seems.
>>>> 
>>> 
>>> The id for mozvoikko is already different in addons.mozilla.org
>>> (fi at dictionaries.addons.mozilla.org) than on Git
>>> ({b676e3ff-cda7-4e0c-b2b8-74e4bb40a67a}).
>>> 
>>> Mozvoikko in AMO (addons.mozilla.org) is now for OS X and Windows
>>> and the Linux version could be added separately. The addon owner
>>> (yllapito at mozilla.fi) can add authors who can manage the files and
>>> submit the addon to be reviewed and signed.
>>> 
>>> The other option, what I understand, is to make new addon entry for
>>> Linux which is unlisted and not distributed on AMO. But the same
>>> author limitation still would exist, who can submit the addon to be
>>> signed.
>> 
>> I don’t quite follow - but let’s take an example, and try to figure
>> out how to proceed:
>> 
>> Harri has extended the Mozvoikko code lately to support multiple
>> languages, and has build a new set of libraries with support for both
>> the Vfst and Zhfst dictionary formats. We in Tromsø intent to use
>> this version of Mozvoikko to provide downloadable Mozvoikko
>> extensions for a number of languages, by just adding the relevant
>> zhfst file to the package. This makes for one Mozvoikko file per
>> language,  from the start around 10 languages, and expanding (we have
>> about 40 languages being worked on more or less actively, and new
>> languages are being added regularly).
>> 
>> Questions: * who can update the AMO version to include the latest
>> work by Harri?
> 
> For now Ville Pohjanheimo (yllapito at mozilla.fi) and I can update the AMO
> version.

Ok.

>> * do what you write above imply that Harri and possibly others can be
>> added to the author list, and then get access to the signing using
>> the existing AMO id?
> 
> Yep.
> 
>> * can we in Tromsø use the same id to distribute a number of
>> different Mozvoikko plugins, where the only difference is the
>> included language/spelling dictionary, or do we need one id for each
>> language?
> 
> AMO supports only one addon package so you would need one id for each language. Like the addon id is now "fi at dictionaries...".
> 
> As there's not much information how the signing works if you don't distribute the addon in AMO (unlisted addon) so it could be possible to have one id and just change the languages inside.

That was what I was thinking of, see below.

>> * what is the best way to manage (AMO) support for many languages
>> using the same Mozvoikko codebase?
>> 
> 
> The other question is does user need to have multiple mozvoikko addons for different languages and how does that work out? Or does the user get just basic addon package from AMO and have the language/spelling dictionaries outside the addon?

As long as there is only one id there can’t be multiple mozvoikko addons, like one for each language - after the first one is installed, installing the next one will overwrite/remove the first one.

The mozvoikko Harri has built for us in Tromsø supports loading multiple dictionaries from several locations in the regular file system, so the proposal for multilingual support would be:

1) download mozvoikko for your favorite language
2) download zhfst files for any and all of your other favorite languages, and put them in directory X (where X is one of a documented list of possible locations)
3) restart Firefox/Thunderbird/SeaMonkey

The point with multiple mozvoikkos is really that most users only need one or two languages, and they would therefore only want to download the one with that language, and then just manually install the other one(s) as zhfst files as needed.

From a maintenance and AMO point of view, these are all one and the same mozvoikko (at least in my perspective), and having one and only one id to relate to is much preferred over having 40+, especially since the code is essentially the same for all of them. And for the really multilingual users, it is much preferred to download the extension only once instead of filling the disk with multiple instances of the same code.

Also, we don’t know how the mozvoikko and libvoikko code would react if we had multiple mozvoikkos with different id’s. Add to that multiple user-installed zhfst dictionaries, and we are in for a mess.

To sum up, here is what I suggest:
* one Mozvoikko at AMO, perhaps with Finnish as the preloaded language (after all, that is the original language of (Moz)voikko), signed
* in the AMO description, add links to download sites for Mozvoikko preloaded with other languages
* I/we in Tromsø provide one or more download sites (two are planned) for Mozvoikko for other languages than Finnish, using the same signed code with the same id as the one on AMO

For this to work, it is of course a requirement that the AMO version is using the latest code by Harri, with (z)hfst support, preferably also vfst support, and compiled to support loading dictionaries from the regular locations.

Sjur