-----BEGIN PGP SIGNED MESSAGE-----
On 01/07/2016 08:41 AM, Martin Stransky wrote:
On 01/07/2016 02:29 PM, Naheem Zaffar wrote:
> ESR will only delay the problem.
> Can the Fedora build add a secodary key to accept signed
Is it possible to use Mozilla API to sign our extensions?
No, it is not. The primary reason being that Koji builds intentionally
have no network access. This is to ensure that all builds are
reproducible (since if they relied upon external network resources,
the output from the same input could be different if it was rebuilt at
a different time). Additionally it's to ensure that some third-party
service isn't inserting unexpected code into the output, thereby
resulting in us shipping a binary that doesn't match the sources.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
-----END PGP SIGNATURE-----