CODEWITHSUNDEEP
firefoxfirefox-addon
user1670407
user1670407

Reputation:

Firefox addon underscore known releases

I am trying to submit a extension to the firefox store but its complaining that

underscore.js

Your add-on includes a JavaScript library file that doesn't match our checksums for known release versions. We require all add-ons to use unmodified release versions, obtained directly from the developer's website.

I am using the latest version of underscore.js from there github with no modifications.

Is 1.7 not a known release ?

Upvotes: 2

Views: 193

Answers (1)

erosman
erosman

Reputation: 7741

Underscore v 1.7.0 is a known release but the file was changed somehow and it no longer matched the hash of the original file.

If I am not mistaken, I was the one who reviewed that one.

Addon's underscore.js SHA-256 hash f0669907de171cfc040464432e53218c003c6d91b4df3d21d1f643f9b8951ff7

underscore-1.7.0.js SHA-256 hash 99317bc4b5be833de9c57a7dc3531dae585484b75f81c49339a0824681710fdc

As you can see, they do not match. Even a single character like space can alter the hash. It is impractical to check library code line by line and therefore we rely on established libraries to be exactly identical to the original library and hence the checksums comparison.

Established libraries must be included from their official source, in their original format without any modification (changing the file name does not matter). Please note that only stable releases of are acceptable (not beta, pre, RC, dev etc). Please note that third party CDNs are not considered official sources for this purpose.

You should get the undescrore 1.7.0 from:
http://underscorejs.org/underscore.js
http://underscorejs.org/underscore-min.js

or ...
https://raw.githubusercontent.com/documentcloud/underscore/1.7.0/underscore.js
https://raw.githubusercontent.com/documentcloud/underscore/1.7.0/underscore-min.js

N.B. Github version is a dev version. (https://github.com/jashkenas/underscore)
Only include one of the above (not both). Minified version is fine as long as it matches the hash.

underscore-1.7.0-min.js SHA-256 hash 7b6fbd8af1c538408f2fe7eef5f6c52b85db12ab91b63277287e5e9ea83a4931

Upvotes: 2

Related Questions