ubuntu-phone team mailing list archive

[Martin Albisetti <argentina@xxxxxxxxx>]

On Fri, Jun 13, 2014 at 11:48 AM, Ondrej Kubik
<ondrej.kubik@xxxxxxxxxxxxx> wrote:
> If we "auto sign" those packages and then later developer decides to update
> app and sign it with own key, what happened then? Update should them fail
> right?

All the client cares about is that our signature is valid. It doesn't
matter what the developer does. Devices will not check developer's
signatures. We can make sure our servers are aware of the transition
and handle it appropriately.


> Are we planning to have policy in places allowing apps to share package only
> if they have same signature?
>
> If two different apps are coming from same developer and share same package
> name ( and same signature) will they share same sandbox or will they be able
> to peak into each other's sandbox, at least data wise?

We don't have anything in mind yet, and I don't think we'd do it based
on signatures, but I'll defer that to the security team when the time
comes.
Developers get a namespace when they sign up, I'd expect that
namespace to determine this relationship, rather than signatures.


-- 
Martin