Add plugin update mechanism

MetaMask / metamask-snaps-beta

Fork of MetaMask that supports plugins! Read the Wiki!

https://github.com/MetaMask/metamask-snaps-beta/wiki

MIT License

142 stars 57 forks source link

Add plugin update mechanism #45

Open danfinlay opened 4 years ago

danfinlay commented 4 years ago

Static plugins have limited utility:

They cannot receive improvements
They cannot improve fixes
They cannot receive security improvements

For these reasons, we should not ship any plugin system without a robust plugin-update system.

This thread will serve as a place to discuss the beginnings of this aspect of the system.

Bunjin commented 4 years ago

I'm still working on it but I had a few ideas about adding 2 features which plugins can requestPermission to use :

Track updates (maybe makes this a base feature for any snaps): This will track the url (http, ipfs, ens) where the snap is hosted and it can detect that the plugin was updated (we may need to add some signature mechanism to make sure that the url wasn't hijacked). Then it can propose to the user to manually update the plugin (maybe by using a list of your snaps and showing which can be updated, a la app store)
Auto update: requires track updates, and will automatically update once a upgrade is detected. (can only happen if the set of requested permission for the new version is not growing)

Bunjin commented 4 years ago

Related question: Did you guys think about a mechanism for snaps requiring other snaps? (similar to dependencies) Imagine I need a state channel snap for my gaming or dex snap. If so, then we need a way to specifiy which version of the dependency snap is being used. And then potentially to handle several versions of the same snap in case a snap that requires it hasn’t updated to the latest version

danfinlay commented 4 years ago

The versioning question is important, and we had a good thread in a DM about this, sharing a bit here for others.

Basically, we think dapps/snaps should be able to request a security model for a dependency, and the user should be able to heighten the security around it (like requiring confirmation to receive updates).

3 options there too from the user perspective:

refuse trackUpdates and thus autoUpdate
accept trackUpdates but update manually
accept autoUpdate (trackUpdate required)

Bunjin commented 4 years ago

Yes I'm making another issue with the discussion about the security and updating models for snaps dependencies.

https://github.com/MetaMask/metamask-plugin-beta/issues/81