Pioneer: Stop shipping the encryption keys in the library

mozilla / shield-studies-addon-utils

Mozilla Public License 2.0

7 stars 21 forks source link

Pioneer: Stop shipping the encryption keys in the library #274

Open motin opened 6 years ago

motin commented 6 years ago

Migrated here from the deprecated pioneer-utils repo: https://github.com/mozilla/pioneer-utils/issues/22

Currently we ship the JOSE public keys (prod/stage) as part of the library. We should come up with a plan to remove these from the library and to instead pulling and caching them from some online source.

motin commented 6 years ago

Pioneer keys can be cycled through remote settings (https://github.com/mozilla/remote-settings)

Basic TODO outline:

[ ] Set up a remote settings collection with the keys
[ ] Make sure that the keys are named / given a uuid in remote settings
[ ] Await keys from remote settings before the start of a Pioneer study
[ ] Annotate pings with metadata about what keys (name/uuid) are used

@rehandalal Comments on this plan?