- Shavar implements SafeBrowsing v2 to serve Mozilla-controlled lists of urls.
- Mozilla-controlled lists are sourced in the mozilla-services org on Github. E.g., trackware lists provided by Disconnect and plugin blocklists.
- Every 30m, Jenkins runs our shavar-list-creation/lists2safebrowsing script to convert the list files on GitHub into SafeBrowsing lists and upload them to s3.
- shavar serves lists from s3 as configured in the
shavar-server-list-configrepo.
Shavar is a small, specific, efficient service for serving lists of urls to Firefox. We do not plan to enhance its functionality much, except to make the service easier to maintain and run. So if your project needs something more than lists of urls, you might look at another service like Kinto.
So, if you just need a list of urls ...
- File an issue in this repo, including a link back to any relevant bugzilla bug
- We will ask you to add "upstream" files to an appropriate repository (e.g., shavar-plugin-blocklist, shavar-prod-lists, or a new repo.)
- We will add the lists to the staging section of our shavar-list-creation and/or shavar-list-creation-config repositories.
- When we verify that we're creating and publishing the SafeBrowsing lists to S3, we will add the names of the lists to the staging section of shavar-server-list-config to make shavar start serving the lists.
- When we verify that shavar is serving the lists to Firefox correctly, we will repeat steps 3-4 for production.
When we add new lists to shavar, Firefox Test Engineering verifies that lists do not disrupt the server-side shavar service. We will always add the new lists to the staging server first, as described above.
If you need help with client-side testing of Firefox behavior with the new
list, contact the
SoftVision QA Team. Typically,
you will need to provide a set of new or updated testing prefs in the
services-test/shavar/e2e-test/prefs.ini
file.
List contents affect all Firefox users, so all list content updates need review checks. On the shavar side, we check that contents are not going to break nor block large erroneous parts of the internet for all Firefox users. We will help you develop those level of review guidelines, but you should perform your own QA and review to verify that the new list contents work as expected in Firefox.
To update list contents ...
- Send a pull request to the repository of your "upstream" list files
- Ideally, the repository contains some automated checks
- Receive a review and merge from another maintainer of the "upstream" repo
- Within 30 minutes of the merge, shavar should be serving the new list contents