https://blog.mozilla.org/addons/2018/05/10/switching-json-update-manifests/
With the old update.rdf I had to sign the manifest using McCoy. Is this step not necessary anymore with the new updates.rdf? And if not, how do you insure that you update to the right new version of the extension?
And how will the transition take place? In my extension’s install.rdf I have a link to the old update.rdf. Do I have to release an updated version with only/at least a link to the new updates.json in order to be able to upgrade users outside of AMO after this changes has become effective?
As the same questions have recently been raised on IRC I’ll try to echo the answers here.
You don’t have to sign your update.json, since you have to deliver it over HTTPS.
That depends on how exactly you want to transition. Firefox does not care what it gets back as a result for the update URL. It’ll handle RDF as RDF and a JSON response as the new update.json format. So if you’re confident with only updating users from something around Firefox 35 or 40 on (I don’t know the exact version when update.json support was added) you can just serve the update.json under the old update.rdf URL to update existing versions.
Alternatively you can do user-agent detection to determine, if the incoming request supports the JSON format and only serve it then.
Lastly, you can issue an update via the old update.rdf format that switches the update URL to a new file. Of course this only works, if users update to that version before they have a Firefox version that no longer supports the update.rdf.