[spohlMozilla]

Description:

The "Configuring policies" guide no longer tells admins to put policies.json into Firefox.app/Contents/Resources/distribution on macOS. It now explains how to deploy policies with a configuration profile, and how to use /Library/Preferences/org.mozilla.firefox.plist on a Mac without device management.

Motivation:

Adding files to the app bundle breaks its code signature (codesign --verify --deep --strict fails). We'd like installed bundles to stay intact so that the privileged updater can verify them before it updates them.

Related issues and pull requests:

• https://bugzilla.mozilla.org/show_bug.cgi?id=2089906

@mkaply, could you review this as well?

[mkaply]

you can also use sudo defaults write. we document that in the policy templates.

https://github.com/mozilla/policy-templates/tree/master/mac

The policies.json route is useful for developers at Mozilla and I direct people to this page so they know how to do it. I'm not sure how best to keep that information.

[spohlMozilla]

you can also use sudo defaults write. we document that in the policy templates.

https://github.com/mozilla/policy-templates/tree/master/mac

Thank you! Adding now.

The policies.json route is useful for developers at Mozilla and I direct people to this page so they know how to do it. I'm not sure how best to keep that information.

@mkaply Are configuration profiles insufficient for developers at Mozilla? I am concerned that using policies.json is not going to be possible anymore in the not too distant future when macOS starts enforcing valid signatures on .app bundles more generally than right now. If configuration profiles are not sufficient, I'd like to get a bug on file to support this without causing the signatures to break, or having to resign the bundle (which may also no longer work as expected with deep signature verifications). And ultimately, removing support for policies.json in the .app bundle on macOS may be desirable as well to prevent admins from accidentally breaking Firefox, or its updates.

[mkaply]

it's mainly in development situations where they put them in the obj directory (so signing doesn't matter).

[bsmth]

Looking good, thanks, I just have one comment where we can preserve the JSON method for convenience / testing.

[bsmth]

Thanks!