Skip to content

Add VirusTotal scan results to add-on details#18974

Merged
seanbudd merged 12 commits into
masterfrom
addonStoreVirusScan
Sep 25, 2025
Merged

Add VirusTotal scan results to add-on details#18974
seanbudd merged 12 commits into
masterfrom
addonStoreVirusScan

Conversation

@seanbudd

@seanbudd seanbudd commented Sep 23, 2025

Copy link
Copy Markdown
Member

Link to issue number:

Replaces #16510 and #16316
Related discussion #16241

Summary of the issue:

  • Add-ons have been scanned by VirusTotal, but there is no easy way for a user to use this information to make an informed decision before installing an add-on
  • Our warning about the safety/security of add-ons could include additional information on researching the safety of add-ons

Description of user facing changes:

  • A new action for add-ons in the add-on store to view the scan results of an add-on
  • Added information in the details panel of an add-on: summary of scan results, and scan URL
  • Updated the user guide

Description of developer facing changes:

None

Description of development approach:

  • Created a new VirusTotalScanResults structure to capture results from the add-on store metadata JSON

Testing strategy:

  • Tested viewing the scan results for an add-on in the store
  • Tested that an add-on with no scan results (externally installed) can be viewed properly from within the store

Known issues with pull request:

None

Code Review Checklist:

  • Documentation:
    • Change log entry
    • User Documentation
    • Developer / Technical Documentation
    • Context sensitive help for GUI changes
  • Testing:
    • Unit tests
    • System (end to end) tests
    • Manual testing
  • UX of all users considered:
    • Speech
    • Braille
    • Low Vision
    • Different web browsers
    • Localization in other languages / culture than English
  • API is compatible with existing add-ons.
  • Security precautions taken.

@seanbudd seanbudd requested review from a team as code owners September 23, 2025 06:34
@seanbudd seanbudd requested review from Qchristensen, SaschaCowley and Copilot and removed request for Copilot September 23, 2025 06:34
Copilot AI review requested due to automatic review settings September 23, 2025 06:35
Copilot AI reviewed Sep 23, 2025

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@seanbudd seanbudd requested a review from Copilot September 23, 2025 06:37
Copilot AI reviewed Sep 23, 2025
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment thread source/addonStore/models/scanResults.py
Comment thread source/gui/addonStoreGui/controls/details.py Outdated
Comment thread user_docs/en/userGuide.md Outdated
@seanbudd seanbudd mentioned this pull request Sep 23, 2025
Closed
5 tasks
seanbudd and others added 2 commits September 23, 2025 16:47
@seanbudd
better track scans totals
9373401
@seanbudd
Update user_docs/en/userGuide.md
461cfb0 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@seanbudd seanbudd requested a review from Copilot September 23, 2025 06:49
@seanbudd seanbudd mentioned this pull request Sep 23, 2025
Closed
5 tasks
Copilot AI reviewed Sep 23, 2025
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment thread source/addonStore/models/scanResults.py Outdated
Comment thread source/gui/addonStoreGui/viewModels/store.py
seanbudd
seanbudd commented Sep 23, 2025
View reviewed changes
Comment thread source/addonStore/models/scanResults.py Outdated
@Adriani90

Adriani90 commented Sep 23, 2025

Copy link
Copy Markdown
Collaborator

This is a great improvement, thank you Sean for this nice work.
Is there a way to run virus total scans on add-on updates as well? So users can see the scan results before updating?

@seanbudd

seanbudd commented Sep 23, 2025

Copy link
Copy Markdown
Member Author

@Adriani90 - add-ons are scanned when they are submitted to the store. You should be able to view the scan results before updating.

SaschaCowley
SaschaCowley approved these changes Sep 25, 2025
View reviewed changes
Comment thread source/gui/addonStoreGui/controls/details.py Outdated
Comment thread user_docs/en/changes.md Outdated
Comment thread user_docs/en/userGuide.md Outdated
seanbudd and others added 3 commits September 25, 2025 10:57
Qchristensen
Qchristensen approved these changes Sep 25, 2025
View reviewed changes

@Qchristensen Qchristensen left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reads well. Showing VirusTotal results is a good inclusion for user peace of mind.

It is also worth noting that the new warning text is not in response to any incident or malicious add-on, but simply ensuring users are aware of the scope of access add-ons have always had. We have a robust and healthy add-on ecosystem - their power can make them very useful, but it is important to be aware of their potential access before downloading particularly from an unknown source.

@seanbudd seanbudd enabled auto-merge (squash) September 25, 2025 01:22
@seanbudd seanbudd disabled auto-merge September 25, 2025 02:11
@seanbudd seanbudd merged commit b675843 into master Sep 25, 2025
34 of 36 checks passed
@seanbudd seanbudd deleted the addonStoreVirusScan branch September 25, 2025 02:11
@github-actions github-actions Bot added this to the 2026.1 milestone Sep 25, 2025
@seanbudd seanbudd mentioned this pull request Sep 25, 2025
Merged
5 tasks
seanbudd added a commit that referenced this pull request Sep 25, 2025
@seanbudd
fix add-on store merge conflicts between #18816 and #18974
339af3e 
Fixes #18991
Fixes a bad merge conflict fix between #18816 and #18974
Summary of the issue:

add-on store cannot open
Description of user facing changes:

add-on store can open again
Description of developer facing changes:

none
Description of development approach:

fix merge conflict
Testing strategy:

add-on store can open again
@CyrilleB79 CyrilleB79 mentioned this pull request Oct 7, 2025
Merged
5 tasks
seanbudd pushed a commit that referenced this pull request Nov 3, 2025
@CyrilleB79
Add-on store: pluralize one string (#19059)
70234cb 
Fix-up of #18974
Summary of the issue:

One newly translatable string needs to support plural forms:
"{malicious} out of {total} malware scanners detected this add-on as potentially malicious."

In English, there is no difference, since "detected" uses the same form at singular or plural; but in other languages, not. There are also languages where scanners pluralization needs to change.
Description of user facing changes:

The information will have correct pluralization form.

After discussion, I have tried to find a wording where only one of the two numbers needs an agreement to avoid splitting and re-building the sentence.
Description of developer facing changes:

N/A
Description of development approach:

Use npgettext instead of pgettext.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@Qchristensen Qchristensen Qchristensen approved these changes

@SaschaCowley SaschaCowley SaschaCowley approved these changes

+1 more reviewer

@alg21990w-ai alg21990w-ai alg21990w-ai approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

2026.1

Development

Successfully merging this pull request may close these issues.

6 participants

@seanbudd @Adriani90 @Qchristensen @SaschaCowley @alg21990w-ai