Add cache busting parameter (version number?) to manifest requests about f2 HOT 3 CLOSED

Please keep in mind a contrary point of view -- as a container developer, I would not like apps to update silently in production (OK if in dev). If apps update their manifest, then they must change their version number (even though that's not the way it works today). Without a js/css sandbox, a silently updating app can break the container or manifest as a bug in other apps, making things extremely hard to debug. This is why I recommend a SHA-1 signature in #46 (comment)

from f2.

Thinking about this one again and reading up on the original issue over on the Google Group, I think at most we would add a cache busting or version parameter to the AppManifest request but not to the individual script/style urls that are specified in the AppManifest. It seems a little heavy-handed to also append the parameter to the script/style requests when the app developer could just as easily make that update (using the url/parameter of their choice) when they make an update to the AppManifest.

The beta Dev Center currently computes an SHA-1 but it computes it on the AppConfig and not the AppManifest. I wonder if the Dev Center should go ahead and request the AppManifest of an app when a developer updates the AppConfig and store it down. That signature could then be passed down with the AppConfig to the container so that it could be compared to the signature of the manifest that is live on the site. I think it would be up to the container developer to do the signature checking/verification and handle errors accordingly. Some containers may not be concerned with this type of verification.

from f2.

There is an option to add debugMode:true to the ContainerConfig though I realize this is a discussion on App versioning. Closing this issue since the beta Dev Center is staying beta, and work on a formal Registry spec is forthcoming.

from f2.