Re: [manifest] Define identity of a web app. (#272)

There was once a discussion on the workflow of installing an app from the app store. From what I remember:
* app store digests manifest (submitted or found by crawling the web). nothing stops the app stoe from validating that the manifest is not malicious (ex visiting the start url and checking the original manifest, if exists)
* when user chooses to install an app from such a store (they click "Install" button), they are taken to the start_url and a normal installation flow from the UA is performed

For "special" app stores, like FxOS marketplace or Xwalk store, it's up to the store to validate the manifests and provide a special installation API if they wish to have their own installation UX

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/272#issuecomment-98155622