We're abusing their v4 API implementation to make v5 API requests, which might not work; hopefully the authentication scheme is the same.
Furthermore, I'm assuming that the v4 sign response gives you a version ID that is valid for v5 `/addons/addon` requests.
The prior version of this code used a hardcoded copy of the script. Not only is this an outdated version of the code, this also caused us to fail our addons.mozilla.org audit.
`temp-dir` 3.0.0 is now pure ESM. As such, it no longer can be `require`d.
To workaround this, use `await import` instead.
In the long-term, it might be worth converting the `sign_xpi.js`
script itself to ESM.
`sign-addon` 5.0.0 switched to ES Modules. Therefore, it no longer
can be `require`d. As a workaround, use `await import` instead.
In the long-term, it might be worth to convert the `sign_xpi.js`
script itself to ES Modules.
YAML is shorter, more modern, readable, and flexible than JSON.
In other words, YAML >>> JSON.
Auto-converted using [`yq`](https://github.com/kislyuk/yq).
Daniel Jacobs