1205641 - Signature Verification Error thrown while installing various addons

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[Ada [:adalucinet]]

Reproducible with Firefox 38.3.0 ESR build 2 (Build ID: 20150916094008)
Affected platforms: Windows 7 64-bit, Mac OS X 10.9.5 and Ubuntu 12.04 32-bit

Steps to reproduce:
1. Launch Firefox and open the Browser Console (from menu [≡] → select "Developer" → select "Browser Console")
2. Install popular add-ons from AMO (E.g.: Firebug - https://addons.mozilla.org/en-US/firefox/addon/firebug/?src=cb-dl-users)

Expected result: The add-on is installed successfully.
Actual result: "Signature Verification Error: the signature on this .jar archive is invalid because the certificate used to sign this file has an unrecognized issuer." is displayed in browser console and the add-on is installed.

Additional notes:
1. Also reproducible with ESR 38.2.0, Firefox 38.0.5 RC and 39.0 RC, but *not* with latest builds - 41 RC build 2, latest 42.0a2 and 43.0a1

Comment 1

[Dave Townsend [:mossop]]

This is basically an accurate message. The add-ons are signed by the AMO signing root which builds of Firefox before 40 don't know about. We're not going to fix this in ESR 38.