1213728 - "addon appears to be corrupt" error when add-on is signed by someone other than Mozilla

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[:glob ✱]

firefox dev-edition 43.0a2 (2015-10-08)

i tried to install the dashline addon from https://d3mfqat9ni8wb5.cloudfront.net/releases/3.5.4/3.5.4.91082/Dashlane.xpi however i receive the following error:

"The add-on downloaded from this site could not be installed because it appears to be corrupt."


this appears to be related to add-on signature checking, as once i changed xpinstall.signatures.required from true to false the error went away.

Comment 1

[:glob ✱]

Attachment: Screenshot 2015-10-12 11.59.47.png

Comment 2

[Dave Townsend [:mossop]]

This add-on was signed by Digicert not Mozilla so we're doing the right thing by refusing to install it. The error message could possibly be a bit better but I'm not sure how easy that is to improve.

Comment 3

[:glob ✱]

if you don't want to expose the more technical reason for considering an add-on corrupt to most users (understandable!), would it be possible to log the technical reason to the browser console, or provide some other means to expose the reason why an add-on is considered corrupt?

Comment 4

[Tony Mechelynck [:tonymec]]

Dupe of bug 1224591 (or vice-versa)? See in particular bug 1224591 comment 6 and 7.

Comment 5

[Tony Mechelynck [:tonymec]]

(In reply to Byron Jones ‹:glob› (Unavailable until 4th Jan) from comment #3)
> if you don't want to expose the more technical reason for considering an
> add-on corrupt to most users (understandable!), would it be possible to log
> the technical reason to the browser console, or provide some other means to
> expose the reason why an add-on is considered corrupt?

In this particular case, I see no security risk in changing the message to "Add-on was not signed by Mozilla". Another possibility would be "Signature verification failed" but I suppose it might bring a lot of bug reports DUPLICATE to this one.