1230073 - Sign Add-on using "jpm sign" doesn't work?

Status: RESOLVED WONTFIX

(Mozilla Labs :: Jetpack SDK, defect)

Description

[Jan Honza Odvarko [:Honza] (always need-info? me)]

I used the `jpm sign` command to sign my addon.
https://developer.mozilla.org/en-US/Add-ons/SDK/Tools/jpm#jpm_sign

The process went well, but when I try to install the downloaded/generated XPI the browser still says:

This add-on could not be installed because it has not been verified.

(of course I want to avoid flipping the `xpinstall.signatures.required` pref)

Here is link to the generated XPI
http://janodvarko.cz/temp/websocketmonitor/websocket_monitor-0.4.3-fx.xpi

What could be wrong?

Honza

Comment 1

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Jeff, any tips?

Comment 2

[Jeff Griffiths (:canuckistani) (:⚡︎)]

I'm ccing Kumar who I think implemented this. I had heard there are some issues / limitations with the signing service.

Kumar - any tips?

Comment 3

[Jan Honza Odvarko [:Honza] (always need-info? me)]

I tried `jpm sign` again today and I am getting the following error:

---
JPM [error] FAIL
Error: Validation took too long to complete; last status: {"active":false,"url":
"https://addons.mozilla.org/api/v3/addons/websocketmonitor%40getfirebug.com/vers
ions/0.4.4/uploads/b8933223c65b46f283481051e215af3e/","files":[{"hash":"sha256:0
9c245163699b3d6c71639b8b32efd7201d76d6b5059d4505ac105fc9e5ed68e","signed":false,
"download_url":"https://addons.mozilla.org/api/v3/file/373063/websocket_monitor-
0.4.4-fx.xpi?src=api"}],"passed_review":false,"pk":"b8933223c65b46f283481051e215
af3e","processed":true,"reviewed":false,"valid":true,"validation_results":{"er..
.
    at null._onTimeout (c:\src\github.com\mozilla\jpm\lib\amo-client.js:151:14)
    at Timer.listOnTimeout (timers.js:92:15)
---

I have even tried to increase the timeout (from 60 sec to 10 min), but the same message appears after 10 min.

I can see the XPI on AMO, but when downloading and installing it the browser still says the same: This add-on could not be installed because it has not been verified.

I don't know if this might be related, but note that my websocketmonitor extension is currently awaiting full review on AMO, so perhaps it can't be auto signed and it only uploads a new version that is again just awaiting full review? Or how the logic should work here?

Honza

Comment 4

[Kumar McMillan [:kumar]]

Hi Honza. Sorry about the confusion. The time-out you're seeing is a bug which will be fixed on our next server push (Dec 10, 2015). What you should see instead of a time-out is this message:

Your add-on has been submitted for review. It passed validation but could not be automatically signed with the type of certificate you requested.

In other words, the file is not signed yet because the way you submitted the add-on requires a full review each time you make a change. You could set it to not require a full review if that's not necessary.


I'm wontfix'ing this one (it's really a dupe) because the bug for this is getting tracker over at: https://github.com/mozilla-jetpack/jpm/issues/407

Comment 5

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Thanks for the answer Kumar!

(In reply to Kumar McMillan [:kumar] (needinfo all the things) from comment #4)
> Hi Honza. Sorry about the confusion. The time-out you're seeing is a bug
> which will be fixed on our next server push (Dec 10, 2015). What you should
> see instead of a time-out is this message:
> 
> Your add-on has been submitted for review. It passed validation but could
> not be automatically signed with the type of certificate you requested.
> 
> In other words, the file is not signed yet because the way you submitted the
> add-on requires a full review each time you make a change. You could set it
> to not require a full review if that's not necessary.
So, here is what I need:
- have the add-on listed on AMO, so I can use AMO as distribution channel
- distribute signed version of the add-on using my secondary channel, so users don't have to wait till the add-on passes the review.

Honza

> 
> 
> I'm wontfix'ing this one (it's really a dupe) because the bug for this is
> getting tracker over at: https://github.com/mozilla-jetpack/jpm/issues/407

Comment 6

[Kumar McMillan [:kumar]]

Huh. I don't think that's possible. I opened this issue to investigate (we aren't using bugzilla anymore for AMO) https://github.com/mozilla/olympia/issues/1066