1298806 - xpinstall.signatures.required = false is ignored

Status: RESOLVED WONTFIX

(Firefox :: Settings UI, defect)

Description

[sjc]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160623154057

Steps to reproduce:

xpinstall.signatures.required was set to false in 47.0.1
Installed 48.0.2 over 47.0.1.
Verified xpinstall.signatures.required still set to false
"Unverified" extensions are still disabled despite the setting
Reinstalled 47.0.1 from backup



Actual results:

"Unverified" extensions are disabled


Expected results:

"Unverified" extensions should be enabled.  I will be staying on 47.0.1 until this is fixed as I rely on some of those extensions.

Comment 1

[Luca Preziati]

Happen to me also in windows. I cannot use anymore VPN system in firefox.

Comment 2

[Alex Haan]

I had the same suddenly happen when upgrading to 49.0.2. I'm not sure what my previous version was. But I usually update pretty soon after the notice is given. It was fine before the update.

There's just a few tiny add-ons that work fine the way they are. I really don't need the hassle of this requiring signing.

OS: Windows 10

Comment 3

[Marco Bonardo [:mak]]

Signing cannot be disabled in Release and Beta versions.
You can self-sign the add-ons you need on addons.mozilla.org, just register your account and publish the add-on as non-public (it will just be for your personal use).
Or you can use jpm to do the same (from the add-ons sdk).

Or, even simpler, just use Developer Edition, that still allows to disable signing.

Comment 4

[Luca Preziati]

Sorry Marco, but i switch to Developer Edition and for a while work, then stop to work for the same reason, bacause ignore the setting.

But i cannot understand why, if i set to ignore the signature, my will is ignored.

Comment 5

[Marco Bonardo [:mak]]

Beta and Release cannot respect the signature pref for safety reasons.
Developer edition should never ignore the pref, as far as I know. Maybe there's another reason if after a while it stops working, maybe signing is a red herring (some other add-on conflicts?, or Dev Edition updates the and add-on breaks due to code changes?), or maybe you inadvertently start Beta (if you have multiple versions installed)?
Another possible option is ESR versions, that are more stable then Dev Edition.
All the details are explained here:
https://wiki.mozilla.org/Add-ons/Extension_Signing

Comment 9

[vleet]

It's awful how you Mozilla Team are ignoring your users with this disable-signing-check-flag.

How THE HELL IS #1549047 a duplicate of this 3 years old issue?
You failed BIG TIME yesterday, so, it's now completely different story and different reasoning, not some 3 year sold WONTFIX ticket.

LISTEN TO THE COMMUNITY FOR GOD'S SAKE.

---

Arguments from #1549047, so you wont be ignoring it:

Christoph Terasa
Description • 17 hours ago

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0

Actual results:
Extensions do not work because of bug #1548973

Expected results:
Firefox should allow users of the stable branch to disable extension signing check.

---

vleet
Comment 1 • 10 hours ago

I can't agree MORE. It was a wrong idea to remove this option in the first place. And people actually WERE telling Mozilla team NOT TO DO it. But Mozilla once again decided wrong.

If this setting for about:config were still available, the current major crysis would be easily mitigated but disabling the "sign check", that obviously works incorrectly for now! It would be the only logical and right way to temporary fix it before you guys make a new fixing-release. Turning on spy-studies or something is no-go for some of your users.

It's super-important to fix the WRONG decision taken back than, because this setting can be helpful in future for other huge fails and reduce the users' pain.

So, Mozilla-guys, we love you and Firefox is probably the only browser we could recommend to friends and use ourselves, but can you please LISTEN to the community more often?
And return this setting back at least after what happen?

---

Michael
Comment 2 • 8 hours ago

On one side, I understand mozilla removing the option to disable/enable extension signing check, because it makes it safer and in theory, simpler for the users that aren't well versed with code. However, in all reality, the average user more than likely doesn't have any clue how to alter any config options, let alone know what "about" pages are.

I believe they need to add the option back as well. I don't believe having the option available to enable/disable the checking, does cause a security concern. If you know how to alter the config, you should hopefully know how to stay safe online and how to check the certificate signing manually, if you are at all concerned it may be a dangerous add-on.

Hopefully mozilla decides to add this option back in one of the next few releases.

Comment 10

[vleet]

(In reply to Marco Bonardo [::mak] from comment #3)

Signing cannot be disabled in Release and Beta versions.
You can self-sign the add-ons you need on addons.mozilla.org, just register
your account and publish the add-on as non-public (it will just be for your
personal use).
Or you can use jpm to do the same (from the add-ons sdk).

Or, even simpler, just use Developer Edition, that still allows to disable
signing.

Marco, what do you think about yesterday when ALL Firefox users got all their addons turned off and could not temporary turn them back on easily with one flag because of YOUR WRONG decision from 3 years ago?
Can you please admit you were wrong and just give back this flag?

This WONTFIX decision of yours really put all community down. Please make up for it by returning the option back.

PS. Anyway I appreciate you as a contributor to Firefox, still the best of popular browsers even after such a fail.

Comment 11

[heaven-seven]

(In reply to Marco Bonardo [::mak] from comment #3)

Signing cannot be disabled in Release and Beta versions.
You can self-sign the add-ons you need on addons.mozilla.org, just register
your account and publish the add-on as non-public (it will just be for your
personal use).
Or you can use jpm to do the same (from the add-ons sdk).

Or, even simpler, just use Developer Edition, that still allows to disable
signing.

It's a great, perfect, excellent lesson - https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/

If this bug was FIXED 3 years ago instead of WONTFIX blah-blah-blah, now everyone could EASILY DISABLE it through about:config and have no problems with FF addons.
But now ALL FF users are experiencing troubles with add-ons. Let me guess, the FF team is hurrying with the fix as well. All these is happening because of some, speaking honestly, stupid decision made 3 years ago.

Hope, all of you, guys, are enjoying the situation?))

Comment 13

[Alexander]

This is absolute non-sense. I use firefox to not be limited, now I have to use firefox not from my distro or go through process of signing extensions just to run my modified extension :/