1720923 - Explicitly mention addon id is needed to install succssfully even in builds where "xpinstall.signatures.required" set to false is supported

Status: RESOLVED INVALID

(WebExtensions :: Untriaged, task, P5)

Description

[Akoki]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36 OPR/72.0.3815.400

Steps to reproduce:

• Install Firefox ESR https://www.mozilla.org/en-US/firefox/enterprise/
• Disable xpinstall.signatures.required preference in about:config.
• Try to install a unsigned extension from a file

Actual results:

It does not allow to install the unsigned extension.

Expected results:

It should allow to do it.
See: https://extensionworkshop.com/documentation/publish/signing-and-distribution-overview/

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Robert Longson [:longsonr]]

Per the documentation that pref only works in Nightly and Developer Editions of Firefox.

Comment 3

[Akoki]

Per the documentation that preference should be able to be disabled:

The ESR release supports signing starting with version 45-based releases. Signing enforcement is enabled by default in these releases, and enforcement can be disabled using the xpinstall.signatures.required preference.

enforcement can be disabled using the xpinstall.signatures.required preference

---

extensionworkshop.com is also the official Mozilla's site.

Comment 4

[Robert Longson [:longsonr]]

Doesn't seem that documentation reflects reality. The code and the other documentation are consistent here.

Comment 5

[Alex Cornestean]

Hello,

I could not reproduce the issue on the latest ESR (78.12.0esr/20210706194121) under Windows 10 x64.

I used the the “beastify” extension available at https://github.com/mdn/webextensions-examples in which I’ve only modified the manifest.json file by adding a random id so the browser won’t throw the corrupted error when attempting to install it (“This add-on could not be installed because it appears to be corrupt” pop-up).

With the xpinstall.signatures.required pref set to false, when attempting to install the above add-on, the browser will recognize the add-on as unverified but will allow installation.

For further details, please see the attached video. I’ve also attached the extension I used to test this.

For future references, could you please attach a screen recording of the steps you performed when you observed this issue? Attaching the add-on you used would also help. Thank you !

Comment 6

[Alex Cornestean]

Attachment: 2021-07-19_10h59_16.mp4

Comment 7

[Alex Cornestean]

Attachment: beastify.xpi

Comment 8

[Luca Greco [:rpl] [:luca] [:lgreco]]

As Alex did also mention in comment 5, to successfully install non-temporarily an unsigned extension the user has to make sure that an addon id is assigned through the manifest (on the contrary an addon id is generated automatically when the extension is installed temporarily, if one is not explicitly set in the manifest.json file).

I'm pretty sure that the issue reporter is very likely related to that (trying to install non-temporarily an addon without an explicit addon id in the manifest.json file).

I think it would be reasonable to explicitly mention that the addon id has to be specified in the manifest to successfully install an unsigned extensions in the doc page linked in comment 0 (https://extensionworkshop.com/documentation/publish/signing-and-distribution-overview/), and it may also link the related doc page at https://extensionworkshop.com/documentation/develop/extensions-and-the-add-on-id.

Comment 9

[Akoki]

Wait.
As I have written above I tested it in Firefox 90, downloaded from https://www.mozilla.org/en-US/firefox/enterprise/#download.
That's right.

But Firefox 90 is not ESR.
The download page looks so: https://i.imgur.com/Zeb0P3h.png This confused me.

I thought that if I'm on "Enterprise page", that I will download "ESR" version, but the first row of downloads is... a usual Firefox?
It the browser in which I tested it.

I have downloaded now exactly "Firefox Extended Support Release (ESR)" (78), and now I can install unsigned zip extension. So it works as expected.

Comment 10

[Akoki]

The image: https://i.imgur.com/y4QflHC.png

Comment 11

[Robert Longson [:longsonr]]

closing per comment 9 that ESR does work as the reporter expects.

Comment 12

[Richard Bloor]

Documentation changes in Install unsigned extensions clarification #1247

Comment 13

[Luca Greco [:rpl] [:luca] [:lgreco]]

(In reply to Richard Bloor from comment #12)

Documentation changes in Install unsigned extensions clarification #1247

Thanks Richard. I just approved the pull request linked in comment 12.