Thunderbird 91 tries to verify add-ons (which it should not) and aborts add-on installations and disables all installed add-ons
Categories
(Thunderbird :: Add-Ons: General, defect)
Tracking
(thunderbird_esr91+ fixed, thunderbird92 wontfix)
People
(Reporter: tryderjr, Assigned: rjl)
References
(Blocks 1 open bug)
Details
(Whiteboard: [TM: 91.1.1])
Attachments
(1 file)
48 bytes,
text/x-phabricator-request
|
wsmwk
:
approval-comm-esr91+
|
Details | Review |
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Steps to reproduce:
Tried to install addon: Addon Compatibility Check for TB 91 or Dark Reader
Actual results:
Message popped up saying Thunderbird has prevented this site from installing an unverified addon
Expected results:
Install the addon. The addons should be compatible with TB 91 and other users seem to have no issues.
Comment 1•3 years ago
•
|
||
Thunderbird has prevented this site from installing an unverified addon.
That is a strange issue we have seen lately. Could you answer the following questions:
-
Which operating system are you using? Windows, Mac, or Linux? Which version? If Linux, which distribution do you use?
-
Could you please go to
Thunderbird hamburger menu
->Preferences
->General
, scroll to the very bottom, click on theConfig editor
button, search forsignature
and tell us which value the settingxpinstall.signatures.required
has? Is it true or false? Is it bold or not bold? -
How did you install Thunderbird 91? Did you manually download it from https://thunderbird.net ? Or has your installation been updated automatically? If so, by which method (for example by a 3rd party updater like Advanced System Care for Windows, or by the package manager of your Linux distribution)?
-
If you download Thunderbird 91 directly from https://thunderbird.net and use that version, does the error remain?
Updated•3 years ago
|
Updated•3 years ago
|
Updated•3 years ago
|
I'm on an Arch-based Linux distribution (Garuda). My installation is from the AUR I believe.
The xpinstall.... is false and it is not bold.
I'll try downloading from Thunderbird.net and give it a shot.
(In reply to John Bieling (:TbSync) from comment #1)
Thunderbird has prevented this site from installing an unverified addon.
That is a strange issue we have seen lately. Could you answer the following questions:
Which operating system are you using? Windows, Mac, or Linux? Which version? If Linux, which distribution do you use?
Could you please go to
Thunderbird hamburger menu
->Preferences
->General
, scroll to the very bottom, click on theConfig editor
button, search forsignature
and tell us which value the settingxpinstall.signatures.required
has? Is it true or false? Is it bold or not bold?How did you install Thunderbird 91? Did you manually download it from https://thunderbird.net ? Or has your installation been updated automatically? If so, by which method (for example by a 3rd party updater like Advanced System Care for Windows, or by the package manager of your Linux distribution)?
If you download Thunderbird 91 directly from https://thunderbird.net and use that version, does the error remain?
With the version downloaded directly from the site, the message "downloading and verifying addon" stays up but it won't go away or actually download the extension.
(In reply to Ryder from comment #2)
I'm on an Arch-based Linux distribution (Garuda). My installation is from the AUR I believe.
The xpinstall.... is false and it is not bold.
I'll try downloading from Thunderbird.net and give it a shot.
Ah also it was actually from the chaotic-aur.
Comment 5•3 years ago
•
|
||
We have confirmation from the slackware community, that the so far reported issues (all from slackware) were due to an issue with their built and it has been fixed:
https://www.linuxquestions.org/questions/slackware-14/thunderbird-91-addons-4175699223/page2.html#post6277449
Are you 100% sure, that you run the version downloaded from thunderbird.net in your second test?
Comment 6•3 years ago
|
||
Ah, I just saw that you reported a different error for the second test. Did you skip the account creation wizzard? Could you actually set up an account?
(In reply to John Bieling (:TbSync) from comment #6)
Ah, I just saw that you reported a different error for the second test. Did you skip the account creation wizzard? Could you actually set up an account?
I did skip the account creation. That might have something to do with it!
Hey what do you know that was it, after account creation thunderbird.net install worked.
Comment 8•3 years ago
|
||
Are you able to report to the repository maintainer, that they have a broken version of TB91? Probably related to what the slackware people run into (mentioned in the link in Comment #5)
That would help others a lot.
Comment 9•3 years ago
|
||
(In reply to Ryder from comment #7)
I did skip the account creation. ... after account creation thunderbird.net install worked.
Ryder, I'm confused. Are you saying that addon installation fails until you configure a mail account in Thunderbird? (This issue is about addon install failing. I'm puzzled how account creation is relevant to that.)
Comment 10•3 years ago
•
|
||
export MOZ_REQUIRE_SIGNING=
If signed Thunderbird addons don't even exist, then it seems like a trap to have a configure option - at compile time! - that enforces signatures for Thunderbird addons. That configure option shouldn't exist. Or at least the Thunderbird build should fail configure when it detects that this setting is set.
Comment 11•3 years ago
•
|
||
(In reply to Ben Bucksch (:BenB) from comment #9)
(In reply to Ryder from comment #7)
I did skip the account creation. ... after account creation thunderbird.net install worked.
Ryder, I'm confused. Are you saying that addon installation fails until you configure a mail account in Thunderbird? (This issue is about addon install failing. I'm puzzled how account creation is relevant to that.)
Ben, he did what I asked him and he reported what happend and yes he run into another bug I have seen before but which is not yet reported as a bugzilla bug.
Comment 12•3 years ago
|
||
Rob: Do we have the power to fix this? I think it boils down to Thunderbird being broken if build without
export MOZ_REQUIRE_SIGNING=
Can we define a default empty value for MOZ_REQUIRE_SIGNING
?
Assignee | ||
Comment 13•3 years ago
|
||
The only way to override default, which is signing is enabled (we inherit from Firefox) is to set the empty value in mozconfig.
Comment 14•3 years ago
•
|
||
So, you're saying that the default is broken. Is that correct?
@rob, could this value be set in the configure build script as we need it (to empty value)? And the script could also enforce the right value.
Comment 15•3 years ago
•
|
||
I can confirm that the default is broken.
Environment:
- In my case: Linux
Reproduction:
- Download https://archive.mozilla.org/pub/thunderbird/releases/91.0.3/source/thunderbird-91.0.3.source.tar.xz
- Build TB without any relevant mozconfig flags
- Run the self-built TB
- Install an addon
Actual result:
Error console shows:
1630093503729 addons.xpi-utils WARN Add-on addon@example.com is not correctly signed. 2
1630093503729 addons.xpi-utils WARN addMetadata: Add-on addon@example.com is invalid: Error:
Extension addon@example.com is not correctly signed
(resource://gre/modules/addons/XPIDatabase.jsm:2839:15)
JS Stack trace: addMetadata@XPIDatabase.jsm:2839:15
processFileChanges@XPIDatabase.jsm:3292:26
checkForChanges@XPIProvider.jsm:3020:55
startup@XPIProvider.jsm:2471:12
callProvider@AddonManager.jsm:230:31
_startProvider@AddonManager.jsm:590:17
startup@AddonManager.jsm:814:14
startup@AddonManager.jsm:3511:26
observe@addonManager.js:81:29
Expected result:
Addons install and work
Importance:
This affects everybody who builds from source.
So, this is actually our bug, not a bug of the Linux distribution. The Linux distro just builds with the default config. The bug is that our default config is broken.
Reporter | ||
Comment 16•3 years ago
|
||
(In reply to John Bieling (:TbSync) from comment #8)
Are you able to report to the repository maintainer, that they have a broken version of TB91? Probably related to what the slackware people run into (mentioned in the link in Comment #5)
That would help others a lot.
Sorry I haven't been keeping up. I noticed the last comment from Ben. Should I still try to report it to the repository maintainer?
Comment 17•3 years ago
|
||
Sorry I haven't been keeping up. I noticed the last comment from Ben. Should I still try to report it to the repository maintainer?
Yes, that would still be needed. As Ben discovered, the default config currently builds a broken Thunderbird and as long as that is not fixed, Linux maintainers of the Thunderbird package need to be aware of that.
Comment 18•3 years ago
|
||
We shouldn't put the burden on every single Linux maintainer (and everybody who builds TB from source himself), if we can fix it on our end.
We can simply fix our build script to set the right config. Given that disabling signing verification is the only config that works, this should be set automatically in TB's configure script.
Assignee | ||
Comment 19•3 years ago
|
||
(In reply to Ben Bucksch (:BenB) from comment #18)
We shouldn't put the burden on every single Linux maintainer (and everybody who builds TB from source himself), if we can fix it on our end.
We can simply fix our build script to set the right config. Given that disabling signing verification is the only config that works, this should be set automatically in TB's configure script.
I don't disagree with you. I tried forcing the setting in a few places, but the Firefox default is pretty sticky.
Comment 20•3 years ago
•
|
||
Ah, so it's just a matter of finding the right place to set it. Thanks for the update. If anybody has a patch, please attach it.
Assignee | ||
Updated•3 years ago
|
Assignee | ||
Comment 21•3 years ago
|
||
imply_option apparently can be used to override config options that do not
have a --enable/disable flag and are set (for Firefox) only via build time
environment variables.
This will effectively disable addon signing for all Thunderbird builds
regardless of MOZ_REQUIRE_SIGNING's presence or value.
Testing on Daily is not too useful, beta or release versions should be tested
thoroughly.
Updated•3 years ago
|
Assignee | ||
Updated•3 years ago
|
Comment 22•3 years ago
|
||
Pushed by thunderbird@calypsoblue.org:
https://hg.mozilla.org/comm-central/rev/56c3c3a87360
Never require that addons are signed for Thunderbird. r=john.bieling
Assignee | ||
Comment 23•3 years ago
|
||
Comment on attachment 9239191 [details]
Bug 1727113 - Never require that addons are signed for Thunderbird.
[Approval Request Comment]
Regression caused by (bug #): 1712643
User impact if declined: Linux distributions may inadvertently be requiring addons be signed
Testing completed (on c-c, etc.): this can only be tested on beta and release. propose that we test on 93b1 next week and uplift to 91.1.1
Risk to taking this patch (and alternatives if risky): Worst case scenario it doesn't work or messes up signing requirements even more. Fortunately it's easy to test on beta and can be backed out if needed. I'm not too worried about that. Local builds with this applied to comm-esr91 worked fine.
Assignee | ||
Updated•3 years ago
|
Comment 24•3 years ago
|
||
Thank you, Rob!
Updated•3 years ago
|
Comment 25•3 years ago
|
||
Comment on attachment 9239191 [details]
Bug 1727113 - Never require that addons are signed for Thunderbird.
[Triage Comment]
Approved for esr91
Assignee | ||
Comment 26•3 years ago
|
||
bugherder uplift |
Thunderbird 91.1.1:
https://hg.mozilla.org/releases/comm-esr91/rev/a2820bbe6e93
Description
•