Closed Bug 1727113 Opened 3 years ago Closed 3 years ago

Thunderbird 91 tries to verify add-ons (which it should not) and aborts add-on installations and disables all installed add-ons

Categories

(Thunderbird :: Add-Ons: General, defect)

Product:
Thunderbird
Component:
Add-Ons: General
Version:
Thunderbird 91
Type:
defect

Tracking

(thunderbird_esr91+ fixed, thunderbird92 wontfix)

Status:
RESOLVED FIXED
Milestone:
93 Branch
Tracking Flags:
Tracking Status
thunderbird_esr91 + fixed
thunderbird92 --- wontfix

People

(Reporter: tryderjr, Assigned: rjl)

References

(Blocks 1 open bug)

Details

(Whiteboard: [TM: 91.1.1])

Attachments

(1 file)

Bug 1727113 - Never require that addons are signed for Thunderbird.
48 bytes, text/x-phabricator-request
wsmwk
: approval-comm-esr91+
Details | Review

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0

Steps to reproduce:

Tried to install addon: Addon Compatibility Check for TB 91 or Dark Reader

Actual results:

Message popped up saying Thunderbird has prevented this site from installing an unverified addon

Expected results:

Install the addon. The addons should be compatible with TB 91 and other users seem to have no issues.

Thunderbird has prevented this site from installing an unverified addon.

That is a strange issue we have seen lately. Could you answer the following questions:

  • Which operating system are you using? Windows, Mac, or Linux? Which version? If Linux, which distribution do you use?

  • Could you please go to Thunderbird hamburger menu -> Preferences -> General, scroll to the very bottom, click on the Config editor button, search for signature and tell us which value the setting xpinstall.signatures.required has? Is it true or false? Is it bold or not bold?

  • How did you install Thunderbird 91? Did you manually download it from https://thunderbird.net ? Or has your installation been updated automatically? If so, by which method (for example by a 3rd party updater like Advanced System Care for Windows, or by the package manager of your Linux distribution)?

  • If you download Thunderbird 91 directly from https://thunderbird.net and use that version, does the error remain?

Summary: TB says Addon is incompatible even if addon is compatible with 91 → Thunderbird 91 tries to verify add-on upon installation (which it should not) and aborts
Summary: Thunderbird 91 tries to verify add-on upon installation (which it should not) and aborts → Thunderbird 91 tries to verify add-on (which it should not) and aborts add-on installations and disables all installed add-ons
Summary: Thunderbird 91 tries to verify add-on (which it should not) and aborts add-on installations and disables all installed add-ons → Thunderbird 91 tries to verify add-ons (which it should not) and aborts add-on installations and disables all installed add-ons

I'm on an Arch-based Linux distribution (Garuda). My installation is from the AUR I believe.
The xpinstall.... is false and it is not bold.
I'll try downloading from Thunderbird.net and give it a shot.

(In reply to John Bieling (:TbSync) from comment #1)

Thunderbird has prevented this site from installing an unverified addon.

That is a strange issue we have seen lately. Could you answer the following questions:

  • Which operating system are you using? Windows, Mac, or Linux? Which version? If Linux, which distribution do you use?

  • Could you please go to Thunderbird hamburger menu -> Preferences -> General, scroll to the very bottom, click on the Config editor button, search for signature and tell us which value the setting xpinstall.signatures.required has? Is it true or false? Is it bold or not bold?

  • How did you install Thunderbird 91? Did you manually download it from https://thunderbird.net ? Or has your installation been updated automatically? If so, by which method (for example by a 3rd party updater like Advanced System Care for Windows, or by the package manager of your Linux distribution)?

  • If you download Thunderbird 91 directly from https://thunderbird.net and use that version, does the error remain?

With the version downloaded directly from the site, the message "downloading and verifying addon" stays up but it won't go away or actually download the extension.

(In reply to Ryder from comment #2)

I'm on an Arch-based Linux distribution (Garuda). My installation is from the AUR I believe.
The xpinstall.... is false and it is not bold.
I'll try downloading from Thunderbird.net and give it a shot.

Ah also it was actually from the chaotic-aur.

We have confirmation from the slackware community, that the so far reported issues (all from slackware) were due to an issue with their built and it has been fixed:
https://www.linuxquestions.org/questions/slackware-14/thunderbird-91-addons-4175699223/page2.html#post6277449

Are you 100% sure, that you run the version downloaded from thunderbird.net in your second test?

Ah, I just saw that you reported a different error for the second test. Did you skip the account creation wizzard? Could you actually set up an account?

(In reply to John Bieling (:TbSync) from comment #6)

Ah, I just saw that you reported a different error for the second test. Did you skip the account creation wizzard? Could you actually set up an account?

I did skip the account creation. That might have something to do with it!
Hey what do you know that was it, after account creation thunderbird.net install worked.

Are you able to report to the repository maintainer, that they have a broken version of TB91? Probably related to what the slackware people run into (mentioned in the link in Comment #5)

That would help others a lot.

(In reply to Ryder from comment #7)

I did skip the account creation. ... after account creation thunderbird.net install worked.

Ryder, I'm confused. Are you saying that addon installation fails until you configure a mail account in Thunderbird? (This issue is about addon install failing. I'm puzzled how account creation is relevant to that.)

From https://www.linuxquestions.org/questions/slackware-14/thunderbird-91-addons-4175699223/page2.html#post6277399

export MOZ_REQUIRE_SIGNING=

If signed Thunderbird addons don't even exist, then it seems like a trap to have a configure option - at compile time! - that enforces signatures for Thunderbird addons. That configure option shouldn't exist. Or at least the Thunderbird build should fail configure when it detects that this setting is set.

(In reply to Ben Bucksch (:BenB) from comment #9)

(In reply to Ryder from comment #7)

I did skip the account creation. ... after account creation thunderbird.net install worked.

Ryder, I'm confused. Are you saying that addon installation fails until you configure a mail account in Thunderbird? (This issue is about addon install failing. I'm puzzled how account creation is relevant to that.)

Ben, he did what I asked him and he reported what happend and yes he run into another bug I have seen before but which is not yet reported as a bugzilla bug.

Rob: Do we have the power to fix this? I think it boils down to Thunderbird being broken if build without

export MOZ_REQUIRE_SIGNING=

Can we define a default empty value for MOZ_REQUIRE_SIGNING?

Flags: needinfo?(rob)

The only way to override default, which is signing is enabled (we inherit from Firefox) is to set the empty value in mozconfig.

Flags: needinfo?(rob)

So, you're saying that the default is broken. Is that correct?

@rob, could this value be set in the configure build script as we need it (to empty value)? And the script could also enforce the right value.

I can confirm that the default is broken.

Environment:

  • In my case: Linux

Reproduction:

Actual result:
Error console shows:

1630093503729	addons.xpi-utils	WARN	Add-on addon@example.com is not correctly signed. 2
1630093503729	addons.xpi-utils	WARN	addMetadata: Add-on addon@example.com is invalid: Error:
Extension addon@example.com is not correctly signed
(resource://gre/modules/addons/XPIDatabase.jsm:2839:15)
JS Stack trace: addMetadata@XPIDatabase.jsm:2839:15
processFileChanges@XPIDatabase.jsm:3292:26
checkForChanges@XPIProvider.jsm:3020:55
startup@XPIProvider.jsm:2471:12
callProvider@AddonManager.jsm:230:31
_startProvider@AddonManager.jsm:590:17
startup@AddonManager.jsm:814:14
startup@AddonManager.jsm:3511:26
observe@addonManager.js:81:29

Expected result:
Addons install and work

Importance:
This affects everybody who builds from source.
So, this is actually our bug, not a bug of the Linux distribution. The Linux distro just builds with the default config. The bug is that our default config is broken.

Assignee: nobody → rob
Severity: -- → S2
Status: UNCONFIRMED → NEW
Ever confirmed: true

(In reply to John Bieling (:TbSync) from comment #8)

Are you able to report to the repository maintainer, that they have a broken version of TB91? Probably related to what the slackware people run into (mentioned in the link in Comment #5)

That would help others a lot.

Sorry I haven't been keeping up. I noticed the last comment from Ben. Should I still try to report it to the repository maintainer?

Sorry I haven't been keeping up. I noticed the last comment from Ben. Should I still try to report it to the repository maintainer?

Yes, that would still be needed. As Ben discovered, the default config currently builds a broken Thunderbird and as long as that is not fixed, Linux maintainers of the Thunderbird package need to be aware of that.

We shouldn't put the burden on every single Linux maintainer (and everybody who builds TB from source himself), if we can fix it on our end.

We can simply fix our build script to set the right config. Given that disabling signing verification is the only config that works, this should be set automatically in TB's configure script.

Flags: needinfo?(rob)

(In reply to Ben Bucksch (:BenB) from comment #18)

We shouldn't put the burden on every single Linux maintainer (and everybody who builds TB from source himself), if we can fix it on our end.

We can simply fix our build script to set the right config. Given that disabling signing verification is the only config that works, this should be set automatically in TB's configure script.

I don't disagree with you. I tried forcing the setting in a few places, but the Firefox default is pretty sticky.

Flags: needinfo?(rob)

Ah, so it's just a matter of finding the right place to set it. Thanks for the update. If anybody has a patch, please attach it.

Blocks: tb-linuxdistro

imply_option apparently can be used to override config options that do not
have a --enable/disable flag and are set (for Firefox) only via build time
environment variables.

This will effectively disable addon signing for all Thunderbird builds
regardless of MOZ_REQUIRE_SIGNING's presence or value.

Testing on Daily is not too useful, beta or release versions should be tested
thoroughly.

Attachment #9239191 - Attachment description: Bug 1727113 - Never require that addons are signed for Thunderbird. r=benb → Bug 1727113 - Never require that addons are signed for Thunderbird.
Blocks: tb91found
status-thunderbird92: --- → wontfix
status-thunderbird_esr91: --- → affected
Target Milestone: --- → 93 Branch

Pushed by thunderbird@calypsoblue.org:
https://hg.mozilla.org/comm-central/rev/56c3c3a87360
Never require that addons are signed for Thunderbird. r=john.bieling

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED

Comment on attachment 9239191 [details]
Bug 1727113 - Never require that addons are signed for Thunderbird.

[Approval Request Comment]
Regression caused by (bug #): 1712643
User impact if declined: Linux distributions may inadvertently be requiring addons be signed
Testing completed (on c-c, etc.): this can only be tested on beta and release. propose that we test on 93b1 next week and uplift to 91.1.1
Risk to taking this patch (and alternatives if risky): Worst case scenario it doesn't work or messes up signing requirements even more. Fortunately it's easy to test on beta and can be backed out if needed. I'm not too worried about that. Local builds with this applied to comm-esr91 worked fine.

Attachment #9239191 - Flags: approval-comm-esr91?
Whiteboard: [TM: 91.1.1]

Thank you, Rob!

Comment on attachment 9239191 [details]
Bug 1727113 - Never require that addons are signed for Thunderbird.

[Triage Comment]
Approved for esr91

Attachment #9239191 - Flags: approval-comm-esr91? → approval-comm-esr91+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: