231969 - Crash on install of signed xpi when local certificate not present

Status: RESOLVED WORKSFORME

(Core Graveyard :: Installer: XPInstall Engine, defect)

Description

[jpowers]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040120 Firebird/0.7+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040120 Firebird/0.7+

Created a signed xpi, using bug #178687 as guide.

When installing xpi on a computer that doesn't have access to the original
certificate, browser crashes.  Occurs in both Firebird 20040120 and Mozilla 1.6
(20040113).

Installing xpi on computer with access to the certificate (on secure network
share) reports as signed, installs fine, no crash.

If xpi is not created with file 'META-INF\zigbert.rsa' as first item in archive,
installs fine but reports as unsigned.

Reproducible: Always

Steps to Reproduce:
1. Create a signed xpi, with 'META-INF\zigbert.rsa' as first file in archive
(see bug #178687).
2. Open browser, file->open the xpi on a computer that doesn't know anything
about the certificate the xpi was signed with.
3. Crash!
Actual Results:  
See Step 3.

Expected Results:  
Report the xpi as signed with the certificate, possibly warning that certificate
is unknown.  Then install properly.

Comment 1

[jpowers]

Expected Results addendum:

Netscape 7.1 will replace 'unsigned' in xpi install dialog with the certificate
name, but still gives warning about untrusted sources.  Does not crash.

Comment 2

[Travis Chase]

*** Bug 234910 has been marked as a duplicate of this bug. ***

Comment 3

[Robert Kaiser]

*** This bug has been marked as a duplicate of 234910 ***

Comment 4

[Dan M]

Thank you Robert for swapping the duplication order; closing that other bug,
which clearly points out the exact problem in the code, as a duplicate of this
one, which merely reports the problem, was pretty careless of Travis.

That said, the relationship between these two bugs is pretty minimal.
234910: install xpi. no crash. exit mozilla. crash. no mention of
        certificates. if Travis had looked more closely he'd have
        noticed this crash was introduced in builds after 20040211.
231969: install signed xpi under special circumstances, browser crashes
        [implication: immediately]. in fact it specifically states there is
        no crash after installing an unsigned xpi. also notice the crash
        happens in builds which predate the beginning of the 234910 crash.
These are totally different bugs. Reopening.

Comment 5

[jpowers]

This appears fixed.

Firefox 20040213 and later works (no crash), new install dialog, reports as signed.
(Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040213
Firefox/0.8)


Firebird 20040210 works, old xpi install dialog, reports as signed.
(Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040210
Firebird/0.8.0+)


Firefox 0.8 release (20040210) has the new dialog, but crashes (before dialog
appears).


Bug 234910 is showing up for me in the recent builds, while this one is not.  So
not a dupe.