378730 - Signing Lightning XPI

Status: RESOLVED WONTFIX

(Calendar :: Build Config, enhancement)

Description

[Daniel Boelzle [:dbo]]

A good start is <https://www.mozdevgroup.com/docs/pete/Signing-an-XPI.html>.

Comment 1

[Philipp Kewisch [:Fallen][📱📆]]

Gozer, any ideas on this?

Comment 2

[Philippe M. Chiasson (:gozer)]

Well, you'll need a code signing certificate, and automating the signing is possible, but has security implications.

Why is this wanted, exactly? Are we talking about releases or nightly builds?

Comment 3

[Philipp Kewisch [:Fallen][📱📆]]

I'm not sure, its probably enough to do so for the release builds...other opinions?

I guess the reason for this is ... "because we can" :-) And maybe to get rid of the unsigned dialog and give people a better feeling when installing lightning.

Comment 4

[Philippe M. Chiasson (:gozer)]

(In reply to comment #3)
> I'm not sure, its probably enough to do so for the release builds...other
> opinions?

Not really, anything like signing nightly builds would require automated, unnatended code-signing, and that's hard. Securely signing release builds, that can involve a bit of manual work, and that's easy, so good!

> I guess the reason for this is ... "because we can" :-) And maybe to get rid of
> the unsigned dialog and give people a better feeling when installing lightning.

Yes, it's certainly possible, but I am not 100% certain where responsability for signing these would lie. 

Once I've got all the bits and pieces in place to sign the Thunderbird releases, I could probably better tell you how easy/realistic it could be for Mozilla Messaging to be signing the Lightning XPIs.

Comment 5

[Philipp Kewisch [:Fallen][📱📆]]

(In reply to comment #4)
> Once I've got all the bits and pieces in place to sign the Thunderbird
> releases, I could probably better tell you how easy/realistic it could be for
> Mozilla Messaging to be signing the Lightning XPIs.

Sounds good. Is there a bug on that we could set dependency with?

Comment 6

[Philipp Kewisch [:Fallen][📱📆]]

Mark, what are the odds that this can happen for future releases? We'd have to either use the Thunderbird signing certs, or have our own certificates.

Comment 7

[Mark Banner (:standard8)]

Doesn't amo effectively sign your packages? AFAIK users are not currently prompted because Lightning isn't signed. I can't at see a real use for this at the moment...

Comment 8

[Philipp Kewisch [:Fallen][📱📆]]

(In reply to comment #7)
> https://bugzilla.mozilla.org/show_bug.cgi?id=378730#c7
> Doesn't amo effectively sign your packages? AFAIK users are not currently
> prompted because Lightning isn't signed. I can't at see a real use for this at
> the moment...
They don't do real xpi signing. The user is not prompted with an extra dialog, but it does say "Author not verified" when installing Lightning.

Comment 9

[Stefan Sitter [:ssitter]]

Doesn't addons.mozilla.org repackage the xpi files, e.g. if one changes the supported application version? What would happen to a signed xpi in that case?

And what about signing the binary components during build/release as requested in another bug?

Comment 10

[Martin Schröder [:mschroeder]]

From Thunderbird 74 onwards Lightning does not exist as a separate add-on but is integrated into Thunderbird.