Provide signed releases for Firefox

[neclimdul]

Just putting this on the radar. Future versions of Firefox will require signed extensions.

https://wiki.mozilla.org/Addons/Extension_Signing

[bkonetzny]

Latest release of Firefox Nightly already disabled dreditor and doesn't allow activation / installation of this extension. Official help for this change in Firefox: https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox

[neclimdul]

Thanks for the update!

According to the release calendar, 42 which has this change is scheduled to beta next month and release in November so time is getting short. I don't have it installed but since Developer Edition is "Aurora" it is probably already broken or will break as well in September.

[davidbarratt]

Just installed FireFox Developer Edition 42.0a2 (2015-08-21) and I can't install dreditor at all. :(

[davidbarratt]

Looks like a project maintainer needs to submit the add on here: https://addons.mozilla.org/en-US/developers/addon/submit/1

[markhalliwell]

I have actually already gone down the path of a.m.o a couple of times now. The Dreditor extension is technically listed at: https://addons.mozilla.org/en-US/firefox/addon/dreditor/. This link, however, is not currently accessible to non-developers because a.m.o has rejected the project's code base/releases.

Basically what it boils down to is a host of issues that need to change in Dreditor before it can be resubmitted to a.m.o: #129, #130, #155, #156, #215

I do not see this happening anytime soon unless people want to start helping tackle the above issues first (I can't do this all on my own, just don't have the time).

[davidbarratt]

@markcarver,

Thanks for the update!

[markhalliwell]

Also #262

[manuee]

Just a heads up that on the latest Firefox release 43.0, the extension will not be allowed to install. Also, upon update the extension gets disabled.

[longwave]

Just run into this after upgrading to Firefox 43. You can still use Dreditor by going to about:config and changing "xpinstall.signatures.required" to false.

[iant-ee]

I think the review policy may have changed since this was postponed, see https://developer.mozilla.org/en-US/Add-ons/AMO/Policy/Reviews

Specifically, "Include their own update mechanism" and "Use unvetted third-party code libraries or frameworks" which are what the issues above are about. These are only required if you want the add on to be listed on addons.mozilla.org. You can still get the addon signed without meeting these requirements.

(both of which are sensible for listed add ons BTW, the libraries thing is because you could slip malicious code into a "3rd party library" that didn't get reviewed properly).

[davidbarratt]

@markcarver,

In light of that information, could you try and submitting it again?

[markhalliwell]

Short answer: no.

Not if we ever want it to be listed again (which is a door I don't wish to close just yet). The above issues aren't as cut and dry as people may think. AMO has some really stringent requirements. If people really want this back, I would appreciate the help in fixing the code so we can just list it there and make everyone's life easier.

[iant-ee]

That's due to technical limitations, rather than a policy. Quote from https://developer.mozilla.org/en-US/Add-ons/Distribution

"You should make this decision carefully, as it isn't easy to switch between Listed and Unlisted at present. Due to some platform limitations, in order to make the switch you'll need to delete your add-on entry and then contact the AMO Admins list in order to enable your add-on ID so you can submit it again. You should also know that if you switch from Listed to Unlisted, your current users won't be automatically migrated to the unlisted versions of your add-on. Switching from Unlisted to Listed is easier because Firefox will check for updates on AMO if an add-on doesn't have an updateURL in its install manifest."

Obviously getting the bugs fixed would be better, but this would at least make dreditor usable in the current release of Firefox without needing to mess about with about:config.

As of Firefox 44 (six weeks from now) it will not be possible to run dreditor at all in Beta/Release versions of Firefox. https://wiki.mozilla.org/Addons/Extension_Signing (see timeline section)

[markhalliwell]

We barely have the time to deal with normal issues that come through here, I don't think that making the decision to mark Dreditor on AMO as unlisted just for the "benefit" of this issue is the right decision.

Having to go through that process in the future once we actually decide to list it again is going to be painful and time consuming, neither of which I care to do. I would love to not have this issue in the first place, but was inevitable given how it was originally created as a user-script. The above issues are about really just about finishing the "user-script -> real browser extension" aspect of the code.

I will say this again, one last time in a different more direct way: if we wish to keep FF support, then the above issues need to be fixed. Period.

[markhalliwell]

Also, the reason I don't have time to address the above issues right now is because of client work & https://www.drupal.org/node/2609316

[killua99]

Well, I'm using the about:config fix mention at https://github.com/unicorn-fail/dreditor/issues/256#issuecomment-165084213

I wish have more time to help with those issues.

[jstoller]

I understand it's going to take some time to get this back up and running on Firefox, but in the mean time, could you post a notice on dreditor.org that explains the problem and maybe links to this issue? I know it would have saved me some significant frustration. Right now that page still indicates that Dreditor is compatible with Firefox—which is not true, strictly speaking—and offers to install the add-on (an install that always fails).

[ryan-jacobs]

I just wanted to second jstoller's comment about placing a notice on https://dreditor.org/ that states this is a known/pending issues. Such a notice could likely point people here as well, or to whatever canonical location can best solicit the right support. This may help avoid some confusion and focus efforts in the right place.

[markhalliwell]

Done - I've placed a notice on the homepage.

[rocketeerbkw]

A small update from Mozilla about this yesterday https://blog.mozilla.org/addons/2016/01/22/add-on-signing-update/.

The about:config override to allow unsigned extensions won't be removed until FF 46 which is slated to release in April.

[hansfn]

After upgrading to FF 45, the extension was automatically disabled (even if I had the about:config override in place.) I had to reinstall the extension to get it working again.

[killua99]

I don't know the state of this list. https://github.com/unicorn-fail/dreditor/labels/firefox but just in case, could we review those tasks to work on it.

[verasativa]

While this issue is fixed, for the users who want to install it on FF45, this is the procedure:

1. open a firefox tab to about:config
2. find the value xpinstall.signatures.required
3. Double click it to change from true to false
4. Go to https://dreditor.org/ and install from big green install button

ps: I suggest to website admin pointing the current link to this issue in the home, to this specific comment anchor for extra user friendliness ;)

[dwaghmare]

@nahueldotme ++

[deviantintegral]

nahueldotme's instructions are working fine for me in Firefox 49 which is currently in the aurora channel. I remember reading that the signing requirement config was going to be kept in Firefox developer edition, so that might continue to be a good workaround for now.

[larowlan]

FYI the about:config fix no longer works in FF 48

[markhalliwell]

Dreditor is being decommissioned due to the lack of availability of current maintainers and the fact that Drupal.org is becoming more feature rich at a much faster rate than Dreditor itself now.

This decision was also partially made due to the amount of work (complete rewrite) it would take to create an "official" Firefox extension (#256).

If you already have the extension installed, it should continue working for a while until, inevitably, the markup on Drupal.org changes. It will no longer be updated.

We understand that many of you love this extension, as do we. This isn't the end, in fact, it's a much brighter beginning. All the things we love about Dreditor can, and should, be moved into Drupal.org natively.

For more information, please follow: https://www.drupal.org/node/2779729

[valthebald]

Hello @markcarver, this is Val from the core mentoring initiative. First of all, thank you for your continuous support and passion, I, among many others, is a big dreditor fan. I see that there is a meta issue on d.o. to move all dreditor features to d.o. itself. This is a great thing when (if) it happens. Unfortunately, I don't see it happen before DrupalCon Dublin (correct me if I'm wrong). Dreditor was (and is) an important tool that we recommend to the new contributors as part of mentored sprints, so I wonder if there is a chance to prolong the site's life until the end of September 2016. If there are any issues with the hosting, I can offer a VM at Hetzner for this period (or longer). Just in case, for FF lovers who want the extension, trick to allow the installation is easy:

1. Go to about:config
2. Set xpinstall.signatures.required to false Hope this can help someone

Best regards, Valery

[chx]

If hosting is required and a VM doesn't suffice just give me a Dockerfile and I will put it on a beefy server (also Hetzner).

[neclimdul]

@valthebald Hosting isn't really the problem I don't think. The Firefox fix has been mentioned half a dozen times on the issue but also the fact that it was removed in the Aug 2 Firefox 48 release as noted just 2 comment above. If its working for you you're very lucky but I wouldn't expect it to work for you sprinters.

https://wiki.mozilla.org/Addons/Extension_Signing

[joachim-n]

The xpinstall.signatures.required technique appears to have stopped working as of Firefox 48.

[andypost]

Another workaround is http://www.ghacks.net/2016/08/14/override-firefox-add-on-signing-requirement/

[MacWeber]

Debian Linux solution, tested on Firefox 49:

Create the file /opt/firefox/defaults/pref/config-prefs.js:

//
pref("general.config.obscure_value", 0);
pref("general.config.filename", "config.js");

Making sure you have the first comment line // and also the 'new line' at the end of the file!

Create the file /opt/firefox/config.js:

//
try {
    Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {})
        .eval("SIGNED_TYPES.clear()");
}
catch(ex) {}

Again, make sure you have the first comment line // and also the 'new line' at the end of the file!

Restart Firefox and now you can install unsigned add-ons, such as Dreditor.