Sign addon

[zuphilip]

For using scaffold in soon coming versions of firefox, it would be good if we can sign the addon. Or are there any other real alternatives?

[aurimasv]

Yes, we're probably going to have to do it at some point for general translator contributors. For those of us who run Zotero/Scaffold from source, however, the only viable alternative is unbranded Firefox, which does not require signing. On Aug 31, 2015 2:32 PM, "Philipp Zumstein" notifications@github.com wrote:

For using scaffold in soon coming versions of firefox, it would be good if we can sign the addon. Or are there any other real alternatives?

— Reply to this email directly or view it on GitHub https://github.com/zotero/scaffold/issues/24.

[dstillman]

It would be preferable to avoid this. I'm inclined to say that someone who knows enough to use Scaffold in the first place should just run the unbranded build or Firefox Developer Edition (which will be allowing unsigned extensions automatically).

[zuphilip]

Yeah, maybe we can see this better when the strict signing rules from mozilla are present. AFAIK the unbranded builds do not yet exist. I tried today the Firefox Developer Edition, which is currently version 43.0a2. The Zotero translators are not working with that version and I guess for troubleshooting etc. it makes much more sense to develop the translators based on the current stable firefox release. Thus, I switched again to another profile within my normal firefox which will work for the moment. Once the unbranded builds exists, we should give the users some hints, how they can run the software (in the README.md, INSTALL.md or the wiki).

[dstillman]

So based on the zotero-dev discussion, we'll plan to sign these through the Zotero AMO account, but leave actual release management to the maintainers:

maintainers would need to tag a release and then open a ticket and tag one of us, we'd run a script to build the XPI and submit it to the Mozilla signing API, we'd upload the signed API to S3 and post the download link to the ticket, and maintainers would update the manifest with the download link and hash and then close the ticket. If we were going to do these under our account, I'd want to make sure the code always passed the validators with no issues to reduce the chance of having to deal with reviews.

[dstillman]

Currently blocked on https://github.com/zotero/scaffold/issues/11#issuecomment-163523854

[dstillman]

Signed and released

[zuphilip]

@dstillman Thank you very much! It works perfectly! :santa: