Alternatives to the Chrome Web Store

[jonatan-holmgren]

Hi! As we all know CWS will stop serving up MV2 extensions such as uBO after Aug 31st, so I have been hacking away at https://browserextension.org for the past few days and I'm interested in how y'all feels about it. Chromium is quite hostile towards non-CWS-addons at the moment but many Chromium forks such as Ungoogled handle these like a charm.

Most extension marketplaces sign the extensions themselves for browsers to run them but this requires unnecessary trust for the marketplace because they can ship malicious updates indistinguishable from the real thing. To avoid this I simply let the developer sign the extension itself. I am actually using the signature of the extension itself for auth for the upload endpoint for new versions, so pushing uBlock there would be as simple as

  curl --fail-with-body \
    -X POST "https://www.browserextension.org/api/extensions/EXTENSION_ID/versions" \
    -F "package=@/absolute/path/to/extension.crx;type=application/x-chrome-extension" \

in the publish-extension submodule repo.

Having explained how all of this works, is this something that is interesting to you guys? In order for me to not have the keys (and therefore not to be able to push my own updates to uBlock), which is my desired outcome, Raymond would need to maintain his own privkey for the extension and have yet another thing in his makefile. If this is unacceptable I can just sign the updates myself but that requires at least some trust in me. I did take the liberty of signing uBlock myself and putting it there (https://www.browserextension.org/extensions/ldhjekilbdlielnfkiojdakjmceaidld) for now, just for the demo.

Any comment on my proposal would be very helpful. Thanks!

[krystian3w]

It would be useful to have a list of which mainstream browsers this will work with and which smaller chromium forks ones are also supported.

Perhaps/Maybe Opera will surprise us and support more browsers in its store (they have or had an agreement with Yandex, so why not with Brave).

[jonatan-holmgren]

Sure! It's a bit of a "chicken and the egg" problem here, to be frank. I have made a similar issue on LocalCDN asking them to publish on such a marketplace. Ungoogled Chromium derivatives like Helium work fine but Brave does not. Maybe they will add support like Ungoogled? Time will tell.

There really aren't that many extensions that only do MV2 like uBlock these days, which of course makes browsers still supporting MV2 few and far between.

[gorhill]

Ok I will publish self-signed CRX packages for chromium, I will need to change the publish scripts for chromium, I will do this as time allow in the coming weeks.

[jonatan-holmgren]

Awesome! Could you also please sign a CRX with the update_url https://www.browserextension.org/api/extensions/YOUR_EXTENSION_ID/update.xml where YOUR_EXTENSION_ID is the CRX' package id? (you can get the extension id from the pem with openssl pkey -in uBlock0.chromium.pem -pubout -outform DER | sha256sum | cut -c1-32 | tr 0123456789abcdef abcdefghijklmnop for example)?

[gorhill]

I was thinking to host and update on GitHub though, just as is done for Firefox's dev build.

[jonatan-holmgren]

Fair! I think you can actually just host an update.xml on GitHub Pages or something and keep updating that pointing to your GitHub releases.

Would be nice if you could sign one with my update_url too (not mutually exclusive) if you feel like it but no hard feelings if you won't :)

[gorhill]

Thanks for the guidance.

A crx packaged is being published with latest dev build of uBO: https://github.com/gorhill/uBlock/blob/master/dist/chromium/update-dev.xml

if you could sign one with my update_url too

I prefer to publish the official package on GitHub only. If I were to have it hosted somewhere else, I would have to revisit the privacy policy to account for this and I prefer to avoid this.

[jonatan-holmgren]

Thank you anyways!

[krystian3w]

And a separate ZIP file for the last 23 days in the Chrome Web Store for Chromium 109–149 (unless it’s now the case that only zero-day vulnerabilities in the extension can be patched, and they’re rejecting the signing of other changes)?

[gorhill]

There will always be a zip.