New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide signed releases for Firefox #256

Closed
neclimdul opened this Issue May 30, 2015 · 33 comments

Comments

Projects
None yet
@neclimdul

neclimdul commented May 30, 2015

Just putting this on the radar. Future versions of Firefox will require signed extensions.

https://wiki.mozilla.org/Addons/Extension_Signing

@bkonetzny

This comment has been minimized.

Show comment
Hide comment
@bkonetzny

bkonetzny Aug 12, 2015

Latest release of Firefox Nightly already disabled dreditor and doesn't allow activation / installation of this extension. Official help for this change in Firefox: https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox

bkonetzny commented Aug 12, 2015

Latest release of Firefox Nightly already disabled dreditor and doesn't allow activation / installation of this extension. Official help for this change in Firefox: https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox

@neclimdul

This comment has been minimized.

Show comment
Hide comment
@neclimdul

neclimdul Aug 12, 2015

Thanks for the update!

According to the release calendar, 42 which has this change is scheduled to beta next month and release in November so time is getting short. I don't have it installed but since Developer Edition is "Aurora" it is probably already broken or will break as well in September.

neclimdul commented Aug 12, 2015

Thanks for the update!

According to the release calendar, 42 which has this change is scheduled to beta next month and release in November so time is getting short. I don't have it installed but since Developer Edition is "Aurora" it is probably already broken or will break as well in September.

@davidbarratt

This comment has been minimized.

Show comment
Hide comment
@davidbarratt

davidbarratt Aug 21, 2015

Just installed FireFox Developer Edition 42.0a2 (2015-08-21) and I can't install dreditor at all. :(

davidbarratt commented Aug 21, 2015

Just installed FireFox Developer Edition 42.0a2 (2015-08-21) and I can't install dreditor at all. :(

@davidbarratt

This comment has been minimized.

Show comment
Hide comment
@davidbarratt

davidbarratt Aug 21, 2015

Looks like a project maintainer needs to submit the add on here:
https://addons.mozilla.org/en-US/developers/addon/submit/1

davidbarratt commented Aug 21, 2015

Looks like a project maintainer needs to submit the add on here:
https://addons.mozilla.org/en-US/developers/addon/submit/1

@markcarver

This comment has been minimized.

Show comment
Hide comment
@markcarver

markcarver Aug 21, 2015

Member

I have actually already gone down the path of a.m.o a couple of times now. The Dreditor extension is technically listed at: https://addons.mozilla.org/en-US/firefox/addon/dreditor/. This link, however, is not currently accessible to non-developers because a.m.o has rejected the project's code base/releases.

Basically what it boils down to is a host of issues that need to change in Dreditor before it can be resubmitted to a.m.o: #129, #130, #155, #156, #215

I do not see this happening anytime soon unless people want to start helping tackle the above issues first (I can't do this all on my own, just don't have the time).

Member

markcarver commented Aug 21, 2015

I have actually already gone down the path of a.m.o a couple of times now. The Dreditor extension is technically listed at: https://addons.mozilla.org/en-US/firefox/addon/dreditor/. This link, however, is not currently accessible to non-developers because a.m.o has rejected the project's code base/releases.

Basically what it boils down to is a host of issues that need to change in Dreditor before it can be resubmitted to a.m.o: #129, #130, #155, #156, #215

I do not see this happening anytime soon unless people want to start helping tackle the above issues first (I can't do this all on my own, just don't have the time).

@davidbarratt

This comment has been minimized.

Show comment
Hide comment
@davidbarratt

davidbarratt Aug 21, 2015

@markcarver,

Thanks for the update!

davidbarratt commented Aug 21, 2015

@markcarver,

Thanks for the update!

@markcarver

This comment has been minimized.

Show comment
Hide comment
@markcarver
Member

markcarver commented Aug 21, 2015

Also #262

@Cottser Cottser changed the title from Provide signed releases to Provide signed releases for Firefox Oct 19, 2015

@manuee

This comment has been minimized.

Show comment
Hide comment
@manuee

manuee Dec 16, 2015

Just a heads up that on the latest Firefox release 43.0, the extension will not be allowed to install. Also, upon update the extension gets disabled.

manuee commented Dec 16, 2015

Just a heads up that on the latest Firefox release 43.0, the extension will not be allowed to install. Also, upon update the extension gets disabled.

@longwave

This comment has been minimized.

Show comment
Hide comment
@longwave

longwave Dec 16, 2015

Just run into this after upgrading to Firefox 43. You can still use Dreditor by going to about:config and changing "xpinstall.signatures.required" to false.

longwave commented Dec 16, 2015

Just run into this after upgrading to Firefox 43. You can still use Dreditor by going to about:config and changing "xpinstall.signatures.required" to false.

@iant-ee

This comment has been minimized.

Show comment
Hide comment
@iant-ee

iant-ee Dec 17, 2015

I think the review policy may have changed since this was postponed, see https://developer.mozilla.org/en-US/Add-ons/AMO/Policy/Reviews

Specifically, "Include their own update mechanism" and "Use unvetted third-party code libraries or frameworks" which are what the issues above are about. These are only required if you want the add on to be listed on addons.mozilla.org. You can still get the addon signed without meeting these requirements.

(both of which are sensible for listed add ons BTW, the libraries thing is because you could slip malicious code into a "3rd party library" that didn't get reviewed properly).

iant-ee commented Dec 17, 2015

I think the review policy may have changed since this was postponed, see https://developer.mozilla.org/en-US/Add-ons/AMO/Policy/Reviews

Specifically, "Include their own update mechanism" and "Use unvetted third-party code libraries or frameworks" which are what the issues above are about. These are only required if you want the add on to be listed on addons.mozilla.org. You can still get the addon signed without meeting these requirements.

(both of which are sensible for listed add ons BTW, the libraries thing is because you could slip malicious code into a "3rd party library" that didn't get reviewed properly).

@davidbarratt

This comment has been minimized.

Show comment
Hide comment
@davidbarratt

davidbarratt Dec 17, 2015

@markcarver,

In light of that information, could you try and submitting it again?

davidbarratt commented Dec 17, 2015

@markcarver,

In light of that information, could you try and submitting it again?

@markcarver

This comment has been minimized.

Show comment
Hide comment
@markcarver

markcarver Dec 17, 2015

Member

Short answer: no.

Not if we ever want it to be listed again (which is a door I don't wish to close just yet). The above issues aren't as cut and dry as people may think. AMO has some really stringent requirements. If people really want this back, I would appreciate the help in fixing the code so we can just list it there and make everyone's life easier.

ff-unlisted

Member

markcarver commented Dec 17, 2015

Short answer: no.

Not if we ever want it to be listed again (which is a door I don't wish to close just yet). The above issues aren't as cut and dry as people may think. AMO has some really stringent requirements. If people really want this back, I would appreciate the help in fixing the code so we can just list it there and make everyone's life easier.

ff-unlisted

@iant-ee

This comment has been minimized.

Show comment
Hide comment
@iant-ee

iant-ee Dec 18, 2015

That's due to technical limitations, rather than a policy. Quote from https://developer.mozilla.org/en-US/Add-ons/Distribution

"You should make this decision carefully, as it isn't easy to switch between Listed and Unlisted at present. Due to some platform limitations, in order to make the switch you'll need to delete your add-on entry and then contact the AMO Admins list in order to enable your add-on ID so you can submit it again. You should also know that if you switch from Listed to Unlisted, your current users won't be automatically migrated to the unlisted versions of your add-on. Switching from Unlisted to Listed is easier because Firefox will check for updates on AMO if an add-on doesn't have an updateURL in its install manifest."

Obviously getting the bugs fixed would be better, but this would at least make dreditor usable in the current release of Firefox without needing to mess about with about:config.

As of Firefox 44 (six weeks from now) it will not be possible to run dreditor at all in Beta/Release versions of Firefox. https://wiki.mozilla.org/Addons/Extension_Signing (see timeline section)

iant-ee commented Dec 18, 2015

That's due to technical limitations, rather than a policy. Quote from https://developer.mozilla.org/en-US/Add-ons/Distribution

"You should make this decision carefully, as it isn't easy to switch between Listed and Unlisted at present. Due to some platform limitations, in order to make the switch you'll need to delete your add-on entry and then contact the AMO Admins list in order to enable your add-on ID so you can submit it again. You should also know that if you switch from Listed to Unlisted, your current users won't be automatically migrated to the unlisted versions of your add-on. Switching from Unlisted to Listed is easier because Firefox will check for updates on AMO if an add-on doesn't have an updateURL in its install manifest."

Obviously getting the bugs fixed would be better, but this would at least make dreditor usable in the current release of Firefox without needing to mess about with about:config.

As of Firefox 44 (six weeks from now) it will not be possible to run dreditor at all in Beta/Release versions of Firefox. https://wiki.mozilla.org/Addons/Extension_Signing (see timeline section)

@markcarver

This comment has been minimized.

Show comment
Hide comment
@markcarver

markcarver Dec 18, 2015

Member

We barely have the time to deal with normal issues that come through here, I don't think that making the decision to mark Dreditor on AMO as unlisted just for the "benefit" of this issue is the right decision.

Having to go through that process in the future once we actually decide to list it again is going to be painful and time consuming, neither of which I care to do. I would love to not have this issue in the first place, but was inevitable given how it was originally created as a user-script. The above issues are about really just about finishing the "user-script -> real browser extension" aspect of the code.

I will say this again, one last time in a different more direct way: if we wish to keep FF support, then the above issues need to be fixed. Period.

Member

markcarver commented Dec 18, 2015

We barely have the time to deal with normal issues that come through here, I don't think that making the decision to mark Dreditor on AMO as unlisted just for the "benefit" of this issue is the right decision.

Having to go through that process in the future once we actually decide to list it again is going to be painful and time consuming, neither of which I care to do. I would love to not have this issue in the first place, but was inevitable given how it was originally created as a user-script. The above issues are about really just about finishing the "user-script -> real browser extension" aspect of the code.

I will say this again, one last time in a different more direct way: if we wish to keep FF support, then the above issues need to be fixed. Period.

@markcarver

This comment has been minimized.

Show comment
Hide comment
@markcarver

markcarver Dec 18, 2015

Member

Also, the reason I don't have time to address the above issues right now is because of client work & https://www.drupal.org/node/2609316

Member

markcarver commented Dec 18, 2015

Also, the reason I don't have time to address the above issues right now is because of client work & https://www.drupal.org/node/2609316

@killua99

This comment has been minimized.

Show comment
Hide comment
@killua99

killua99 Dec 21, 2015

Well, I'm using the about:config fix mention at #256 (comment)

I wish have more time to help with those issues.

killua99 commented Dec 21, 2015

Well, I'm using the about:config fix mention at #256 (comment)

I wish have more time to help with those issues.

@jstoller

This comment has been minimized.

Show comment
Hide comment
@jstoller

jstoller Jan 3, 2016

I understand it's going to take some time to get this back up and running on Firefox, but in the mean time, could you post a notice on dreditor.org that explains the problem and maybe links to this issue? I know it would have saved me some significant frustration. Right now that page still indicates that Dreditor is compatible with Firefox—which is not true, strictly speaking—and offers to install the add-on (an install that always fails).

jstoller commented Jan 3, 2016

I understand it's going to take some time to get this back up and running on Firefox, but in the mean time, could you post a notice on dreditor.org that explains the problem and maybe links to this issue? I know it would have saved me some significant frustration. Right now that page still indicates that Dreditor is compatible with Firefox—which is not true, strictly speaking—and offers to install the add-on (an install that always fails).

@ryan-jacobs

This comment has been minimized.

Show comment
Hide comment
@ryan-jacobs

ryan-jacobs Jan 19, 2016

I just wanted to second jstoller's comment about placing a notice on https://dreditor.org/ that states this is a known/pending issues. Such a notice could likely point people here as well, or to whatever canonical location can best solicit the right support. This may help avoid some confusion and focus efforts in the right place.

ryan-jacobs commented Jan 19, 2016

I just wanted to second jstoller's comment about placing a notice on https://dreditor.org/ that states this is a known/pending issues. Such a notice could likely point people here as well, or to whatever canonical location can best solicit the right support. This may help avoid some confusion and focus efforts in the right place.

@markcarver

This comment has been minimized.

Show comment
Hide comment
@markcarver

markcarver Jan 19, 2016

Member

Done - I've placed a notice on the homepage.

Member

markcarver commented Jan 19, 2016

Done - I've placed a notice on the homepage.

@rocketeerbkw

This comment has been minimized.

Show comment
Hide comment
@rocketeerbkw

rocketeerbkw Jan 23, 2016

A small update from Mozilla about this yesterday https://blog.mozilla.org/addons/2016/01/22/add-on-signing-update/.

The about:config override to allow unsigned extensions won't be removed until FF 46 which is slated to release in April.

rocketeerbkw commented Jan 23, 2016

A small update from Mozilla about this yesterday https://blog.mozilla.org/addons/2016/01/22/add-on-signing-update/.

The about:config override to allow unsigned extensions won't be removed until FF 46 which is slated to release in April.

@hansfn

This comment has been minimized.

Show comment
Hide comment
@hansfn

hansfn Mar 10, 2016

After upgrading to FF 45, the extension was automatically disabled (even if I had the about:config override in place.) I had to reinstall the extension to get it working again.

hansfn commented Mar 10, 2016

After upgrading to FF 45, the extension was automatically disabled (even if I had the about:config override in place.) I had to reinstall the extension to get it working again.

@killua99

This comment has been minimized.

Show comment
Hide comment
@killua99

killua99 Mar 15, 2016

I don't know the state of this list. https://github.com/unicorn-fail/dreditor/labels/firefox but just in case, could we review those tasks to work on it.

killua99 commented Mar 15, 2016

I don't know the state of this list. https://github.com/unicorn-fail/dreditor/labels/firefox but just in case, could we review those tasks to work on it.

frob added a commit to frob/dreditor that referenced this issue Apr 4, 2016

Delete issue.summary.template.js
Remove the insert template functionality as per #262 to aid with #256 and https://www.drupal.org/node/1393226
@verasativa

This comment has been minimized.

Show comment
Hide comment
@verasativa

verasativa May 4, 2016

While this issue is fixed, for the users who want to install it on FF45, this is the procedure:

  1. open a firefox tab to about:config
  2. find the value xpinstall.signatures.required
  3. Double click it to change from true to false
  4. Go to https://dreditor.org/ and install from big green install button

ps: I suggest to website admin pointing the current link to this issue in the home, to this specific comment anchor for extra user friendliness ;)

verasativa commented May 4, 2016

While this issue is fixed, for the users who want to install it on FF45, this is the procedure:

  1. open a firefox tab to about:config
  2. find the value xpinstall.signatures.required
  3. Double click it to change from true to false
  4. Go to https://dreditor.org/ and install from big green install button

ps: I suggest to website admin pointing the current link to this issue in the home, to this specific comment anchor for extra user friendliness ;)

@dwaghmare

This comment has been minimized.

Show comment
Hide comment
@dwaghmare

dwaghmare Jun 14, 2016

@nahueldotme ++

dwaghmare commented Jun 14, 2016

@nahueldotme ++

@deviantintegral

This comment has been minimized.

Show comment
Hide comment
@deviantintegral

deviantintegral Jun 21, 2016

nahueldotme's instructions are working fine for me in Firefox 49 which is currently in the aurora channel. I remember reading that the signing requirement config was going to be kept in Firefox developer edition, so that might continue to be a good workaround for now.

deviantintegral commented Jun 21, 2016

nahueldotme's instructions are working fine for me in Firefox 49 which is currently in the aurora channel. I remember reading that the signing requirement config was going to be kept in Firefox developer edition, so that might continue to be a good workaround for now.

@larowlan

This comment has been minimized.

Show comment
Hide comment
@larowlan

larowlan Aug 3, 2016

FYI the about:config fix no longer works in FF 48

larowlan commented Aug 3, 2016

FYI the about:config fix no longer works in FF 48

This was referenced Aug 12, 2016

@markcarver

This comment has been minimized.

Show comment
Hide comment
@markcarver

markcarver Aug 12, 2016

Member

Dreditor is being decommissioned due to the lack of availability of current maintainers and the fact that Drupal.org is becoming more feature rich at a much faster rate than Dreditor itself now.

This decision was also partially made due to the amount of work (complete rewrite) it would take to create an "official" Firefox extension (#256).

If you already have the extension installed, it should continue working for a while until, inevitably, the markup on Drupal.org changes. It will no longer be updated.

We understand that many of you love this extension, as do we. This isn't the end, in fact, it's a much brighter beginning. All the things we love about Dreditor can, and should, be moved into Drupal.org natively.

For more information, please follow: https://www.drupal.org/node/2779729

Member

markcarver commented Aug 12, 2016

Dreditor is being decommissioned due to the lack of availability of current maintainers and the fact that Drupal.org is becoming more feature rich at a much faster rate than Dreditor itself now.

This decision was also partially made due to the amount of work (complete rewrite) it would take to create an "official" Firefox extension (#256).

If you already have the extension installed, it should continue working for a while until, inevitably, the markup on Drupal.org changes. It will no longer be updated.

We understand that many of you love this extension, as do we. This isn't the end, in fact, it's a much brighter beginning. All the things we love about Dreditor can, and should, be moved into Drupal.org natively.

For more information, please follow: https://www.drupal.org/node/2779729

@valthebald

This comment has been minimized.

Show comment
Hide comment
@valthebald

valthebald Aug 17, 2016

Hello @markcarver,
this is Val from the core mentoring initiative.
First of all, thank you for your continuous support and passion, I, among many others, is a big dreditor fan.
I see that there is a meta issue on d.o. to move all dreditor features to d.o. itself. This is a great thing when (if) it happens. Unfortunately, I don't see it happen before DrupalCon Dublin (correct me if I'm wrong).
Dreditor was (and is) an important tool that we recommend to the new contributors as part of mentored sprints, so I wonder if there is a chance to prolong the site's life until the end of September 2016. If there are any issues with the hosting, I can offer a VM at Hetzner for this period (or longer).
Just in case, for FF lovers who want the extension, trick to allow the installation is easy:

  1. Go to about:config
  2. Set xpinstall.signatures.required to false
    Hope this can help someone

Best regards,
Valery

valthebald commented Aug 17, 2016

Hello @markcarver,
this is Val from the core mentoring initiative.
First of all, thank you for your continuous support and passion, I, among many others, is a big dreditor fan.
I see that there is a meta issue on d.o. to move all dreditor features to d.o. itself. This is a great thing when (if) it happens. Unfortunately, I don't see it happen before DrupalCon Dublin (correct me if I'm wrong).
Dreditor was (and is) an important tool that we recommend to the new contributors as part of mentored sprints, so I wonder if there is a chance to prolong the site's life until the end of September 2016. If there are any issues with the hosting, I can offer a VM at Hetzner for this period (or longer).
Just in case, for FF lovers who want the extension, trick to allow the installation is easy:

  1. Go to about:config
  2. Set xpinstall.signatures.required to false
    Hope this can help someone

Best regards,
Valery

@chx

This comment has been minimized.

Show comment
Hide comment
@chx

chx Aug 18, 2016

If hosting is required and a VM doesn't suffice just give me a Dockerfile and I will put it on a beefy server (also Hetzner).

chx commented Aug 18, 2016

If hosting is required and a VM doesn't suffice just give me a Dockerfile and I will put it on a beefy server (also Hetzner).

@neclimdul

This comment has been minimized.

Show comment
Hide comment
@neclimdul

neclimdul Aug 18, 2016

@valthebald Hosting isn't really the problem I don't think. The Firefox fix has been mentioned half a dozen times on the issue but also the fact that it was removed in the Aug 2 Firefox 48 release as noted just 2 comment above. If its working for you you're very lucky but I wouldn't expect it to work for you sprinters.

https://wiki.mozilla.org/Addons/Extension_Signing

neclimdul commented Aug 18, 2016

@valthebald Hosting isn't really the problem I don't think. The Firefox fix has been mentioned half a dozen times on the issue but also the fact that it was removed in the Aug 2 Firefox 48 release as noted just 2 comment above. If its working for you you're very lucky but I wouldn't expect it to work for you sprinters.

https://wiki.mozilla.org/Addons/Extension_Signing

@joachim-n

This comment has been minimized.

Show comment
Hide comment
@joachim-n

joachim-n Aug 23, 2016

The xpinstall.signatures.required technique appears to have stopped working as of Firefox 48.

joachim-n commented Aug 23, 2016

The xpinstall.signatures.required technique appears to have stopped working as of Firefox 48.

@andypost

This comment has been minimized.

Show comment
Hide comment
@MacWeber

This comment has been minimized.

Show comment
Hide comment
@MacWeber

MacWeber Nov 10, 2016

Debian Linux solution, tested on Firefox 49:

Create the file /opt/firefox/defaults/pref/config-prefs.js:

//
pref("general.config.obscure_value", 0);
pref("general.config.filename", "config.js");

Making sure you have the first comment line // and also the 'new line' at the end of the file!

Create the file /opt/firefox/config.js:

//
try {
    Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {})
        .eval("SIGNED_TYPES.clear()");
}
catch(ex) {}

Again, make sure you have the first comment line // and also the 'new line' at the end of the file!

Restart Firefox and now you can install unsigned add-ons, such as Dreditor.

MacWeber commented Nov 10, 2016

Debian Linux solution, tested on Firefox 49:

Create the file /opt/firefox/defaults/pref/config-prefs.js:

//
pref("general.config.obscure_value", 0);
pref("general.config.filename", "config.js");

Making sure you have the first comment line // and also the 'new line' at the end of the file!

Create the file /opt/firefox/config.js:

//
try {
    Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {})
        .eval("SIGNED_TYPES.clear()");
}
catch(ex) {}

Again, make sure you have the first comment line // and also the 'new line' at the end of the file!

Restart Firefox and now you can install unsigned add-ons, such as Dreditor.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment