firefox add-on signing

[darkoshi]

Just FYI. As of Firefox 48.0, for security reasons, add-ons will no longer work unless they've been verified/signed by Mozilla. This is done automatically for ones hosted on the Mozilla site, but for ones hosted on other sites, must be done manually by the developer. This is actually not a new thing - it has been the case since Firefox 43.0. But until now, users could override it by setting the "xpinstall.signatures.required" preference to false on the about:config page. Now, that preference is no longer supported - to avoid malware from being able to change the preference without the user's knowledge.

From what I understand, a side effect of this is that any add-on which as part of its functionality, changes the contents of its own folders, won't work either.
For example, the Change Profile's Window Icons add-on allowed the user to select a custom icon for Firefox browser windows, and copied the selected icon file to a subfolder, which allowed it to override the default Firefox icon. This allowed you to use different icons for different browser profiles. Now this add-on no longer works, although it can still be installed from the Mozilla site. The problem with this add-on doesn't happen after selecting a new icon, as I expected it would... The buttons in the add-on's options window don't even work anymore (probably due to some other issue), so you can't even select any icons.

As the above add-on no longer works, I created these 2 add-ons with static replacement icons, for me to use instead:
BrowserIconsBlue
BrowserIconsPink

Comments

[marahmarie]

Possible workarounds are here: http://www.thewindowsclub.com/allow-unsigned-extensions-installed-firefox

tl;dr: 1) about:debugging page. Look for ‘Load Temporary add-on’ and select the XPI file for add-on. (has to be redone on every browser restart)

2) "Developer Edition and Nightly versions of Firefox will have a setting to disable signature enforcement."

3) "In addition to it, there will be special unbranded versions of Release and Beta that will have this setting, so that add-on developers can work on their add-ons without having to sign every build. For disabling signature checks, a developer will need to set the xpinstall.signatures.required preference to “false”."

[darkoshi]

Yeah, I'll have to use one of those work-arounds for testing making updates to add-ons, before uploading them to the Mozilla site.