Hacker News Reader

Comment by mehrdadn | Hacker News Reader

Question: How do I sign extensions I wrote for myself so I can actually use them, without uploading a copy of the extension somewhere? That's my roadblocker right now. I don't know how to migrate make my own extensions work on my own system without uploading them to other people's servers. (Yes, I want Firefox stable. I don't want to run a buggy browser.)

View on HN

You can run either Firefox ESR or the unbranded builds [1] if you want unsigned extensions, but I'm curious what your concerns are with the unlisted extensions option from Mozilla?

1 - https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...

> You can run either Firefox ESR

Then I have the exact same problem when support dies in the coming months though.

> or the unbranded builds [1]

Interesting, so does this mean that if I want stable builds, I'd have to manually update to the exact unbranded counterpart of that stable version?

> I'm curious what your concerns are with the unlisted extensions option from Mozilla?

I guess because I really don't see what business they have forcing me to upload my extensions to their servers? Same reason why people don't like uploading Chrome stuff to Google servers?

~~~~~~~~~~~

Edit:

I'm trying out the unbranded builds and running into a problem when I try to use my existing profile: disabling signature checking doesn't work. However, it works on a fresh profile. Not sure what the problem is...

I know this is exactly what you're trying to avoid, but could you upload an example unsigned extension? I'll try to figure it out, could be a bug somewhere.

Thank you for offering to help! I actually just figured out how to fix it right now myself. The solution is to delete the following lines in prefs.js, then restart unbranded-Firefox twice:

  user_pref("extensions.databaseSchema", 27);
  user_pref("extensions.e10s.rollout.policy", "50allmpc");

The first start takes longer, so I can tell it's resetting something internally (not sure what). However, the second restart is what makes it start working. Not sure why.

Edit:

For anyone else trying to auto-obtain the latest stable Firefox nightly, here's a hacky command (change for your OS as needed):

  curl -s "https://wiki.mozilla.org/Add-ons/Extension_Signing" | sed -n "0,/Windows 64-bit Installer/{s/.*href=\"\\(https:[^\"]*\\.zip\\)\">Windows 64-bit Installer<.*/\\1/p}"

Glad to hear you worked it out, good luck! Looking around there are a few levels of cache around whether addons are enabled, I guess those are what you need to clear it.

It's a temporary hack, but you might also want to look at temporarily loading extensions with about:debugging, this works even in official release.

Yeah the temporary thing was already working in the official release, but it's temporary so I was looking for the normal way. Thanks! :)

> Then I have the exact same problem when support dies in the coming months though.

Good news! Even Firefox ESR 60 always you to disable the mandatory signature checks by setting the "xpinstall.signatures.required" pref = false. The Mozilla add-on wiki was a little unclear, so I just manually verified that the "xpinstall.signatures.required" pref works correctly in Firefox ESR 60. :)

https://wiki.mozilla.org/Add-ons/Extension_Signing

You have to use Firefox Developer Edition and change 'xpinstall.signatures.required' to True in about:config

What about the part where I wrote

> Yes, I want Firefox stable. I don't want to run a buggy browser.

? Is the developer edition running the same code as stable?

Developer Edition is essentially Beta with a few changes (which means additional telemetry by default so probably not up your alley):

https://hacks.mozilla.org/2017/04/simplifying-firefox-releas... (edit for better link)

Yeah, I neither want beta nor telemetry...

fwiw even Nightly is quite stable these days, I can't remember when it last kept me from getting work done. And the addt'l telemetry is just a pref away.

Reply on news.ycombinator.com