Signing issues

Wednesday, August 10, 2016 | 08:05

I have been receiving some reports about this add-on not being signed or that the add-on is disabled after a Firefox update. In fact every add-on that can be downloaded and installed directly from Mozilla is digitally signed so that is definitely not what is causing this issue.

See also the Mozilla topic on extension signing, in the FAQ section:
  • How do I get my add-ons signed if they are hosted on addons.mozilla.org (AMO)?
    No action is required. We automatically signed reviewed versions of all add-ons currently hosted on AMO. All new versions will be signed automatically after they pass review.

It turns out that many of the signing issues seem to be related to cleaning and/or protecting software like CCleaner and BleachBit. Other problems that might cause an add-on to be disabled are a corrupt add-on registry or some sort of caching issue which might also be caused by the aforementioned cleaning software. Some users reported that setting the Firefox option xpinstall.whitelist.required (about:config) to false and re-installing the add-on resolved their issue.

If you have issues with this add-on being automatically disabled and you are using cleaning software try playing around with the browser related cleaning options. If this does not help or you are not using any cleaning software you might find some solutions on this Mozilla support page: https://support.mozilla.org/questions/998008

You can easily see if this add-on is signed by examining the folder of the installed extension. First locate the profile folder, see here on how to do that. In the profile folder, navigate to extensions\formhistory@yahoo.com, here you should find a META-INF subfolder with the following 3 files: manifest.mf, mozilla.rsa and mozilla.sf.
If the META-INF folder or any of its files inside are missing Firefox will regard the add-on as being unsigned. So either the add-on was downloaded from an untrusted source or some or all signing files were deleted (cleaned) at some point after being downloaded from the official Mozilla repository.

Technical info about the signing files: how-mozilla-signs-addons

3 comments:

Anonymous said...

"In fact every add-on that can be downloaded and installed directly from Mozilla is digitally signed" - that's a bit misleading statement.

Please see https://wiki.mozilla.org/Add-ons/Extension_Signing which describes, what kind of signing your extension needs and how to obtain it.

Please not that since Firefox 48, youe extension is not able to work at all, since there is no longer any override for allowing running of unsigned extensions.

It would be sad to loose this very useful extension just for not having the signature. Please follow the process and obtain it.

Thanks for all the work on it!

Stephan Mahieu said...

I do not think it is misleading to state that every add-on that can be downloaded and installed directly from Mozilla is digitally signed. My add-on is in fact signed, if you have problems with your setup it has nothing to do with my add-on not being signed.

From the site you mentioned, in the FAQ section you can read:

- How do I get my add-ons signed if they are hosted on addons.mozilla.org (AMO)?

- No action is required. We automatically signed reviewed versions of all add-ons currently hosted on AMO. All new versions will be signed automatically after they pass review.

Stephan Mahieu said...

I have updated the post with info on how to check for the signing files. If any of these are missing then the add-on was downloaded from an untrusted source or the files have been deleted (cleaned) afterwards.

Post a Comment