Document how to disable XPI signing in Firefox 49+

Question

Document how to disable XPI signing in Firefox 49+

alphapapa opened this issue 8 years ago · 32 comments

Note: Definitive info from this issue is being added to this wiki page.

I just built Firefox 49 on Ubuntu 14.04 Trusty, switching from Gtk3 back to Gtk2 (because there's no Gtk3 version of my Gtk2 theme, QtCurve). Firefox 48 allowed me to install the Pentadactyl XPI I packaged, but Firefox 49 did not. sigh

A bit of googling around led me to this: http://www.ghacks.net/2016/08/14/override-firefox-add-on-signing-requirement/ I followed the instructions, restarted Firefox, and it worked, enabling me to install unsigned XPI extensions without rebuilding Firefox.

I think this should be documented somewhere prominently, as it saves a lot of trouble compared to rebuilding Firefox (until Mozilla kills this avenue, of course...). For posterity, here is a simple version of the instructions for Linux:

Create file /usr/lib/firefox/config.js with the following content:

try {
    Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {})
        .eval("SIGNED_TYPES.clear()");
}
catch(ex) {}

Create file /usr/lib/firefox/defaults/pref/config-prefs.js with the following content:

pref("general.config.obscure_value", 0);
pref("general.config.filename", "config.js");

Restart Firefox.

Now you should be able to install unsigned extensions.

If (when?) Mozilla "plugs" this "hole", it should be possible to rebuild Firefox to disable extension signing by doing this:

Download and extract the Firefox source (e.g. on Debian/Ubuntu, apt-get source firefox)..
Open the file toolkit/mozapps/extensions/internal/XPIProvider.jsm.
Find this code:

const SIGNED_TYPES = new Set([
      "webextension",
      "extension",
      "experiment",
  ]);

Remove extension and webextension from the set.
Build and install Firefox (out of scope for these instructions).

Answer 1 · 2016-10-01T21:50:57.000Z

BTW, I tried to post this to the Pentadactyl Google Group, but all I get is, "You do not have permission to access this content. (#554)" I recall getting similar errors when trying to post to the group in the past, a year or two ago. Google Groups appears to be completely useless; we should really move discussion elsewhere.

Answer 2 · 2016-10-01T23:21:40.000Z

Hi,

First thing first, thanks ^^.

For MacOs, the file seems to be placed in
/Applications/Firefox.app/Contents/Resources/pref.js
/Applications/Firefox.app/Contents/Resources/defaults/pref/config-pref.js

But then I get the error message when I try to install pentadactyl: "Pentadactyl could not be installed because it is not compatible with Firefox 49.0.1.

Did you get the same issue ?

Answer 3 · 2016-10-01T23:30:06.000Z

@Thiel Where did you get the pentadactyl.xpi file you're trying to install? You need one that was built since the Sep 23 commit that bumped the max version to 49. That's unrelated to extension signing.

Answer 4 · 2016-10-01T23:37:01.000Z

I see, thank you for the info, and sorry for it being un-related to the issue.

Answer 5 · 2016-10-10T09:03:07.000Z

@Thiel, are you sure about location/names of these files? When I create them, I get the following error message:

Configuration error.
Failed to read the configuration file. Please contact your system administrator.

UPD Looks like I was able to fix it (manually typed above code in the specified files), so now firefox starts, but it doesn't fix the problem, I still cannot activate pentadactyl because of the missing verification. I have firefox 49.0.1. Which version do you guys have?

UPD2 Argh, I've reinstalled the pentadactyl and now it works. God bless you, guys!

Answer 6 · 2016-10-14T14:02:27.000Z

@mklishevych , is that all you did do get it working again? It did not work for me.
I also get the same error message:

Configuration Error
Failed to read the configuration file. Please contact your system administrator.

I am running FF 49.0.1 x64 on Windows 7 x64

Which system/version of Firefox are you using or is it reasonable to expect there to be differences between the x86 and x64 versions?
Thanks!

Answer 7 · 2016-10-14T15:02:41.000Z

@likyng What paths did you place the files at? Did you try 1) remove Pentadactyl if it's already installed, 2) quit Firefox, 3) add the files mentioned here, 4) start Firefox, 5) install Pentadactyl?

is it reasonable to expect there to be differences between the x86 and x64 versions?

That shouldn't make any difference.

Answer 8 · 2016-10-14T17:35:27.000Z

@alphapapa

I placed the files in C:\Program Files\Mozilla Firefox and C:\Program Files\Mozilla Firefox\defaults\pref.
2)It was a fresh installation of Firefox (only addon which was installed before trying this method was uBlock origin)

and after trying this method the mentioned error popped up upon launching FF and thus I am not able to start it at all (even without any addons installed). When I remove the file in \defaults\pref I can start Firefox again but obviously can only install signed extensions.

Answer 9 · 2016-10-14T17:43:26.000Z

@likyng I see that those are the paths described in the article I linked, however I wonder if those are actually the correct paths. You might google around and see if there is another directory they should go in, maybe something in an AppData directory, something like that. I'm not sure, because I don't use Windows much; sorry I can't be of more help. Please let us know if you find out so we can add the solution here (and/or on the wiki page).

Answer 10 · 2016-10-14T18:51:30.000Z

In my case I've only tested in MacOS, and since the exact path wasn't specified in the article. I think I've tried to follow the relative path but didn't work, so I've brute-forced until getting something that worked ^^. And posted the result here.

Answer 11 · 2016-10-15T00:29:24.000Z

$ cat /Applications/Firefox.app/Contents/Resources/defaults/pref/config-prefs.js
pref("general.config.obscure_value", 0);
pref("general.config.filename", "config.js");

$ cat /Applications/Firefox.app/Contents/Resources/config.js
try {
    Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {})
        .eval("SIGNED_TYPES.clear()")
}
catch(ex) {}

Also I tried with config.js on /Applications/Firefox.app/ and the same result. I can't see what I'm doing wrong 😕

Mac OSX El Capitan (10.11.6)
Firefox 49.0.1

Answer 12 · 2016-10-23T20:40:40.000Z

Try adding empty lines before and after the pasted content in both files. Make sure you don't have any additional spaces, new line characters, etc., and that you have a comment in the first line of both files. It's needed.

On my new Manjaro installation it was pasting some weird white chars and simply removing them helped with the Failed to read configuration issue.

Still, I can see the changes creating these files made in about:config but can't install unverified add-ons.

Doesn't work with Firefox 49.0.1 and 49.0.2 on Manjaro i3 16.08.

Answer 13 · 2016-10-23T21:21:55.000Z

@cprn Sorry to hear it doesn't work for you. I wonder if there's something different about the way Ubuntu has the Firefox build configured. If you happen to have the time and inclination, it would be very interesting if you could test Ubuntu in a VM or something and see if this works there. Maybe we could figure out how to adjust the build to make it work on other systems.

@mklishevych Could you tell us what system you're running on, what version and build of the Firefox package you have installed, etc? Since it's working for you, I'd like to compare your system with the ones it isn't working on.

@Thiel Just to clarify, you did get it working on OS X using the paths you mentioned earlier?

Answer 14 · 2016-10-26T19:31:40.000Z

@alphapapa Ignore it.

tl;dr: In order to check older version I downgraded to 49.0.1 (the only other one available in Arch repositories without reaching to ALA) and repeated every step. At that point it still didn't work for me so I posted my comment... After upgrading back to 49.0.2, however, Firefox correctly run about:newaddon?id= and so on, installing all unsigned plugins one by one. Unless someone else reports similar issue I'll let myself think it's solved.

Answer 15 · 2016-10-26T20:20:02.000Z

@cprn Great, glad to hear it works now!

Answer 16 · 2016-10-26T22:17:41.000Z

@cprn thanks for the update ^^.

@alphapapa Sorry I completely missed your previous message. And I just noticed that I made a terrible mistake by writing "pref.js" instead of "config.js" in the first part (sorry guys).

Here is a copy past of what solved my issue:

$ cat /Applications/Firefox.app/Contents/Resources/defaults/pref/test.js
pref("general.config.obscure_value", 0);
pref("general.config.filename", "config.js");
$ cat /Applications/Firefox.app/Contents/Resources/config.js
//
try {
Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {})
.eval("SIGNED_TYPES.clear()");
}
catch(ex) {}

@maturano configuration looks correct. So I have no idea it's failing.

Answer 17 · 2016-10-28T23:26:02.000Z

@Thiel 's method works for me. Don't forget the // before try in config.js

Answer 18 · 2016-10-28T23:34:02.000Z

@haidahaha You mean that without a // on a line by itself before the try, it doesn't work? And are you also on OS X?

Answer 19 · 2016-10-28T23:35:08.000Z

@alphapapa yes exactly. I'm on OS X 10.11.3. WIthout a // I got the configuration error like @maturano above

Answer 20 · 2016-10-28T23:43:27.000Z

@haidahaha Thanks, that's very good info. I'll add it to the wiki page.

Answer 21 · 2016-10-31T11:21:58.000Z

Thanks @haidahaha for figuring that out ^^.

Out of curiosity, does anyone know the reason behind // ?

Answer 22 · 2016-11-02T09:45:53.000Z

@alphapapa the config file from @Thiel (incl. the comment) also works on my windows 7 machine! Thanks a lot!!!!!

Answer 23 · 2016-11-23T12:03:55.000Z

You can also use the "unbranded" binaries built here: https://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-release-linux64-add-on-devel/

On archlinux it's in the AUR.

Answer 24 · 2016-11-23T14:55:55.000Z

// is just a comment... It doesn't mean anything but it's needed in the first line for Firefox to parse the file correctly. If it isn't in the first line, it's also possible you've copy&pasted some unprintable character that bugs the interpreter and commenting it solves the issue. Deleting white space will solve it in that case.

Answer 25 · 2016-11-24T07:09:48.000Z

@ohjames Yeah, here's hoping other Linux distros will also provide builds like that.

@cprn Thanks for pointing that out. That would explain why some people don't have that problem.

Answer 26 · 2017-02-14T17:45:38.000Z

I got it installed on FF 51 with the techniques noted above and bypassing the max version. The plugin does not seem to load; a stack trace shows up:

1487094198770 addons.xpi WARN Error loading bootstrap.js for

pentadactyl@dactyl.googlecode.com: TypeError: can't convert undefined to object (resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/hari/.mozilla/firefox/5sumaxhy.default/extensions/pentadactyl@dactyl.googlecode.com.xpi!/bootstrap.js:20:1) JS Stack trace: @resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/hari/.mozilla/firefox/5sumaxhy.default/extensions/pentadactyl@bootstrap.js:20:1 < @XPIProvider.jsm:4796:1 < this.XPIProvider.loadBootstrapScope@XPIProvider.jsm:4796:7 < this.XPIProvider.callBootstrapMethod@XPIProvider.jsm:4875:9 < this.XPIProvider.startup@XPIProvider.jsm:2868:13 < callProvider@AddonManager.jsm:235:12 < _startProvider@AddonManager.jsm:788:5 < AddonManagerInternal.startup@AddonManager.jsm:972:9 < this.AddonManagerPrivate.startup@AddonManager.jsm:3016:5 < amManager.prototype.observe@addonManager.js:71:9
undefined: bootstrap: startup startup
1487094198772 addons.xpi WARN Exception running bootstrap method startup on pentadactyl@dactyl.googlecode.com: ReferenceError: can't access lexical declaration `initialized' before initialization (resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/hari/.mozilla/firefox/5sumaxhy.default/extensions/pentadactyl@dactyl.googlecode.com.xpi!/bootstrap.js:361:9) JS Stack trace: startup@resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/hari/.mozilla/firefox/5sumaxhy.default/extensions/pentadactyl@bootstrap.js:361:9 < this.XPIProvider.callBootstrapMethod@XPIProvider.jsm:4944:9 < this.XPIProvider.startup@XPIProvider.jsm:2868:13 < callProvider@AddonManager.jsm:235:12 < _startProvider@AddonManager.jsm:788:5 < AddonManagerInternal.startup@AddonManager.jsm:972:9 < this.AddonManagerPrivate.startup@AddonManager.jsm:3016:5 < amManager.prototype.observe@addonManager.js:71:9

Answer 27 · 2017-02-16T15:54:37.000Z

@hari-rangarajan That would be a different problem that should be discussed in a separate issue. This is only for discussing how to work around XPI signing.

Answer 28 · 2017-05-30T13:29:20.000Z

Any Idea how to install addons with label Compatible with Firefox 57+?
For example:

ColorZilla
Disconnect
Evernote Web Clipper
Tab Auto Refresh

Answer 29 · 2017-06-01T21:40:42.000Z

@uBlock-magic This is only for discussing how to work around XPI signing for Pentadactyl, not a general extension support forum.

Answer 30 · 2017-10-26T09:06:03.000Z

Any Idea how to install addons with label Compatible with Firefox 57+?
For example:

ColorZilla
Disconnect
Evernote Web Clipper
Tab Auto Refresh

Script die in Firefox 51+, install no problem 👍

Answer 31 · 2017-11-21T13:26:11.000Z

@cprn

// is just a comment... if you need it in order for this workaround to work, it means you've copy&pasted some unprintable character that bugs the interpreter and commenting it solves the issue. Deleting white space will solve it as well.

No. Comment is needed because Firefox ignores the first line of this file. See MDN.

Answer 32 · 2017-11-21T19:35:55.000Z

@CoolCmd Thanks, you're right.
@alphapapa Can you update the first post so it would include comments in first line of both config.js and config-prefs.js?