Page 1 of 2

5.1.8.7rc4 is not signed

Posted: Mon Sep 10, 2018 8:42 pm
by therube
NoScript 5.1.8.7rc4 is not signed.


Shouldn't it be?
Or is Mozilla no longer allowing signing of Legacy extensions at all?


If the latter, then there should be a note that the about:config Pref, xpinstall.signatures.required, needs to be toggled to false (for Firefox users, or other browsers that require signing - which might only be Firefox?).

Re: 5.1.8.7rc4 is not signed

Posted: Mon Sep 10, 2018 8:59 pm
by Giorgio Maone
therube wrote:NoScript 5.1.8.7rc4 is not signed.
Shouldn't it be?
It should, but...
therube wrote: Or is Mozilla no longer allowing signing of Legacy extensions at all?
This one.
therube wrote: If the latter, then there should be a note that the about:config Pref, xpinstall.signatures.required, needs to be toggled to false (for Firefox users, or other browsers that require signing - which might only be Firefox?).
There's one since 5.1.8.7 has been released this morning.
Ops, probably it should be duplicated in the dev build section as well. Doing that now...

Re: 5.1.8.7rc4 is not signed

Posted: Tue Sep 11, 2018 2:56 am
by barbaz
Does this mean that Firefox 56 users won't be able to use any NoScript Classic updates beyond 5.1.8.7rc3, unless they switch to either the unbranded build, 52 ESR, SeaMonkey, or Waterfox?

Re: 5.1.8.7rc4 is not signed

Posted: Tue Sep 11, 2018 9:32 pm
by harryray2
Why can't this be signed?...I'm using FF 55.0.3 and I have no intention of changing this

I also use ublock origin and all the updates for this are signed when on the github site.

Re: 5.1.8.7rc4 is not signed

Posted: Tue Sep 11, 2018 10:02 pm
by barbaz
harryray2 wrote:Why can't this be signed?
already said -
Giorgio Maone wrote:
therube wrote: Or is Mozilla no longer allowing signing of Legacy extensions at all?
This one.
harryray2 wrote:I also use ublock origin and all the updates for this are signed when on the github site.
uBlock Origin is a WebExtension.

Re: 5.1.8.7rc4 is not signed

Posted: Thu Sep 13, 2018 5:27 am
by WhackaScript
I'm running FF v56.0.2 (currently with NoScript v5.1.8.6) and changed the about:config preference "xpinstall.signatures.required" from "True" to "False". However, FF still won't let me install the update to NoScript v5.1.8.7. FF pops up the message "This add-on could not be installed because it has not been verified" each time I try. Any solution here?

Re: 5.1.8.7rc4 is not signed

Posted: Thu Sep 13, 2018 12:14 pm
by barbaz
WhackaScript wrote:I'm running FF v56.0.2 (currently with NoScript v5.1.8.6) and changed the about:config preference "xpinstall.signatures.required" from "True" to "False". However, FF still won't let me install the update to NoScript v5.1.8.7. FF pops up the message "This add-on could not be installed because it has not been verified" each time I try. Any solution here?
So are you saying the answer to my question https://forums.informaction.com/viewtop ... 626#p98626 is "yes"?

Re: 5.1.8.7rc4 is not signed

Posted: Thu Sep 13, 2018 11:34 pm
by therube
The "autoconfig.js" hack still works on FF 56 (Release version too).
So you can install unsigned extensions in Release versions of FF at least FF 55 & FF 56.
(I didn't check in later versions?)
(Slightly different method used for earlier versions.)


This was talked about on mozillazine.org & elsewhere some time back (more then a year ago, it seems).


Download link (click the word, 'Download', on the page), http://ge.tt/5W2Rxcr2
692 bytes.


My "FF-Bypass Add-on Signing Check (55+).zip" contents:

_readme55+.TXT:

Code: Select all

Copy mozilla.cfg to:

        instalDir\mozilla.cfg

Copy autoconfig.js to:

        instalDir\defaults\pref\autoconfig.js
mozilla.cfg:

Code: Select all

// mozilla.cfg file needs to start with a comment line

try {
  Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {}).
    eval("SIGNED_TYPES.clear()");
} catch (e) {}

try {
  Components.utils.import("resource://gre/modules/addons/XPIInstall.jsm", {}).
    eval("SIGNED_TYPES.clear()");
} catch (e) {}
autoconfig.js:

Code: Select all

// autoconfig.js file needs to start with a comment

pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0);

Re: 5.1.8.7rc4 is not signed

Posted: Thu Sep 13, 2018 11:52 pm
by therube
While you're at it, you should make another "hackish" (if you will) change to prevent updates, http://forums.mozillazine.org/viewtopic ... #p14808936 (see the link to Frank's post in the thread below the linked post).

Re: 5.1.8.7rc4 is not signed

Posted: Thu Sep 13, 2018 11:54 pm
by therube
Barbaz wrote:So are you saying the answer to my question viewtopic.php?p=98626#p98626 is "yes"?
Correct.
Without some "hack" method, as it is currently, an unsigned 5.1.8.7rc4 will not install in FF 56.

uBlock Origin is a WebExtension
The most recent Legacy version of uBlock, uBlock0.firefox-legacy_1.16.4.4.xpi, on github, is not signed & likewise will not install into FF 56 without some "hack".

Re: 5.1.8.7rc4 is not signed

Posted: Fri Sep 14, 2018 1:36 am
by WhackaScript
@barbaz, I don't know enough about the topic to give you a definitive "yes" to your question (but looks like therube has confirmed that)--I just wanted to clarify that for at least Firefox v56.x the "xpinstall.signatures.required" preference referenced in the original post no longer works. According to a response I received today on a Mozilla Support Forum (https://support.mozilla.org/en-US/questions/1233587), that preference was disabled somewhere around version 48.

@therube, thanks for the "autoconfig.js" hack. Just tried it and works fine on FF v56.0.2 on Win 10 and Win 8.1.

Re: 5.1.8.7rc4 is not signed

Posted: Fri Sep 14, 2018 5:12 am
by harryray2
Thanks for the hack...it solved a long standing problem for me...

Is it OK, once the unsigned extensions have been installed, to delete the two files mozilla.cfg and autoconfig.js from the firefox directory and just replace them when I need to install another unsigned extension?

Re: 5.1.8.7rc4 is not signed

Posted: Thu Oct 04, 2018 6:47 pm
by harryray2
Although this hack worked and I managed to install noscript I appear to be having problems installing some extensions..I'm getting a addon corrupt message.

How do i reverse the hack, do I have to change the about:config entries? I tried deleting the files but that stopped FF from starting.

Re: 5.1.8.7rc4 is not signed

Posted: Fri Oct 05, 2018 11:04 am
by therube
The hack is not likely the issue.
The hack allows you to install unsigned extensions.

If you make a change to the extension itself, & if the extension is signed, your change breaks the signing.
But (by default) extensions do need to be signed to be installed.
So you cannot make changes to extensions & expect them to work.
Well, unless you also remove the signing parts from the extension - or get them signed.
But if you remove the signing parts from the extension, the extension can no longer be installed because then the signing is missing.
But, if you use the hack, signing is not required, so you can make changes to the extension & they can be installed, so long as you remove the signing parts from the extension itself.
So (after backing up first) try removing the /META-INF/ directory from the extension & see if then works.
And again, that also assumes that you have made a change to an extension, which breaks the signing, & that you have something in place, a hack, or you're using some browser that does not require signing at all.
Isn't a bunch of crap that Mozilla makes you go through "for your security" (or whatever their "stated" reasons for putting you through that crap are).

Re: 5.1.8.7rc4 is not signed

Posted: Fri Oct 05, 2018 1:07 pm
by harryray2
Must admit, I do get fed up with a lot of the so called 'security' crap..some of which is totally unnecessary.

This started right after I installed the hack. I hadn't made any other changes either to FF or the add-on itself Is it possible that Mozilla has changed something that is 'breaking' the add-ons and making them corrupt?

I would be interested though on how to reverse the hack anyway just to give me a better understanding of things.

Btw, I'm using FF 55.0.3

Thanks.