5.1.8.7rc4 is not signed

Bug reports and enhancement requests
User avatar
therube
Ambassador
Posts: 7922
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

5.1.8.7rc4 is not signed

Post by therube »

NoScript 5.1.8.7rc4 is not signed.


Shouldn't it be?
Or is Mozilla no longer allowing signing of Legacy extensions at all?


If the latter, then there should be a note that the about:config Pref, xpinstall.signatures.required, needs to be toggled to false (for Firefox users, or other browsers that require signing - which might only be Firefox?).
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: 5.1.8.7rc4 is not signed

Post by Giorgio Maone »

therube wrote:NoScript 5.1.8.7rc4 is not signed.
Shouldn't it be?
It should, but...
therube wrote: Or is Mozilla no longer allowing signing of Legacy extensions at all?
This one.
therube wrote: If the latter, then there should be a note that the about:config Pref, xpinstall.signatures.required, needs to be toggled to false (for Firefox users, or other browsers that require signing - which might only be Firefox?).
There's one since 5.1.8.7 has been released this morning.
Ops, probably it should be duplicated in the dev build section as well. Doing that now...
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
barbaz
Senior Member
Posts: 10834
Joined: Sat Aug 03, 2013 5:45 pm

Re: 5.1.8.7rc4 is not signed

Post by barbaz »

Does this mean that Firefox 56 users won't be able to use any NoScript Classic updates beyond 5.1.8.7rc3, unless they switch to either the unbranded build, 52 ESR, SeaMonkey, or Waterfox?
*Always* check the changelogs BEFORE updating that important software!
-
harryray2
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Re: 5.1.8.7rc4 is not signed

Post by harryray2 »

Why can't this be signed?...I'm using FF 55.0.3 and I have no intention of changing this

I also use ublock origin and all the updates for this are signed when on the github site.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
barbaz
Senior Member
Posts: 10834
Joined: Sat Aug 03, 2013 5:45 pm

Re: 5.1.8.7rc4 is not signed

Post by barbaz »

harryray2 wrote:Why can't this be signed?
already said -
Giorgio Maone wrote:
therube wrote: Or is Mozilla no longer allowing signing of Legacy extensions at all?
This one.
harryray2 wrote:I also use ublock origin and all the updates for this are signed when on the github site.
uBlock Origin is a WebExtension.
*Always* check the changelogs BEFORE updating that important software!
-
WhackaScript
Posts: 2
Joined: Thu Sep 13, 2018 5:21 am

Re: 5.1.8.7rc4 is not signed

Post by WhackaScript »

I'm running FF v56.0.2 (currently with NoScript v5.1.8.6) and changed the about:config preference "xpinstall.signatures.required" from "True" to "False". However, FF still won't let me install the update to NoScript v5.1.8.7. FF pops up the message "This add-on could not be installed because it has not been verified" each time I try. Any solution here?
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
barbaz
Senior Member
Posts: 10834
Joined: Sat Aug 03, 2013 5:45 pm

Re: 5.1.8.7rc4 is not signed

Post by barbaz »

WhackaScript wrote:I'm running FF v56.0.2 (currently with NoScript v5.1.8.6) and changed the about:config preference "xpinstall.signatures.required" from "True" to "False". However, FF still won't let me install the update to NoScript v5.1.8.7. FF pops up the message "This add-on could not be installed because it has not been verified" each time I try. Any solution here?
So are you saying the answer to my question https://forums.informaction.com/viewtop ... 626#p98626 is "yes"?
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
therube
Ambassador
Posts: 7922
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Post by therube »

The "autoconfig.js" hack still works on FF 56 (Release version too).
So you can install unsigned extensions in Release versions of FF at least FF 55 & FF 56.
(I didn't check in later versions?)
(Slightly different method used for earlier versions.)


This was talked about on mozillazine.org & elsewhere some time back (more then a year ago, it seems).


Download link (click the word, 'Download', on the page), http://ge.tt/5W2Rxcr2
692 bytes.


My "FF-Bypass Add-on Signing Check (55+).zip" contents:

_readme55+.TXT:

Code: Select all

Copy mozilla.cfg to:

        instalDir\mozilla.cfg

Copy autoconfig.js to:

        instalDir\defaults\pref\autoconfig.js
mozilla.cfg:

Code: Select all

// mozilla.cfg file needs to start with a comment line

try {
  Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {}).
    eval("SIGNED_TYPES.clear()");
} catch (e) {}

try {
  Components.utils.import("resource://gre/modules/addons/XPIInstall.jsm", {}).
    eval("SIGNED_TYPES.clear()");
} catch (e) {}
autoconfig.js:

Code: Select all

// autoconfig.js file needs to start with a comment

pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0);
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
therube
Ambassador
Posts: 7922
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Post by therube »

While you're at it, you should make another "hackish" (if you will) change to prevent updates, http://forums.mozillazine.org/viewtopic ... #p14808936 (see the link to Frank's post in the thread below the linked post).
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
therube
Ambassador
Posts: 7922
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Post by therube »

Barbaz wrote:So are you saying the answer to my question viewtopic.php?p=98626#p98626 is "yes"?
Correct.
Without some "hack" method, as it is currently, an unsigned 5.1.8.7rc4 will not install in FF 56.

uBlock Origin is a WebExtension
The most recent Legacy version of uBlock, uBlock0.firefox-legacy_1.16.4.4.xpi, on github, is not signed & likewise will not install into FF 56 without some "hack".
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
WhackaScript
Posts: 2
Joined: Thu Sep 13, 2018 5:21 am

Re: 5.1.8.7rc4 is not signed

Post by WhackaScript »

@barbaz, I don't know enough about the topic to give you a definitive "yes" to your question (but looks like therube has confirmed that)--I just wanted to clarify that for at least Firefox v56.x the "xpinstall.signatures.required" preference referenced in the original post no longer works. According to a response I received today on a Mozilla Support Forum (https://support.mozilla.org/en-US/questions/1233587), that preference was disabled somewhere around version 48.

@therube, thanks for the "autoconfig.js" hack. Just tried it and works fine on FF v56.0.2 on Win 10 and Win 8.1.
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
harryray2
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Re: 5.1.8.7rc4 is not signed

Post by harryray2 »

Thanks for the hack...it solved a long standing problem for me...

Is it OK, once the unsigned extensions have been installed, to delete the two files mozilla.cfg and autoconfig.js from the firefox directory and just replace them when I need to install another unsigned extension?
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
harryray2
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Re: 5.1.8.7rc4 is not signed

Post by harryray2 »

Although this hack worked and I managed to install noscript I appear to be having problems installing some extensions..I'm getting a addon corrupt message.

How do i reverse the hack, do I have to change the about:config entries? I tried deleting the files but that stopped FF from starting.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
User avatar
therube
Ambassador
Posts: 7922
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Post by therube »

The hack is not likely the issue.
The hack allows you to install unsigned extensions.

If you make a change to the extension itself, & if the extension is signed, your change breaks the signing.
But (by default) extensions do need to be signed to be installed.
So you cannot make changes to extensions & expect them to work.
Well, unless you also remove the signing parts from the extension - or get them signed.
But if you remove the signing parts from the extension, the extension can no longer be installed because then the signing is missing.
But, if you use the hack, signing is not required, so you can make changes to the extension & they can be installed, so long as you remove the signing parts from the extension itself.
So (after backing up first) try removing the /META-INF/ directory from the extension & see if then works.
And again, that also assumes that you have made a change to an extension, which breaks the signing, & that you have something in place, a hack, or you're using some browser that does not require signing at all.
Isn't a bunch of crap that Mozilla makes you go through "for your security" (or whatever their "stated" reasons for putting you through that crap are).
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
harryray2
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Re: 5.1.8.7rc4 is not signed

Post by harryray2 »

Must admit, I do get fed up with a lot of the so called 'security' crap..some of which is totally unnecessary.

This started right after I installed the hack. I hadn't made any other changes either to FF or the add-on itself Is it possible that Mozilla has changed something that is 'breaking' the add-ons and making them corrupt?

I would be interested though on how to reverse the hack anyway just to give me a better understanding of things.

Btw, I'm using FF 55.0.3

Thanks.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Post Reply