5.1.8.7rc4 is not signed

Bug reports and enhancement requests

5.1.8.7rc4 is not signed

Postby therube » Mon Sep 10, 2018 8:42 pm

NoScript 5.1.8.7rc4 is not signed.


Shouldn't it be?
Or is Mozilla no longer allowing signing of Legacy extensions at all?


If the latter, then there should be a note that the about:config Pref, xpinstall.signatures.required, needs to be toggled to false (for Firefox users, or other browsers that require signing - which might only be Firefox?).
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
therube
Ambassador
 
Posts: 7158
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Postby Giorgio Maone » Mon Sep 10, 2018 8:59 pm

therube wrote:NoScript 5.1.8.7rc4 is not signed.
Shouldn't it be?

It should, but...
therube wrote:Or is Mozilla no longer allowing signing of Legacy extensions at all?

This one.
therube wrote:If the latter, then there should be a note that the about:config Pref, xpinstall.signatures.required, needs to be toggled to false (for Firefox users, or other browsers that require signing - which might only be Firefox?).

There's one since 5.1.8.7 has been released this morning.
Ops, probably it should be duplicated in the dev build section as well. Doing that now...
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
User avatar
Giorgio Maone
Site Admin
 
Posts: 8625
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy

Re: 5.1.8.7rc4 is not signed

Postby barbaz » Tue Sep 11, 2018 2:56 am

Does this mean that Firefox 56 users won't be able to use any NoScript Classic updates beyond 5.1.8.7rc3, unless they switch to either the unbranded build, 52 ESR, SeaMonkey, or Waterfox?
*Always* check the changelogs BEFORE updating that important software!
Board search is currently partially broken: viewtopic.php?f=14&t=21752
Workaround: use your favorite search engine, add site:forums.informaction.com to your query
-
barbaz
Senior Member
 
Posts: 8675
Joined: Sat Aug 03, 2013 5:45 pm

Re: 5.1.8.7rc4 is not signed

Postby harryray2 » Tue Sep 11, 2018 9:32 pm

Why can't this be signed?...I'm using FF 55.0.3 and I have no intention of changing this

I also use ublock origin and all the updates for this are signed when on the github site.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
harryray2
 
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Re: 5.1.8.7rc4 is not signed

Postby barbaz » Tue Sep 11, 2018 10:02 pm

harryray2 wrote:Why can't this be signed?

already said -
Giorgio Maone wrote:
therube wrote:Or is Mozilla no longer allowing signing of Legacy extensions at all?

This one.



harryray2 wrote:I also use ublock origin and all the updates for this are signed when on the github site.

uBlock Origin is a WebExtension.
*Always* check the changelogs BEFORE updating that important software!
Board search is currently partially broken: viewtopic.php?f=14&t=21752
Workaround: use your favorite search engine, add site:forums.informaction.com to your query
-
barbaz
Senior Member
 
Posts: 8675
Joined: Sat Aug 03, 2013 5:45 pm

Re: 5.1.8.7rc4 is not signed

Postby WhackaScript » Thu Sep 13, 2018 5:27 am

I'm running FF v56.0.2 (currently with NoScript v5.1.8.6) and changed the about:config preference "xpinstall.signatures.required" from "True" to "False". However, FF still won't let me install the update to NoScript v5.1.8.7. FF pops up the message "This add-on could not be installed because it has not been verified" each time I try. Any solution here?
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
WhackaScript
 
Posts: 2
Joined: Thu Sep 13, 2018 5:21 am

Re: 5.1.8.7rc4 is not signed

Postby barbaz » Thu Sep 13, 2018 12:14 pm

WhackaScript wrote:I'm running FF v56.0.2 (currently with NoScript v5.1.8.6) and changed the about:config preference "xpinstall.signatures.required" from "True" to "False". However, FF still won't let me install the update to NoScript v5.1.8.7. FF pops up the message "This add-on could not be installed because it has not been verified" each time I try. Any solution here?

So are you saying the answer to my question viewtopic.php?p=98626#p98626 is "yes"?
*Always* check the changelogs BEFORE updating that important software!
Board search is currently partially broken: viewtopic.php?f=14&t=21752
Workaround: use your favorite search engine, add site:forums.informaction.com to your query
-
barbaz
Senior Member
 
Posts: 8675
Joined: Sat Aug 03, 2013 5:45 pm

Re: 5.1.8.7rc4 is not signed

Postby therube » Thu Sep 13, 2018 11:34 pm

The "autoconfig.js" hack still works on FF 56 (Release version too).
So you can install unsigned extensions in Release versions of FF at least FF 55 & FF 56.
(I didn't check in later versions?)
(Slightly different method used for earlier versions.)


This was talked about on mozillazine.org & elsewhere some time back (more then a year ago, it seems).


Download link (click the word, 'Download', on the page), http://ge.tt/5W2Rxcr2
692 bytes.


My "FF-Bypass Add-on Signing Check (55+).zip" contents:

_readme55+.TXT:
Code: Select all
Copy mozilla.cfg to:

        instalDir\mozilla.cfg

Copy autoconfig.js to:

        instalDir\defaults\pref\autoconfig.js


mozilla.cfg:
Code: Select all
// mozilla.cfg file needs to start with a comment line

try {
  Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm", {}).
    eval("SIGNED_TYPES.clear()");
} catch (e) {}

try {
  Components.utils.import("resource://gre/modules/addons/XPIInstall.jsm", {}).
    eval("SIGNED_TYPES.clear()");
} catch (e) {}


autoconfig.js:
Code: Select all
// autoconfig.js file needs to start with a comment

pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0);
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
therube
Ambassador
 
Posts: 7158
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Postby therube » Thu Sep 13, 2018 11:52 pm

While you're at it, you should make another "hackish" (if you will) change to prevent updates, http://forums.mozillazine.org/viewtopic.php?p=14808936#p14808936 (see the link to Frank's post in the thread below the linked post).
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
therube
Ambassador
 
Posts: 7158
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Postby therube » Thu Sep 13, 2018 11:54 pm

Barbaz wrote:So are you saying the answer to my question viewtopic.php?p=98626#p98626 is "yes"?

Correct.
Without some "hack" method, as it is currently, an unsigned 5.1.8.7rc4 will not install in FF 56.


uBlock Origin is a WebExtension

The most recent Legacy version of uBlock, uBlock0.firefox-legacy_1.16.4.4.xpi, on github, is not signed & likewise will not install into FF 56 without some "hack".
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
therube
Ambassador
 
Posts: 7158
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Postby WhackaScript » Fri Sep 14, 2018 1:36 am

@barbaz, I don't know enough about the topic to give you a definitive "yes" to your question (but looks like therube has confirmed that)--I just wanted to clarify that for at least Firefox v56.x the "xpinstall.signatures.required" preference referenced in the original post no longer works. According to a response I received today on a Mozilla Support Forum (https://support.mozilla.org/en-US/questions/1233587), that preference was disabled somewhere around version 48.

@therube, thanks for the "autoconfig.js" hack. Just tried it and works fine on FF v56.0.2 on Win 10 and Win 8.1.
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
WhackaScript
 
Posts: 2
Joined: Thu Sep 13, 2018 5:21 am

Re: 5.1.8.7rc4 is not signed

Postby harryray2 » Fri Sep 14, 2018 5:12 am

Thanks for the hack...it solved a long standing problem for me...

Is it OK, once the unsigned extensions have been installed, to delete the two files mozilla.cfg and autoconfig.js from the firefox directory and just replace them when I need to install another unsigned extension?
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
harryray2
 
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Re: 5.1.8.7rc4 is not signed

Postby harryray2 » Thu Oct 04, 2018 6:47 pm

Although this hack worked and I managed to install noscript I appear to be having problems installing some extensions..I'm getting a addon corrupt message.

How do i reverse the hack, do I have to change the about:config entries? I tried deleting the files but that stopped FF from starting.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
harryray2
 
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Re: 5.1.8.7rc4 is not signed

Postby therube » Fri Oct 05, 2018 11:04 am

The hack is not likely the issue.
The hack allows you to install unsigned extensions.

If you make a change to the extension itself, & if the extension is signed, your change breaks the signing.
But (by default) extensions do need to be signed to be installed.
So you cannot make changes to extensions & expect them to work.
Well, unless you also remove the signing parts from the extension - or get them signed.
But if you remove the signing parts from the extension, the extension can no longer be installed because then the signing is missing.
But, if you use the hack, signing is not required, so you can make changes to the extension & they can be installed, so long as you remove the signing parts from the extension itself.
So (after backing up first) try removing the /META-INF/ directory from the extension & see if then works.
And again, that also assumes that you have made a change to an extension, which breaks the signing, & that you have something in place, a hack, or you're using some browser that does not require signing at all.
Isn't a bunch of crap that Mozilla makes you go through "for your security" (or whatever their "stated" reasons for putting you through that crap are).
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.5
User avatar
therube
Ambassador
 
Posts: 7158
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: 5.1.8.7rc4 is not signed

Postby harryray2 » Fri Oct 05, 2018 1:07 pm

Must admit, I do get fed up with a lot of the so called 'security' crap..some of which is totally unnecessary.

This started right after I installed the hack. I hadn't made any other changes either to FF or the add-on itself Is it possible that Mozilla has changed something that is 'breaking' the add-ons and making them corrupt?

I would be interested though on how to reverse the hack anyway just to give me a better understanding of things.

Btw, I'm using FF 55.0.3

Thanks.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
harryray2
 
Posts: 16
Joined: Wed Mar 08, 2017 4:53 pm

Next

Return to NoScript Development

Who is online

Users browsing this forum: No registered users and 2 guests