alexveley
46 lines
2.6 KiB
Markdown
46 lines
2.6 KiB
Markdown
# Signing for Firefox Release
|
|
|
|
Firefox Release and Beta will only keep an add-on that Mozilla has signed. Temporary add-ons from `about:debugging` are removed on restart. Developer Edition / Nightly can load unsigned builds if `xpinstall.signatures.required` is false — do not rely on that for daily use.
|
|
|
|
Mozilla signs through [addons.mozilla.org](https://addons.mozilla.org/) even when the add-on is **not** listed in the store.
|
|
|
|
## 1. AMO developer account
|
|
|
|
1. Register at [addons.mozilla.org](https://addons.mozilla.org/) (Mozilla account).
|
|
2. Open [API credentials](https://addons.mozilla.org/developers/addon/api/key/).
|
|
3. Generate a JWT **issuer** (`user:…`) and **secret**.
|
|
4. Store both in your password manager. Never commit them. Env names `WEB_EXT_API_KEY` / `WEB_EXT_API_SECRET`.
|
|
|
|
## 2. Choose a channel
|
|
|
|
| Channel | What you get |
|
|
|---------|----------------|
|
|
| **unlisted** | Signed `.xpi` for self-install. Not on the AMO store. Enough to survive Firefox restarts. **Start here.** |
|
|
| **listed** | Public AMO listing, automatic updates via Firefox. Needs listing metadata, review, and Add-on Policy compliance. |
|
|
|
|
Unlisted submissions can still be pulled for manual review. Native messaging is allowed; be ready to explain that the HTTP listener is the **native host**, bind is loopback-only, tokens are hashed at rest, and the extension does not accept `onMessageExternal`.
|
|
|
|
## 3. Sign (unlisted)
|
|
|
|
From this repo, with Node + `web-ext` 8+:
|
|
|
|
```powershell
|
|
npm install -g web-ext
|
|
cd extension
|
|
web-ext sign --channel=unlisted --api-key $env:WEB_EXT_API_KEY --api-secret $env:WEB_EXT_API_SECRET
|
|
```
|
|
|
|
The gecko id in `manifest.json` must stay stable. Bump `version` for every new sign.
|
|
|
|
`web-ext` writes a signed `.xpi` under `web-ext-artifacts/`. Install it in Firefox from that file, or `about:addons` → gear → Install Add-on From File.
|
|
|
|
Keep the native host registered (`tools/install-native-host.ps1`). Signing replaces only the extension; the host is unchanged.
|
|
|
|
## 4. Updates
|
|
|
|
Bump `version`, sign again on the same channel and id. For unlisted self-distribution, [updates](https://extensionworkshop.com/documentation/manage/updating-your-extension/) need an `update_url` in `browser_specific_settings.gecko` if you want Firefox to auto-fetch. Until that exists, install a new `.xpi` by hand.
|
|
|
|
## 5. Listed (later)
|
|
|
|
`web-ext sign --channel=listed` plus AMO metadata (name **Bookmarks API for Scripting and AI**, license MIT, privacy policy from [PRIVACY.md](../PRIVACY.md)). Listing copy: local scripts only, loopback HTTP, bearer token, bookmarks allowlist. Do not title it “Firefox …”. Mozilla only allows “Name for Firefox”; this add-on uses neither form.
|