alexveley
2.6 KiB
Signing for Firefox Release
Firefox Release and Beta will only keep an add-on that Mozilla has signed. Temporary add-ons from about:debugging are removed on restart. Developer Edition / Nightly can load unsigned builds if xpinstall.signatures.required is false — do not rely on that for daily use.
Mozilla signs through addons.mozilla.org even when the add-on is not listed in the store.
1. AMO developer account
- Register at addons.mozilla.org (Mozilla account).
- Open API credentials.
- Generate a JWT issuer (
user:…) and secret. - Store both in your password manager. Never commit them. Env names
WEB_EXT_API_KEY/WEB_EXT_API_SECRET.
2. Choose a channel
| Channel | What you get |
|---|---|
| unlisted | Signed .xpi for self-install. Not on the AMO store. Enough to survive Firefox restarts. Start here. |
| listed | Public AMO listing, automatic updates via Firefox. Needs listing metadata, review, and Add-on Policy compliance. |
Unlisted submissions can still be pulled for manual review. Native messaging is allowed; be ready to explain that the HTTP listener is the native host, bind is loopback-only, tokens are hashed at rest, and the extension does not accept onMessageExternal.
3. Sign (unlisted)
From this repo, with Node + web-ext 8+:
npm install -g web-ext
cd extension
web-ext sign --channel=unlisted --api-key $env:WEB_EXT_API_KEY --api-secret $env:WEB_EXT_API_SECRET
The gecko id in manifest.json must stay stable. Bump version for every new sign.
web-ext writes a signed .xpi under web-ext-artifacts/. Install it in Firefox from that file, or about:addons → gear → Install Add-on From File.
Keep the native host registered (tools/install-native-host.ps1). Signing replaces only the extension; the host is unchanged.
4. Updates
Bump version, sign again on the same channel and id. For unlisted self-distribution, updates need an update_url in browser_specific_settings.gecko if you want Firefox to auto-fetch. Until that exists, install a new .xpi by hand.
5. Listed (later)
web-ext sign --channel=listed plus AMO metadata (name Bookmarks API for Scripting and AI, license MIT, privacy policy from PRIVACY.md). Listing copy: local scripts only, loopback HTTP, bearer token, bookmarks allowlist. Do not title it “Firefox …”. Mozilla only allows “Name for Firefox”; this add-on uses neither form.