Firefox / Librewolf unsigned add-ons

In short:

Enable unsigned add-ons by setting xpinstall.signatures.required to false in about:config.

Make sure the add-on manifest.json has an id, as in the following:

   "browser_specific_settings": {
      "gecko": {
        "id": "zhongwen@example.org"
      }
    },

 Zip the add-on into an 'xpi' file:

    $ zip -r -FS ../zhongwen.xpi * --exclude '*.git*'

Then install the add-on from the about:addons page.

 

But it took me an unreasonably long time to learn to do this because Mozilla doesn't document it very well.

Mozilla has various guides to developing add-ons but they are all oriented towards having them signed by Mozilla. They say that it is possible to install unsigned add-ons to select versions of Firefox but give only hints about what is required.

Some add-ons that install successfully as a temporary add-on, via about:debugging, cannot be installed permanently as an unsigned add-on, with the unhelpful message:

Installation aborted because the add-on appears to be corrupt.

They could have omitted "because..." - it would have made the message no less informative.

Mozilla support gets reports of the message but offers no explanation. Multiple reports, with all sorts of complex details but no overview of how an add-on might be corrupt or how to diagnose the problem, just specific trial and error advice. Mozilla is getting to be as bad as Microsoft.

The browser console has more information:

1645324229834 addons.xpi WARN Invalid XPI: Error: Cannot find id for addon /home/ian/dev/zhongwen.xpi(resource://gre/modules/addons/XPIInstall.jsm:1531:19) JS Stack trace: loadManifest@XPIInstall.jsm:1531:19

Why isn't the error message to the user: Installation aborted because the add-on does not have an id? Or some such? None the less, if one jumps through enough esoteric hoops, the information is available.

So, how to provide an ID? 

This page gives some hints. 

The workshop gives some hints. Mostly it tells you that you don't have to set an ID explicitly and when you do have to set and ID explicitly. At the very end (did you read all the way through the irrelevant details to the last sentence?) it says:

See browser_specific_settings in manifest.json for the syntax of setting the extension ID.

Could they have made it any less obvious? I don't think so. To make it this obscure, one would have to be deliberately trying to make it difficult to succeed in any way other than having the add-on signed by Mozilla, and one would have to develop and refine the obscurity with diligence.

In any case, the documentation of browser_specific_settings describes the id, including the two supported formats.

So, I edited manifest.json of my plugin, adding:

   "browser_specific_settings": {
      "gecko": {
        "id": "zhongwen@example.org"
      }
    },

They don't say anything more about this format than: a string formatted like an email address, and the guidance that if it is a real email address it will attract spam. This suggests that it doesn't have to be a real email address: it just has to have the format of an email address. There is nothing about whether or how the address is used or validated, uniqueness constraints or anything else. Really, it just describes the syntax and that is all.

I then zipped the contents of the add-on directory, excluding the .git directory, to an xpi file (which is just a zip file with a unconventional extension):

    $ zip -r -FS ../zhongwen.xpi * --exclude '*.git*'

I also set 'xpinstall.signatures.required' to false via about:config.

I was then able to install the add-on.

Why do they need an ID when they don't need it to install temporarily? Obviously they don't need it, otherwise they would need it to install the add-on temporarily. It is an arbitrary restriction, making installation more difficult without adding any obvious value and possibly without adding any value at all. One more brick in the wall.

I have installed the add-on to Librewolf and a Nightly build of Firefox. It seems to work OK.