Sign addon - https://wiki.mozilla.org/Addons/Extension_Signing

AlecTaylor
Unfortunately with the latest versions of Firefox it is no longer possible to disable extension signing.

It's fine to keep hosting it externally to addons.mozilla.org, however it needs to be signed in order to enable installation on newer Firefox versions.

Details: https://wiki.mozilla.org/Addons/Extension_Signing

Thanks
  • dstillman
    edited November 6, 2015
    That's incorrect. As it says on that page, Firefox 40, which is the current release version, does not require extension signing. Firefox 41, which is the current beta version, allows it to be disabled via xpinstall.signatures.required.

    Zotero will be signed before Firefox 41 is released.

    Edit: The deadline was pushed back. See below.
  • AlecTaylor
    edited August 14, 2015
    Ah, well I'm running 43 (alpha/nightly).

    So the sooner it's signed the better it is [for us early adopters at least].
  • dstillman
    In Nightly and Developer Edition you can turn off the signing requirement by disabling xpinstall.signatures.required. (It also says that on the page you linked to.)
  • dstillman
    Zotero 4.0.28.3, available now, is signed by Mozilla.

    We'll try to get the word processor integration plugins signed in the next few days.
  • dstillman
    Just to note, Firefox extension signing enforcement was pushed back to Firefox 43 (with the xpinstall.signatures.required preference not being removed until Firefox 44), so Zotero releases may not all be signed in the interim. Zotero 4.0.28.4, which was just released, isn't signed.
  • leewalsh
    edited November 7, 2015
    I've found that the best solution easiest solution without changing settings for all firefox extensions is just to use the most recent signed version, available at:
    https://download.zotero.org/extension/zotero-4.0.28.3.xpi
  • adamsmith
    edited November 7, 2015
    While you're obviously free to do what works for you, no, that's not the best solution (e.g. we won't do any troubleshooting here for people running older Zotero versions.)

    The best solution is to either use the current Firefox version, which works with unsigned add-ons or, if you do want to run the beta version of Firefox, set the signatures.required preference to false.
  • mretegan
    Are there any reasons why the extension is not signed?
  • DWL-SDCA
    I am only a Zotero user and have nothing to do with Zotero development.

    Zotero is a complex add-on with zillions of lines of code. Mozilla is still finalizing the in-house signing procedures for reviewing complex extensions. Thus, Mozilla delayed the requirements to a later FF version.

    See:
    https://developer.mozilla.org/en-US/Add-ons/Distribution

    Note that the signing approval time may require "weeks" of waiting. Tedious at best for getting updates and bug fixes out to Zotero users.
  • adamsmith
    yes, what DWL says -- it's a hassle for both sides and Zotero will only get signed once it's actually necessary (that's why the 4.0.28.3 version was signed, in light of the originally announced FF 41 requirement for signing), but the fact that there was an earlier signed release tells you that
    a) there isn't anything problematic about Zotero from mozilla's point of view (changes since then have been tiny) and
    b) Zotero and mozilla have figured out a way to get Zotero's enormous code base reviewed in a timely way, so you can count on it being signed in time for the FF 43 release.
  • mretegan
    Following this logic implies that signing of versions after 4.0.28.3 should be very fast since only small modifications were made to the code. I hope this will be done by the time FF 43 is released next month.
  • dstillman
    Zotero 4.0.28.9, available now, is signed for use in Firefox 43, which will be out on December 15th. After some discussions we had with Mozilla, they've changed their signing procedures to ensure that releases of Zotero and other externally hosted extensions won't be subject to delays.
  • ChristianR
    Hmm, not sure what is the problem:
    Zotero 4.0.28.9 (2015-12-12) on Firefox 43.0 / Win7x64.
    Zotero is deactivated with message "could not be verified for usage in Firefox and was deactivated" (translated from German)
  • adamsmith
    try re-installing from zotero.org/download
  • ChristianR
    thanks adamsmith. I did that, strangely now Zotero Plugin seems active (I can click and use the toolbar logo) but the deactivation message is still showed:
    http://up.picr.de/23995442ay.png
    Do others have the same situation or is there something odd?
  • adamsmith
    Fine for me on Win7 and Linux.
    Maybe related to localization (though it shouldn't be)? @zuphilip, does this work for you?
  • iGor.m
    Fine for me too on Debian Jessie, Iceweasel 43 and Zotero 4.0.28.9. I tried to install the plugin for LibreOffice, without any problem.

    My local is fr_CH.
  • zuphilip
    @adamsmith: Fine for me on Win8 with German locales.
  • adamsmith
    so Christian, to answer your question -- definitely something odd on your end, yes.
    You could check if any of the other addons are interfering (i.e. restart with all others disabled).
  • ChristianR
    @adamsmith: I did that. Now everything is deactivated including Zotero (did deactivate again without my action, can not activate again). Seems Zotero working was only a temporary situation.
    I forgot to say that I use Firefox Portable. Maybe there is a difference to the standard installation influencing Add-Ons and/or Zotero.
    Not sure what to try next. I could install/try Firefox normally, but that will not solve the problem that I see no way to not continue to use Firefox Portable (various reasons).
  • ChristianR
    I do not know if this is expected to do for Zotero in Firefox but now in about:config I changed xpinstall.signatures.required to false.
    Zotero now works but a warning message for all 3 Zotero Add-Ons (Zotero, LibO Integration, RTF/ODF Scan) is displayed: "... could not be verified, continue with caution"
  • dstillman
    edited December 17, 2015
    All Zotero-produced extensions are signed, so xpinstall.signatures.required shouldn't be necessary if you have the latest versions.

    If you're using Firefox Portable I'm afraid you're on your own, but there are definitely still some bugs around signature verification in Firefox — I've seen the same bug as you (enabled but with an erroneous validation message) in different test profiles, and some other extensions developers have reported similar issues, so it's not a Zotero issue. I'd try trashing extensions.json in the Firefox profile directory and, if necessary, reinstalling the extensions. See next post for recommended steps.
  • dstillman
    If you're seeing problems with Firefox reporting the latest versions of Zotero extensions as unverified, it'd be great if you could send a copy of the extensions.json file in your Firefox profile directory to support@zotero.org so that we can report this to Mozilla. After that, I'd guess that uninstalling the affected extension and reinstalling it would do the trick.
  • ChristianR
    Thank you Dan!!!
    I did follow your advise to uninstall and reinstall all Zotero extensions and now everything seems fine.
    I did create a extensions.json.zip before but unfortunately I did accidentally overwrite it later when preparing the email to support@zotero.org
    So I do not think sending the current extensions.json is helping anymore.
  • Julien Demade
    Same problem as Christian, with Ubuntu 14.04, Zotero 4.0.28.9 on Firefox 43.0; French locale. The solution worked as well, I hoped you got the json file well.
    Same problem as well for my wife (Windows 10), solution worked as well.
  • dstillman
    OK, so it seems like, in the cases where Firefox is disabling 4.0.28.9, Firefox thinks Zotero was at some point side-loaded — meaning installed into Firefox some way other than a direct install from zotero.org. If you're experiencing this, it'd be good to know if you recall anything special about your Zotero installation history on the affected computer. Did you previously use (or are you currently using) Firefox Portable? Have you used MLZ/Juris-M (though I'm not sure why that would matter)? Does anything else come to mind?

    (The relevant flag here is foreignInstall: true or foreignInstall: 1 in extensions.json for the zotero@chnm.gmu.edu entry, which indicates that Firefox thinks Zotero was once side-loaded.)

    It's certainly a Firefox bug that this issue is persisting through a manual reinstall from zotero.org — and Mozilla will hopefully fix that — but it'd be good to know if there are any common patterns that are causing Firefox to think this in the first place.
  • dstillman
    Also, if you're experiencing this, are you seeing the same thing with other extensions? All other extensions? Some? If some, any pattern in installation history to the ones it's happening for?
  • dstillman
    We've just pushed out a new version of Zotero, 4.0.28.10, that should fix this problem — we still don't know why it's happening, but we asked Mozilla to toggle a flag on our extensions that should prevent them from being disabled if Firefox (mistakenly) thinks they're side-loaded.

    New versions of the word processor integration plugins will be out shortly with the same fix.
  • Julien Demade
    Nothing comes to mind relating to the installation process, and the possibilities you mention are not valid in our case.
    No problem with other extensions (except the Libre office integration plugin). And the problem with Zotero was new from today in both our cases - is that a clue maybe?
    Great for the fix, thanks for all the work, and sorry for not being able to be more specific!
  • dstillman
    New versions of the word processor plugins are now out as well. If you're still having trouble, check for updates from the Firefox add-ons pane or reinstall the latest versions manually from zotero.org. There's no longer a need to uninstall anything first.

    From the files that people have sent us, it looks like this issue — Firefox thinking extensions are side-loaded — applies to various extensions people have installed, but most wouldn't be disabled because they're either distributed from the Mozilla add-ons site or were configured to allow side-loading. Mozilla has enabled the side-loading flag for us, even though we shouldn't need it, while they investigate this issue.
Sign In or Register to comment.