A Look at Extension Signing In Firefox 40

Finally got around to creating (actually cloning) new profiles today and installing the Nightly 42, Developer’s Edition (Aurora) 41 and Beta 40 of Firefox. As I am sure you know by now, Mozilla is starting Extension Signing with Firefox 40. So, what does this mean in the upcoming Firefox 40 (ETA August 11th)? In Firefox 40, it is just warnings…warnings in the add-on manager and a warning when you attempt to install and unsigned (or unverified) add-on. Below is a screenshot of my add-ons manager in Firefox 40. First thing I noticed was the slight change in the UI with the darker side bar and the addition of ‘Experiments’ menu item (might be used in the future for Idea Town).

Add-ons manager in Firefox 40.

Add-ons manager in Firefox 40.

As you can see I have a couple add-ons that can not “be verified”. Clicking the More information link takes you to the Mozilla support page about add-on signing. Something interesting here is Forecastfox shows as unverified even though it is hosted on AMO. Turns out Forecastfox is no longer compatible with Firefox so it was not automatically signed. For those who are looking for a replacement Oleksandr has created Forecastfox (fix version).

So, what happens when you try to install an unsigned (or unverified) add-on? In Firefox 40 you will get this warning:

Warning when attempting to install an unsigned extension.

Warning when attempting to install an unsigned add-on.

Starting in Firefox 41 (ETA September 22nd) the installation of an unsigned/unverified add-on will be blocked. However, users can disable this (I am assuming via about:config). Firefox 41 is currently in the Developer’s Edition channel which like the Nightly channel will still allow installation after the warning (as I found out earlier today). So, I will need to wait until Firefox 41 moves into the Beta channel (mid August) to see what happens with that version and how you can force installation. Firefox 42 (ETA November 3rd) will not allow an unsigned/unverified add-on to be installed, period. Again, will need to wait for that version to reach Beta in late September to see how that works.