Page 1 of 1

Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 18:40
by seaside
This tweak doesn't help since you've updated pale moon keeping the addon signature enforcement .. .
xpinstall.signatures.required;false


It's a good joke, that new signature enforcement, anyone can sign an xpi & post it anywhere.

The benefices of addon signature enforcement are:

-Ignoring all tweaked- version compatibility & pale moon id modified versions
-because the signed string isn't present in all those files, downloaded from firefox, elsewhere or tweaked,
checking for addon updates lead to filling the "available updates" section of about:addons with every users installed addons.

If i'm retarded, here's my option:

i add the signed compatibility & reinstall all my addons losing the tweaked addons, app id modified versions & version compatibility updated versions
which literally sends me to hell.

if i'm i have a brain..

i'll wait for an option, even in about:config to prevent pale moon from considering the ".1-signed" string during addons update verifications.
or eventually, which is even better, an automatic behavior in next version of pale moon.

if not considered:

go beg coders who care about the stupidity that mozilla offers in every new update to create an addon or userscript that prevents it to happen.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 20:50
by Moonchild
I'm not entirely sure that I follow your point.

What bug is there that you reported, exactly?
Or did you just want to voice your disenchantment with the mass-signing done by Mozilla, causing an update of Firefox-addons installed in Pale Moon?

Of note: Pale Moon will never enforce extensions to be signed.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 21:36
by seaside
pale-moon wont ever force extensions to be signed ?

Image

pale-moon believes i have to reinstall almost all my addons because they're not signed like mozilla want them to appear in my extensions window (.1-signed)

which would cause the loss of tweaked versions, & version compatibility tweaked versions like those where the app id has been modified for a pale-moon compatibility.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 21:39
by seaside
what i'd like is that palemoon ignores the ".1-signed" while checking for updates on the mozilla site. because 85% of my addons from mozilla are working fine, so i don't want them to be replaced
with the (.1-signed) string & lose my tweaks.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 21:43
by seaside
if i follow mozilla' stupidity, i lose my tweaks & some badly written addons will have user based options overridden. i cannot check what's really available because of that new signature forcing users
to reinstall all addons

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 22:18
by Moonchild
So, you're complaining because you've manually edited add-ons to make them work, and expect Pale Moon to ignore extension updates when they happen so you won't lose your edits? Then simply disable automatic updates for extensions.
Your edits would be overwritten by any extension that receives an update, whether it's because of signing or because of an actual functional update. That doesn't necessarily have anything to do with Mozilla-signing. You would have to manually update your extensions anyway in your case, since you need to re-edit the files each time there is an update.

You have to understand that any and all Firefox extensions from this point forward will be signed by Mozilla because they are going to enforce signed extensions (well, in "their" way signed) in the near future. The .1-signed suffix only exists because of this one-time bulk-signing of their entire collection of extensions, server-side. Any new versions of extensions uploaded to addons.mozilla.org will automatically be signed when they are reviewed, in the future.

Pale Moon's bout of updates to .1-signed versions of extensions you have installed are the result of Mozilla bumping the version of all extensions they have on file this way while they are being Mozilla-signed. Pale Moon is simply (correctly) following what the Firefox add-ons site tells it (that there is an update available). There is no bug in Pale Moon, and this is entirely Mozilla's doing. The fact that you see "-signed" extension versions for your (note!) Firefox extensions installed in Pale Moon has nothing to do with whether Pale Moon will require it or not; it's just a matter of whether the update offered by Mozilla is signed (and marked as such).

Does that clarify how it works?

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 22:46
by seaside
1. disable automatic updates for extensions
-i never had them to auto update.
3. You would have to manually update your extensions anyway in your case
-i always do if that extension needs compatibility updates, but it's impossible for me to know what's available because all addons hosted by mozilla must be updated & palemoon authors follow the "addon tweaks castration", but i cannot update everything, because the mozilla team decided that if i need to see available updates, i must update all my addons including tweaked ones.
3. Pale Moon is simply (correctly) following what the Firefox add-ons site tells it (that there is an update available).
-ok, i accept your deal to not make an effort in order to make pale moon ignore the ".1-signed" mozilla addon signature, so people are forced
to seek a userscript or create a new addon, to make sure they can see what is "really" available & do not have already installed in terms of updates,
without overriding all addons because you follow mozilla's addon castration.

kind regards.

Ps: i've never obtained in almost 2 years an update or option from suggestions & i'm not surprised, even though palemoon is still better than firefox, but still buttsniffing them,
i'll take the option of finding someone who can write a script for it & not force people to override their installed addons in order to see available updates.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 22:49
by seaside
"3. Pale Moon is simply (correctly) following what the Firefox add-ons site tells it (that there is an update available)"

i also agree, the update to all installed addons is:

"mozilla signature".

shall i consider it as a valuable update in terms of objectivity & what does it add to the addon in terms of programation ?:
SHIT.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-05-31, 23:37
by New Tobin Paradigm
I take great offense at your implications and direct insults. Every effort has been made to ensure that add-ons from AMO from v25 onward are not going to be an issue.

Here is the process of what happens.

- Pale Moon checks the Pale Moon Add-ons Site by a query to the web server.
- The site checks its own list of add-ons by ID if it finds no match it sends the request to AMO
- AMO responds if it finds a match with an xml file.
- The Add-on manager does a compare between the version installed and the version in the xml file
- If the version in the XML file is newer it presents an update

In this way we are able to provide updates for both Pale Moon Specific Add-ons and Mozilla Add-ons. The Mozilla signature is largely immaterial to anything Pale Moon related it is simply there.. If you chose not to update or update manually that is your choice. We are monitoring the situation but there is no reason why we shouldn't send requests for Add-on update checks to AMO as long as it will still work.

As for your distaste for their decisions I understand them but I will not accept you spewing venom on us because you are disgruntled. We will not break the ability to update AMO hosted add-ons unless it presents a significant issue to Pale Moon users. This is not presently the situation so it shall continue. That being said, as time moves on I hope to significantly reduce the reliance on AMO and work is proceeding to that end.

Updates from AMO is being evaluated here: https://github.com/Pale-Moon-Addons-Team/phoebus/issues/4

As for your edited add-ons if you want to 100% ensure that they will not be served an inappropriate update.. Take a cue from the old Pseudo-Statics and most of our forks.. Change the extension ID.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-06-01, 00:04
by seaside
Sorry guys, it was driving me nuts. i'm overreacting because since the creation of mozilla, we've all been facing issues with updates affecting the functionality of addons, there's always something wrong
& authors of those addons abandoning projects & i have been struggling to find available contributors to fix some addons or keep them compatible not always successfully, so this invasion from mozilla
was like a step too far. i've watched the whole list & unchecked 3 addons that musn't be updated then added their stupid 1-signed signature enforcement reinstalling them.
i was scared to see that new verification overriding addons that had been modified for version compatibility, but everything's fine.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-06-01, 07:42
by Moonchild
Have a cup of chai or something, and take it easy ;)

Moved this to the correct board since this is not even remotely a Pale Moon bug.

Re: Firefox (.1-signed) new addon signature enforcement

Posted: 2015-06-01, 07:51
by seaside
you could delete the topic, i really need a drink ((