Signing XPI package about ipfs-companion HOT 2 CLOSED

Seems this will be soon a mandatory thing:

We announced that we will require extensions to be signed in order for them to continue to work in release and beta versions of Firefox. If you’re an extension developer, please read the post and participate in the discussions. We will be posting a followup expanding on the reasons behind this initiative.
– https://blog.mozilla.org/addons/2015/04/08/add-ons-update-63/

from ipfs-companion.

Ok, seems that the change will be quite big:

Extensions that are submitted for hosting on AMO and pass review will be automatically signed. We will also automatically sign the latest reviewed version of all currently listed extensions.

There will be a transition period of two release cycles (12 weeks total) during which unsigned extensions will only generate a warning in Firefox.

After the transition period, it will not be possible to install unsigned extensions in Release or Beta versions of Firefox. There won’t be any preferences or command line options to disable this.

– https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/

As Mozilla will do the signing, I think this ticket can be closed.

Digression
I guess I'll have to stop attaching .xpi to github releases, as unsigned packages will not work with future Firefox, so there is no point in doing them.

People who want to do SECURITY.md check, will build xpi themselves anyway.
The only difference will be the signature added by Mozilla.

from ipfs-companion.