44
edits
Changes
Resolve references to external documentation; remove note about obsolete beta channels
refs:
* https://dxr.mozillasearchfox.org/mozilla-central/source/toolkit/mozapps/extensions/internal/XPIProvider.jsm
* https://developer.mozilla.org/en-US/docs/Signing_a_XPI
== Documentation ==
* [httphttps://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/ Introducing Extension Signing], Add-ons Blog.
* [https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/ The Case for Extension Signing], Add-ons Blog.
* [https://bugzilla.mozilla.org/show_bug.cgi?id=signed-addons Main tracking bug].
* How do I get my add-ons signed if they are not hosted on addons.mozilla.org (AMO)?
** You will need to create an AMO account and submit your add-on. There will be an option where you indicate the add-on won't be listed on AMO, and you'll be able to submit your add-on files without having them published on the site. Please read the [https://developer.mozilla.org/en-US/Add-ons/Distribution Distribution Policy] for more details.
** You can also use the [https://developerextensionworkshop.mozilla.orgcom/documentation/develop/enweb-US/Addext-command-onsreference/SDK/Tools/jpm#jpm_sign jpm web-ext-sign web-ext sign] command to generate a signed XPI that can be self-hosted.** There is an [httphttps://olympiaaddons-server.readthedocs.orgio/en/latest/topics/api/signing.html API you can use] for signing.
* How does the signing process work for unlisted add-ons?
** For unlisted add-ons, files submitted for signing go through an automated review process. If they pass this review, they are automatically signed and a download link is sent back to the developer. This process should normally take seconds.
** There is an [httphttps://olympiaaddons-server.readthedocs.orgio/en/latest/topics/api/signing.html API you can use] for signing. * What about [https://developer.mozilla.org/en-US/Add-ons/AMO/Policy/Maintenance#How_do_I_submit_a_Beta_add-on.3F Beta versions on AMO]? Will they be reviewed and signed?** Yes. Beta versions will be treated like non-AMO add-ons. They will be automatically validated and signed if they pass validation.
* Will I need to sign the custom version of an existing add-on I created with my own code changes, locale additions, etc.?
* Will there be an upload and signing API so I don't have to manually upload each new version of the add-on?
** Yes. The [httphttps://olympiaaddons-server.readthedocs.orgio/en/latest/topics/api/signing.html signing API is documented here].
* Will this protect users against all forms of add-on malware?
