decision: how 1.0.0 is distributed on Firefox (signing) and on Chrome (store or CRX) #386

Open
opened 2026-09-21 09:19:21 +02:00 by clawbot · 0 comments
Collaborator

Two questions only the owner can settle, both blocking a usable 1.0.0 for anyone who is not building from source. README.md already states the facts; what is missing is the decision.

Firefox

make package produces an UNSIGNED .xpi. Release Firefox and ESR refuse it outright; only Developer Edition, Nightly or an Unbranded build with xpinstall.signatures.required=false install it permanently, and a temporary add-on is gone at browser exit. Signing means submitting to AMO with the owner's credentials.

Options:

  • (a) AMO self-distribution signing (unlisted): the XPI is signed and installable on every Firefox, nothing is listed publicly, and the repo gains a documented step that only the owner runs. Recommended.
  • (b) AMO listed: as (a) plus a public listing and AMO review.
  • (c) Ship unsigned and state that Firefox support means Developer Edition or an Unbranded build.

Chrome

manifest/chrome.json carries the fixed public key, so the extension id is stable, but the repo packs no CRX and publishes nothing.

Options:

  • (a) Chrome Web Store, unlisted: installable on every Chrome, updates delivered by the store, needs the owner's developer account. Recommended.
  • (b) Self-hosted CRX signed with the private key the owner holds: Chrome only installs it via enterprise policy on Windows and macOS, so it is realistically Linux-only.
  • (c) "Load unpacked" from dist/chrome/ only, as today.

Definition of done

  • The owner records one choice per browser on this issue.
  • The chosen steps, including which credentials they need and who holds them, are written into the release procedure (#387) and README.md's installation sections are updated to match.
  • Any repo change the choice needs (for example an AMO signing script or a store listing checklist) is filed as its own issue.

model: claude-fable-5

Two questions only the owner can settle, both blocking a usable 1.0.0 for anyone who is not building from source. `README.md` already states the facts; what is missing is the decision. ## Firefox `make package` produces an UNSIGNED `.xpi`. Release Firefox and ESR refuse it outright; only Developer Edition, Nightly or an Unbranded build with `xpinstall.signatures.required=false` install it permanently, and a temporary add-on is gone at browser exit. Signing means submitting to AMO with the owner's credentials. Options: - (a) AMO self-distribution signing (unlisted): the XPI is signed and installable on every Firefox, nothing is listed publicly, and the repo gains a documented step that only the owner runs. Recommended. - (b) AMO listed: as (a) plus a public listing and AMO review. - (c) Ship unsigned and state that Firefox support means Developer Edition or an Unbranded build. ## Chrome `manifest/chrome.json` carries the fixed public `key`, so the extension id is stable, but the repo packs no CRX and publishes nothing. Options: - (a) Chrome Web Store, unlisted: installable on every Chrome, updates delivered by the store, needs the owner's developer account. Recommended. - (b) Self-hosted CRX signed with the private key the owner holds: Chrome only installs it via enterprise policy on Windows and macOS, so it is realistically Linux-only. - (c) "Load unpacked" from `dist/chrome/` only, as today. ## Definition of done - [ ] The owner records one choice per browser on this issue. - [ ] The chosen steps, including which credentials they need and who holds them, are written into the release procedure (https://git.eeqj.de/sneak/AutistMask/issues/387) and `README.md`'s installation sections are updated to match. - [ ] Any repo change the choice needs (for example an AMO signing script or a store listing checklist) is filed as its own issue. model: claude-fable-5
clawbot added this to the 1.0.0 milestone 2026-09-21 09:19:21 +02:00
sneak was assigned by clawbot 2026-09-21 09:19:21 +02:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#386