Two questions only the owner can settle, both blocking a usable 1.0.0 for anyone who is not building from source. README.md already states the facts; what is missing is the decision.
Firefox
make package produces an UNSIGNED .xpi. Release Firefox and ESR refuse it outright; only Developer Edition, Nightly or an Unbranded build with xpinstall.signatures.required=false install it permanently, and a temporary add-on is gone at browser exit. Signing means submitting to AMO with the owner's credentials.
Options:
(a) AMO self-distribution signing (unlisted): the XPI is signed and installable on every Firefox, nothing is listed publicly, and the repo gains a documented step that only the owner runs. Recommended.
(b) AMO listed: as (a) plus a public listing and AMO review.
(c) Ship unsigned and state that Firefox support means Developer Edition or an Unbranded build.
Chrome
manifest/chrome.json carries the fixed public key, so the extension id is stable, but the repo packs no CRX and publishes nothing.
Options:
(a) Chrome Web Store, unlisted: installable on every Chrome, updates delivered by the store, needs the owner's developer account. Recommended.
(b) Self-hosted CRX signed with the private key the owner holds: Chrome only installs it via enterprise policy on Windows and macOS, so it is realistically Linux-only.
(c) "Load unpacked" from dist/chrome/ only, as today.
Definition of done
The owner records one choice per browser on this issue.
The chosen steps, including which credentials they need and who holds them, are written into the release procedure (#387) and README.md's installation sections are updated to match.
Any repo change the choice needs (for example an AMO signing script or a store listing checklist) is filed as its own issue.
model: claude-fable-5
Two questions only the owner can settle, both blocking a usable 1.0.0 for anyone who is not building from source. `README.md` already states the facts; what is missing is the decision.
## Firefox
`make package` produces an UNSIGNED `.xpi`. Release Firefox and ESR refuse it outright; only Developer Edition, Nightly or an Unbranded build with `xpinstall.signatures.required=false` install it permanently, and a temporary add-on is gone at browser exit. Signing means submitting to AMO with the owner's credentials.
Options:
- (a) AMO self-distribution signing (unlisted): the XPI is signed and installable on every Firefox, nothing is listed publicly, and the repo gains a documented step that only the owner runs. Recommended.
- (b) AMO listed: as (a) plus a public listing and AMO review.
- (c) Ship unsigned and state that Firefox support means Developer Edition or an Unbranded build.
## Chrome
`manifest/chrome.json` carries the fixed public `key`, so the extension id is stable, but the repo packs no CRX and publishes nothing.
Options:
- (a) Chrome Web Store, unlisted: installable on every Chrome, updates delivered by the store, needs the owner's developer account. Recommended.
- (b) Self-hosted CRX signed with the private key the owner holds: Chrome only installs it via enterprise policy on Windows and macOS, so it is realistically Linux-only.
- (c) "Load unpacked" from `dist/chrome/` only, as today.
## Definition of done
- [ ] The owner records one choice per browser on this issue.
- [ ] The chosen steps, including which credentials they need and who holds them, are written into the release procedure (https://git.eeqj.de/sneak/AutistMask/issues/387) and `README.md`'s installation sections are updated to match.
- [ ] Any repo change the choice needs (for example an AMO signing script or a store listing checklist) is filed as its own issue.
model: claude-fable-5
clawbot
added this to the 1.0.0 milestone 2026-09-21 09:19:21 +02:00
sneak
was assigned by clawbot2026-09-21 09:19:21 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Two questions only the owner can settle, both blocking a usable 1.0.0 for anyone who is not building from source.
README.mdalready states the facts; what is missing is the decision.Firefox
make packageproduces an UNSIGNED.xpi. Release Firefox and ESR refuse it outright; only Developer Edition, Nightly or an Unbranded build withxpinstall.signatures.required=falseinstall it permanently, and a temporary add-on is gone at browser exit. Signing means submitting to AMO with the owner's credentials.Options:
Chrome
manifest/chrome.jsoncarries the fixed publickey, so the extension id is stable, but the repo packs no CRX and publishes nothing.Options:
dist/chrome/only, as today.Definition of done
README.md's installation sections are updated to match.model: claude-fable-5