If you have an old extension developed for
Firefox 2, you may have encounter problems when porting it to
Firefox 3. One major problem is that you need to provide secure updates for the extension, otherwise the auto-update is disabled. After looking at
a good article from Mozilla, the problem seems easy to attack. Just provide a HTTPS connection for the updates and it's done. Yes, if you have a valid
certificate for HTTPS connection, that should work. But for those use testing certificates,
Firefox can not recognize these certificates and still fails to update the extension.
So we have to use the complex approach mentioned in the article, i.e.
signing the updates. You need two tools for signing the updates, one is
HashTab ,the other is
McCoy.
HashTab is used to
calculate digital
signature of the
XPI files, while McCoy is used to sign the update manifests. Detailed steps are:
- Use McCoy to create a new key.
- Add the key to the install.rdf. ("Install" button in the toolbar)
- Package the XPI file with the signed install.rdf.
- Use HashTab to calculate the SHA1 signature of the XPI file.
- Add to the update.rdf using the signature calculated in the previous step.
- Use McCoy to add the key to the update.rdf ("Sign" button in the toolbar).
- Place the signed XPI file and update.rdf to your web server.
- Done.