How to create unsigned xpi

For create unsigned xpi, you must to do this:

Change current into extension directory.
Create two files with hashes in base64 encode.

All extension files with hashes in META-INF/manifest.mf

Code:

Manifest-Version: 1.0

Name: manifest.json
Digest-Algorithms: SHA1 SHA256
SHA1-Digest: /OI4yYYrHDKz24u3ibNqwrreTpQ=
SHA256-Digest: Hm8nvJrWiOlrAeSwoKQoYOSAvRqhHvEIveBLlJDTc38=

Name: background.js
Digest-Algorithms: SHA1 SHA256
SHA1-Digest: Jv+SuehkjQObFu5Cnmy5+AqQOcc=
SHA256-Digest: vsFkIXFB3wTWpNXzxaz2O89tKMBlfKQKEnZBKOCFo/4=

...

And hash of manifest.mf into META-INF/mozilla.sf

Code:

Signature-Version: 1.0
SHA1-Digest-Manifest: uDaQxqo2RTMDOnogESmLIeurrLw=
SHA256-Digest-Manifest: uDaQxqo2RTMDOnogESmLIeurrLw=

Add into manifest.json

Code:

        ,"browser_specific_settings": {
                "gecko": {
                        "id": "[email protected]"
                }
        }

Pack all files in extension directory into zip archive with name [email protected]

In about:config change xpinstall.signatures.required to false

Now you can install xpi in firefox browser.

Simple script on 'perl' for create xpi

Code:

#!/usr/bin/perl

if( ($ARGV[0] eq '-h') || ($ARGV[0] eq '--help') ) {
    print('
Description: Script create unsigned xpi file
Usage:
    In about:config set
    xpinstall.signatures.required = false
  
    In manifest.json set
    "browser_specific_settings": {
        "gecko": {
            "id": "[email protected]"
            ,"strict_min_version": "45.0"
        }
    }

    Chage dir into extension and exec
    xpi-create [email protected]
');
    exit(0);
}

$xpi_name = "../$ARGV[0]";
print("Using xpi name - $xpi_name\n");

`rm -rf ./META-INF`;
$output = `find`;
@PATH = split("\n", $output);

$manifest = "Manifest-Version: 1.0\n\n";
foreach(@PATH) {
    $path = $_;
    $return = system("test -f $path");
    if($return == 0) {
        $file = $path;
        $file =~ s/^\.\///g;
        $manifest .= "Name: $file\n";
      
        $manifest .= "Digest-Algorithms: SHA1 SHA256\n";
      
        $hash = `openssl dgst -binary -sha1 $path | base64`;
        $hash =~ s/^\s+|\s+$//g;
        $manifest .= "SHA1-Digest: $hash\n";
      
        $hash = `openssl dgst -binary -sha256 $path | base64`;
        $hash =~ s/^\s+|\s+$//g;
        $manifest .= "SHA256-Digest: $hash\n";
      
        $manifest .= "\n";
    }
}

`mkdir ./META-INF`;
open(FH, '>', './META-INF/manifest.mf') or die $!;
print(FH $manifest);
close(FH);

$mozilla = "Signature-Version: 1.0\n";

$hash = `openssl dgst -binary -sha1 ./META-INF/manifest.mf | base64`;
$hash =~ s/^\s+|\s+$//g;
$mozilla .= "SHA1-Digest-Manifest: $hash\n";

$hash = `openssl dgst -binary -sha1 ./META-INF/manifest.mf | base64`;
$hash =~ s/^\s+|\s+$//g;
$mozilla .= "SHA256-Digest-Manifest: $hash\n";

open(FH, '>', './META-INF/mozilla.sf') or die $!;
print(FH $mozilla);
close(FH);

`zip -r $xpi_name ./*`

 

https://extensionworkshop.com/documentation/publish/package-your-extension/

 

web-ext build - Creates a zip archive, but does not create files with hashes. Without hashes, the extension can only be loaded from
about:debugging#/runtime/this-firefox -> Load Temporary Add-on....

If you create xpi as shown above. You can load extension via about:addons -> Install Add-on From File for permanent use.