# Can add-on get signed without XPI?

**URL:** https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494
**Category:** addons.mozilla.org
**Created:** [May 5, 2016, 1:48am UTC](https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494 "2016-05-05T01:48:43Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![dyep](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@dyep](https://discourse.mozilla.org/u/dyep)
#### Post date: [May 5, 2016, 1:48am UTC](https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494/1 "2016-05-05T01:48:44Z")

</div>

We have a overlay add-on which we install manually using the registry. I know this is an obsolete way to do it, but we have many customers using the product and we would like to know how we can sign this add-on without creating an XPI. The add-on simply launches an executable from our main product.

---

<div class="post-metadata">

### Author: ![desktopd](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/desktopd/32/4520_2.png) [@desktopd](https://discourse.mozilla.org/u/desktopd)
#### Post date: [May 6, 2016, 9:27am UTC](https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494/2 "2016-05-06T09:27:27Z")

</div>

I don’t know for sure, but unpacking a signed XPI as-is into a directory may work. (A signed XPI has a directory named `META-INF`)

---

<div class="post-metadata">

### Author: ![jorgev](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@jorgev](https://discourse.mozilla.org/u/jorgev)
#### Post date: [May 10, 2016, 7:34pm UTC](https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494/3 "2016-05-10T19:34:05Z")

</div>

All you have to do is package your add-on as an XPI, get it signed, and then distribute the unpacked version of the signed XPI. Just make sure the directory contents aren’t changed after installation.

---

<div class="post-metadata">

### Author: ![dyep](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@dyep](https://discourse.mozilla.org/u/dyep)
#### Post date: [May 13, 2016, 7:39pm UTC](https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494/4 "2016-05-13T19:39:49Z")

</div>

Thank you. That worked

---

<div class="post-metadata">

### Author: ![dyep](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@dyep](https://discourse.mozilla.org/u/dyep)
#### Post date: [May 13, 2016, 9:43pm UTC](https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494/5 "2016-05-13T21:43:56Z")

</div>

Unpacking the XPI worked, but for some reason, I had to place the contents into a separate folder for the signed add-on to be recognized. The unsigned add-on, however, worked fine in our main application folder with other files. Is it possible to get the signed add-on to work in a folder where other files are present?

---

<div class="post-metadata">

### Author: ![jorgev](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@jorgev](https://discourse.mozilla.org/u/jorgev)
#### Post date: [May 17, 2016, 10:09pm UTC](https://discourse.mozilla.org/t/can-add-on-get-signed-without-xpi/8494/6 "2016-05-17T22:09:31Z")

</div>

It’s not possible to have other files inside the extension folder because that will break the signature. It should be possible for an add-on to reference files anywhere, however.
