Question About Distribution Methods and Automatic Signing

Add-ons
1

Hello,

Over the past few months, I have noticed that the add-on review process has become significantly slower. Previously, my submissions were usually approved within 2–4 days, but now I sometimes have to wait 2–3 weeks, and in some cases even more than a month.

After looking into the available information, I understand that Mozilla may currently be experiencing issues related to review capacity, staffing, or increased workload.

Because of this, I have a question regarding add-on distribution.

Is there any way to obtain automatic signatures for new versions of an extension and distribute them independently through my own website?

For example, I would like to create a download page on my website with a button such as:

[ Download / Install Extension ]

When the user clicks this button, I would like Firefox to display the standard extension installation prompt, similar to the experience of installing an extension from an AMO page. I would like to avoid a process where users have to manually download an .xpi file, open it, navigate through developer settings, or perform additional steps to install a new version.

While this process is not a problem for technically experienced users, ordinary users are often unwilling to go through several additional steps just to install an extension. Seeing a long list of instructions is enough for many users to simply give up.

I understand that automatic signing may work for smaller changes, but my extension is a fairly large project. It currently contains more than 100,000 lines of code, and many updates add another 5,000–10,000 lines of new code. As a result, almost every significant update is sent for manual review, which can delay important fixes for several weeks.

I would still like to keep the stable version of my extension publicly available on AMO, but I would also like to have the ability to distribute urgent fixes and newer versions through my own website without waiting several weeks for manual review.

My main question is: Is there an official way to obtain a signed version of an extension for self-distribution that can be installed directly from a website with a single click, using Firefox’s standard installation mechanism, without requiring a lengthy manual AMO review for every update?

I would appreciate any clarification regarding the available distribution options for this use case and any limitations that apply.

2

Hi, and thanks for reaching out, and I am sorry about the wait you have been having.

You are right that reviews are taking longer than they used to. We wrote about what is happening and what we are doing about it here: Important update: Addressing the long manual review times (Important update: Addressing the long manual review times).

On your main question, yes, self-distribution is an officially supported path. When you submit a version, choose “On your own” instead of “On this site”. That version is signed for self-distribution and is not published on AMO, and signing there is normally automatic rather than queued for manual review.

Two things to be clear about, though. Self-hosted does not mean unreviewed. Every version still goes through our automated scanners, and if something looks like it does not follow our policies, the add-on can be flagged for a manual look or blocked. And there is no way to sign a build yourself, at least not yet, so signing goes through us either way.

For the install experience, you do not need anything special. Host the signed .xpi on your site and link to it directly, served as application/x-xpinstall. Clicking that link in Firefox shows the standard installation prompt, the same doorhanger users see from an AMO page. No saving the file, no developer settings.

For updates, self-distributed add-ons do not get them from AMO, so you host your own update manifest and point browser_specific_settings.gecko.update_url at it. That is what gives your users automatic updates.

One caveat worth planning around: mixing a listed and a self-hosted build under the same add-on ID makes the two update paths compete. It is usually cleaner to give the self-distributed build its own ID.

And for the AMO listing itself, since your codebase is large, including your source code with a build script the reviewer can run genuinely speeds things up. This guide walks through it: Help our source code review process, add a build for AMO script (Help our source code review process: add a build-for-amo script).

Thank you!

-Christos

3

Thank you for the detailed response!

If I understand correctly, in short, the main thing I should focus on is making sure that the automated scanner does not find any errors or warnings, and this could potentially help speed up the review process?

At the moment, the automated check reports 140+ warnings for my extension, so I suppose I should start addressing those issues as soon as possible.

You also mentioned:

“There is no way to sign a build yourself, at least not yet, so signing goes through us either way.”

If I read that correctly, the wording “at least not yet” seems to imply that this possibility could potentially be considered or introduced in the future. Is independent signing something Mozilla may consider adding eventually?

As I understand it, the main things I should focus on at the moment are:

  1. Fix all the issues and warnings reported by the automated scanner.

  2. Try submitting the extension through self-distribution and see how long the signing process takes and whether the extension is sent for manual review after addressing the reported issues.

  3. Improve the source-code review process by providing a ready-to-run build script.

Regarding the source code, every time I submit a build for review, I already include a text-based build guide along with the package.json files. In my next submissions, I will also try to provide a ready-to-run build script that can build the extension with a single command, hopefully making the review process easier and faster.

Thank you again for the clarification and for your time!

4

Appreciate your response, SanoSenpai.

Yes, we are considering self-signing, though we don’t have anything planned yet.

You should address the warnings, but keep in mind that our policy and security scanners will review your code only after you submit your version; that’s when we’ll decide whether to manually review it.

We have an extensive list of examples for adhering to our policies, and the most common issue we see is around Data Collection and Transmission Disclosure and Control.

If you need any further help, don’t hesitate to comment on this thread.

Have a nice day

-Christos

5

Hello Christos,

Thank you for the clarification.

Regarding the policy and security warnings, I will make sure to review and address them appropriately before submitting the next version.

I would also like to mention that my extension currently has optional collection of technical data. This data is not critical to the core functionality of the extension and is mainly useful for identifying potential issues and improving stability.

At the moment, users are generally supportive of this feature and understand that reporting technical information can also benefit them by helping us identify and fix bugs more quickly. However, if this type of data collection could potentially be a reason for additional manual review or cause any policy concerns, I would have no problem removing it entirely.

Thank you again for the information and for considering self-signing. I appreciate the clarification.

Have a nice day!

Best regards,
-SanoSenpai