test-jpm-signing-on-stage.md

We're about to release some tools for developers to sign add-ons so they can publish the .xpi files to their own site as opposed to hosting them on addons.mozilla.org. This would let users install the add-ons in a release or beta channel when add-on signatures are required.

Can you help test what we have so far? Here's how:

• Clone jpm and install it so you can run jpm from your shell:

git clone https://github.com/mozilla-jetpack/jpm.git
cd jpm
npm install
npm link

• Create an add-on like you normally would
  • jpm init ...
• Generate an API key from this page
• Run jpm sign with your API credentials. The command should look something like this:

jpm sign --api-key ... --api-secret ... --api-url-prefix https://addons.allizom.org/api/v3

• If your add-on passed validation, the script would have downloaded a signed xpi file
• Set some prefs in Nightly so you can verify that the xpi was signed correctly
  • Open about:config
  • Create a new boolean preference, xpinstall.signatures.dev-root, and set it to true. This will tell Nightly to check add-on signatures using the staging cert.
  • Restart Nightly
• Try to install the add-on by opening the signed xpi file (File > Open...). Nightly should let you install it or else it will complain that the signature is invalid.

Let us know if it worked!

thanks, Kumar