web-ext sign fails if last version uploaded via website was listed

[dstillman]

Is this a bug or feature request?

Bug

What is the current behavior?

I have an add-on with both an unlisted and a listed version, the latter awaiting review. If the last version uploaded via the website was listed, web-ext sign fails with a generic "The WebExtension could not be signed". Using verbose mode and loading the validation URL, I can see that the underlying error is "applications.gecko.update_url" is not allowed for Mozilla-hosted add-ons..

What is the expected or desired behavior?

Using web-ext sign should always create an unlisted version, regardless of the last-used mode on AMO. (See also: #804 for adding a separate web-ext submit.)

Version information (for bug reports)

• Paste the output of these commands:

node --version && npm --version && web-ext --version

v7.7.2
4.4.4
1.8.1

[kumar303]

Huh, that's odd. Thanks for the bug report. If it's convenient for you to reproduce this, could you attach a verbose log?

[dstillman]

Sure: https://gist.githubusercontent.com/dstillman/d9cf22f7ff6655b55bbe7a6faa92f8d6/raw/3d8582453b084ee5ccd03c0657ad8f317feab9f6/sign_failure.txt

[kumar303]

Thanks. The response property automated_signing: false means that the API thinks it's dealing with a listed add-on which doesn't seem right.

[kumar303]

@mstriemer do you think mozilla/addons#1637 would fix this?

[mstriemer]

I think this is due to supporting listed and unlisted for the same add-on. It looks like a channel parameter has been added to the API which can be either "listed" or "unlisted", if it isn't specified then last the last versions channel is used [1].

So I'm guessing web-ext needs to be updated to pass the channel flag when requested (or possibly just set it to unlisted unless it is called with --listed or something) .

[1] https://github.com/mozilla/addons-server/blob/38b2901df38372462c86574b06751e385e0f7688/src/olympia/signing/views.py#L189-L196

[kumar303]

Oh, hey, there is even a channel param for the API endpoint now.

Thanks for the info. I'm not sure who will be able to work on supporting this in web-ext but I can review a patch.

[dstillman]

OK, so for other people hitting this, a temporary fix is to add channel: 'unlisted' to the form data uploaded by the sign-addon module used by web-ext.

The relevant object in the current code is here. To get it working on my system without rebuilding sign-addon, I just modified the dist file at /usr/local/lib/node_modules/web-ext/node_modules/sign-addon/dist/sign-addon.js:

Before:

	      var formData = {
	        upload: this._fs.createReadStream(xpiPath)
	      };

After:

	      var formData = {
	        upload: this._fs.createReadStream(xpiPath),
	        channel: 'unlisted'
	      };

A proper fix will require changes to both sign-addon and web-ext, with the latter passing 'unlisted' for web-ext sign and 'listed' for a future web-ext submit.

[dstillman]

(And until there's a web-ext submit, you'll also have to change the mode from "On your own" to "On this site" every time you upload a listed version via the web interface after uploading an unlisted version via the API, because the web interface will default to the last-used mode.)

[kumar303]

ok, glad to hear that worked!

If you didn't want to modify the dist file, here is how to patch it with the sign-addon source:

cd src/sign-addon
npm install
# Add the patch
npm run build
npm link
cd ../src/web-ext
npm install
npm link sign-addon
npm run build
npm link
web-ext sign ...

^ Your local web-ext would then be using the patched sign-addon module.

[kumar303]

Supporting listed add-ons from web-ext is tracked here: #804

[kumar303]

channel: unlisted will be added via #1250

[kumar303]

Thanks for everyone's patience. Richard Bloor and I worked on documentation for this.

Reference: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/web-ext_command_reference#web-ext_sign
How to create test (beta) versions: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Getting_started_with_web-ext#Signing_a_test_version_of_a_listed_extension

This feature is half baked so it's a little confusing, alas. If anyone has feedback on the documentation, let us know.