From browser/app/profile/firefox.js: pref("xpinstall.whitelist.add", "update.mozilla.org"); pref("xpinstall.whitelist.add.103", "addons.mozilla.org"); Shouldn't we also whitelist *.add-ons.mozilla.com and *.add-ons.mozilla.org?

I don't believe that we should. We're not intending to have the service-localized add-ons hostnames perform an installTrigger, or indeed be used for anything other than redirects, and adding wildcards into the whitelist makes me rather nervous. We need to be compatible with Fx 1.5's whitelist, so we currently intend to have the browser see all the installTrigger requests as coming from addons.mozilla.org, regardless of the final hostname for the refreshed site. Recommend WONTFIX.

So be it.