Wladimir Palant Reporter
	Description • 14 years ago

I was trying to install a version of Adblock Plus with a slightly modified install.rdf file and installation seemingly didn't do anything whatsoever. Error Console showed the reason:

Signature Verification Error: the signature on install.rdf is invalid because the MANIFEST.MF file does not contain a valid hash of the file being verified.

Error: ERROR addons.manager: Exception calling provider.getInstallForURL: Error: XPI is incorrectly signed

Shouldn't this produce some user-visible error? I don't think that we want the user to be able to install such an add-on but an error message would be useful if the download was corrupted by anti-virus software for example.

	Henrik Skupin [:whimboo][⌚️UTC+2]
	Comment 1 • 14 years ago

Wladimir, do you have an example of that XPI and could you attach it on that bug?

This bug depends on bug 552965 IMO.

	Wladimir Palant Reporter
	Comment 2 • 14 years ago

Correctly signed XPI file - this one should show "Wladimir Palant" as author.

	Wladimir Palant Reporter
	Comment 3 • 14 years ago

This has the same signature as the previous XPI file but some whitespace modification in install.rdf - the signature doesn't match.

	Wladimir Palant Reporter
	Comment 4 • 14 years ago

Actually, when installing from the web I get an error message:

The download of https://bug562303.bugzilla.mozilla.org/attachment.cgi?id=442047 failed: -3

With a file from your hard drive not even this (unhelpful) message is shown.

	Henrik Skupin [:whimboo][⌚️UTC+2]
	Comment 5 • 14 years ago

Do you eventually see bug 562302? Does a new profile or removing the extensions.sqlite file help?

	Wladimir Palant Reporter
	Comment 6 • 14 years ago

No, the profile is brand new. And I can install extensions - it's only those with invalid signature that fail.

	Blair McBride [:Unfocused] (UNAVAILABLE)
	Comment 7 • 14 years ago

Hmm, for local files, it seems the API sends no events until after its successfully loaded the manifest (and a bunch of other stuff). So the UI doesn't know anything has actually happened, let alone an error has occurred.

	Dave Townsend [:mossop]
	Comment 8 • 14 years ago

Certainly the poor error message is bug 552965, the total lack of errors for local installs is something new though

	Dave Townsend [:mossop]
	Comment 9 • 14 years ago

Fixed by the patch in bug 570200

	Henrik Skupin [:whimboo][⌚️UTC+2]
	Comment 10 • 14 years ago

Given the automated tests it looks to be stable enough to call it out as verified fixed.