The official XPI packages that constitute Mozilla the application should be signed. This includes the PSM package. Mozilla should contain signature validation code (even if only for its own key) and the user should be presented with a dialog warning about security etc. whenever an XPI package is about to be installed and whether it is signed or not.

Agreed. We already have signature verification code, and it should be hooked up to the installer.

QA > ckritzer

->Future, but I still think we should have this feature if we can make it practical.

As I see it, xpi packages can install just about any files into your mozilla directory, this can be a major security risk. It seems like there is definatly an ability for someone to create a malisious xpi. We should atleast warn uses when installing an xpi, that this can install random files into your computer and can completly mess up your system (in nicerwords anyways) and if its signed, jsut give the description that comes with the signature of what the installer does :)

we *do* warn the user of the consequences before allowing an xpinstall to occur. We always have. What do you mena by "the description that comes with the signature of what the installer does." There's no such description. Signing just verifies the authorship of the xpi, not what it does.

performance, footprint, feature work, and re-architecture bugs will be addressed in 0.9.8

I don't think we're going to have this done by Moz 1.0. If anyone thinks this is really needed by then, talk to me.

Corfirming topembed- [T2] per EDT triage.

On a related note, patches that come 'officially' from the Mozilla organization (like the recent fix for the shell: vulnerability) should be signed. Its actually incomprehensible to me how Mozilla could distribute an unsigned patch for a security vulnerability, to be applied to current versions of Firefox, Thunderbird, and Mozilla - especially in light of the most recent IE vulnerabilities, and CERT recommending Mozilla/Firefox over IE. This seems like a simple oversight that should be very easy to correct.

Is this bug obsolet and tracked anywhere else? I believe this is quite an issue..

Still not fixed: https://addons.mozilla.org/messages/307259.html Unsigned, huh?!