5 ms·

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_signature_hotfix.json https://xor.cat/assets/other/random/20

by XORcat 7y ago

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_signature_hotfix.json https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on "resource://gre/modules/addons/XPIDatabase.jsm" edit: The linked XPI definitely seems to add the new certificate, whatever mechanism used to reverify the signatures just doesn't seem to work in 60. edit2: Restarting Firefox appears to have forced the reverify... Possibly a flag that I twiddled with though, hard to be sure. Either way, the above should help people get everything running again without having to enable studies/normandy.

rndgermandude 7y ago
Yes, this is broken on ESR, but only somewhat broken. The hotfix extension does two things: 1) Install a new certificate for "CN=signingca1.addons.mozilla.org/emailAddress=foxsec@mozilla.com", effectively replacing the old certificate that expired. This should work. 2) Then it tries to import the internal "resource://gre/modules/addons/XPIDatabase.jsm" module and calls XPIDatabase.verifySignatures(). This does not work on ESR, as "XPIDatabase.jsm" is a new-ish thing that isn't present in ESR yet. In ESR the function is still in "resource://gre/modules/addons/XPIProvider.jsm" (XPIProvider.verifySignatures()). Thankfully, the non-existing module is imported using ChromeUtils.defineModuleGetter, which only lazily loads the module on first of the imported property, so after the certificate-adding code has run.
gpm 7y ago
Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)
- option_greek 7y ago
  This should be sticky comment somewhere on the top of the comments. It bought all the addons back for me.
- jwalton 7y ago
  It does, but it didn't fix anything for me. All my extensions are still gone. :(
  - gpm 7y ago
    You might have to reinstall them unfortunately, on the system I figured that out on Firefox had decided to uninstall them (I think because I had to update the browser from the ancient version the user was using first).
- deleted 7y ago
  [deleted]
- classichasclass 7y ago
  Just tried on Android. Hooray!
  - mateus1 7y ago
    Clicking the URL was the only way I was able to get the hotfix on Firefox mobile for Android
- reader_1000 7y ago
  Unrelated to cert problem: Yes, clicking on the link installs the plugin, but it is suprising to see that firefox claims that it is the news.ycombinator.com, not storage.googleapis.com, that wants to install plugin. Could it be a security issue since if an attacker somehow manages the post/inject a link for a malicious plugin in a credible site, firefox will claim that plugin is from that site?
  - DoctorOetker 7y ago
1over137 7y ago
So not only does this 'normandy' thing exist, but it goes to a google server? So much for using Firefox to keep google out of my life. :(
- DoctorOetker 7y ago
  that's an interesting question: when we install add-ons or extensions, are these hosted on google servers? I'd rather not have google know what versions of which add-ons I am running...
johnnycab 7y ago
>hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This fixed it for me. Thanks. W10/FF 66.0.3
DoctorOetker 7y ago
Thanks for the sleuthing, but who does this repository belong to? I'd like to apply it but only if mozilla provides such instruction on their issue page, I don't know who the actual owner of /moz-fx-normandy-prod-addons/ is... https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... Can mozilla please verify, confirm authenticity, and list this instruction on their issue page?
- XORcat 7y ago
  I would have the same question if I didn't see the response come back from https://normandy.cdn.mozilla.net/ https://normandy.cdn.mozilla.net/ myself. I encourage you to go through the whole Normandy process yourself in a test environment, and even better (if possible), check out the code to see whether it looks legit or benign. I'm happy, because I went through and checked it out myself without needing to enable Normandy on my actual Firefox, but ultimately, it will be great when Moz can get instructions for manually applying the fix out.

by XORcat 7y ago

rndgermandude 7y ago

Yes, this is broken on ESR, but only somewhat broken. The hotfix extension does two things: 1) Install a new certificate for "CN=signingca1.addons.mozilla.org/emailAddress=foxsec@mozilla.com", effectively replacing the old certificate that expired. This should work. 2) Then it tries to import the internal "resource://gre/modules/addons/XPIDatabase.jsm" module and calls XPIDatabase.verifySignatures(). This does not work on ESR, as "XPIDatabase.jsm" is a new-ish thing that isn't present in ESR yet. In ESR the function is still in "resource://gre/modules/addons/XPIProvider.jsm" (XPIProvider.verifySignatures()). Thankfully, the non-existing module is imported using ChromeUtils.defineModuleGetter, which only lazily loads the module on first of the imported property, so after the certificate-adding code has run.

gpm 7y ago

Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)

option_greek 7y ago
This should be sticky comment somewhere on the top of the comments. It bought all the addons back for me.
jwalton 7y ago
It does, but it didn't fix anything for me. All my extensions are still gone. :(
- gpm 7y ago
  You might have to reinstall them unfortunately, on the system I figured that out on Firefox had decided to uninstall them (I think because I had to update the browser from the ancient version the user was using first).
deleted 7y ago
[deleted]
classichasclass 7y ago
Just tried on Android. Hooray!
- mateus1 7y ago
  Clicking the URL was the only way I was able to get the hotfix on Firefox mobile for Android
reader_1000 7y ago
Unrelated to cert problem: Yes, clicking on the link installs the plugin, but it is suprising to see that firefox claims that it is the news.ycombinator.com, not storage.googleapis.com, that wants to install plugin. Could it be a security issue since if an attacker somehow manages the post/inject a link for a malicious plugin in a credible site, firefox will claim that plugin is from that site?
- DoctorOetker 7y ago

1over137 7y ago

So not only does this 'normandy' thing exist, but it goes to a google server? So much for using Firefox to keep google out of my life. :(

DoctorOetker 7y ago
that's an interesting question: when we install add-ons or extensions, are these hosted on google servers? I'd rather not have google know what versions of which add-ons I am running...

johnnycab 7y ago

>hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This fixed it for me. Thanks. W10/FF 66.0.3

DoctorOetker 7y ago

Thanks for the sleuthing, but who does this repository belong to? I'd like to apply it but only if mozilla provides such instruction on their issue page, I don't know who the actual owner of /moz-fx-normandy-prod-addons/ is... https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... Can mozilla please verify, confirm authenticity, and list this instruction on their issue page?

XORcat 7y ago
I would have the same question if I didn't see the response come back from https://normandy.cdn.mozilla.net/ https://normandy.cdn.mozilla.net/ myself. I encourage you to go through the whole Normandy process yourself in a test environment, and even better (if possible), check out the code to see whether it looks legit or benign. I'm happy, because I went through and checked it out myself without needing to enable Normandy on my actual Firefox, but ultimately, it will be great when Moz can get instructions for manually applying the fix out.