Bug 1332061 Add warning for unsigned extensions r=florian
authorAndrew Swan <aswan@mozilla.com>
Thu, 02 Mar 2017 11:30:41 -0800
changeset 395094 782f34bf8bb5de282e6dfe8a83e26c81281c8c2f
parent 395093 5e737be8b31ff0244af2a011222b7f30322ca598
child 395095 3215abf8a6cb1bf4b86c16a8120c60863580a985
push id7391
push usermtabara@mozilla.com
push dateMon, 12 Jun 2017 13:08:53 +0000
treeherdermozilla-beta@2191d7f87e2e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersflorian
bugs1332061
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1332061 Add warning for unsigned extensions r=florian MozReview-Commit-ID: JAvjmh0IgBW
browser/base/content/test/webextensions/browser.ini
browser/base/content/test/webextensions/browser_permissions_unsigned.js
browser/base/content/test/webextensions/browser_webext_unsigned.xpi
browser/locales/en-US/chrome/browser/browser.properties
browser/modules/ExtensionsUI.jsm
--- a/browser/base/content/test/webextensions/browser.ini
+++ b/browser/base/content/test/webextensions/browser.ini
@@ -1,25 +1,28 @@
 [DEFAULT]
 support-files =
   head.js
   file_install_extensions.html
   browser_legacy.xpi
   browser_legacy_webext.xpi
   browser_webext_permissions.xpi
   browser_webext_nopermissions.xpi
+  browser_webext_unsigned.xpi
   browser_webext_update1.xpi
   browser_webext_update2.xpi
   browser_webext_update_icon1.xpi
   browser_webext_update_icon2.xpi
   browser_webext_update_perms1.xpi
   browser_webext_update_perms2.xpi
   browser_webext_update.json
   browser_webext_search.xml
 
 [browser_extension_sideloading.js]
 [browser_extension_update_background.js]
 [browser_permissions_addons_search.js]
 [browser_permissions_installTrigger.js]
 [browser_permissions_local_file.js]
 [browser_permissions_mozAddonManager.js]
+[browser_permissions_unsigned.js]
+skip-if = require_signing
 [browser_update_interactive.js]
 [browser_update_interactive_noprompt.js]
new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/webextensions/browser_permissions_unsigned.js
@@ -0,0 +1,44 @@
+"use strict";
+
+const ID = "permissions@test.mozilla.org";
+const WARNING_ICON = "chrome://browser/skin/warning.svg";
+
+add_task(async function test_unsigned() {
+  await SpecialPowers.pushPrefEnv({set: [
+    ["extensions.webapi.testing", true],
+    ["extensions.install.requireBuiltInCerts", false],
+
+    // XXX remove this when prompts are enabled by default
+    ["extensions.webextPermissionPrompts", true],
+  ]});
+
+  let testURI = makeURI("https://example.com/");
+  Services.perms.add(testURI, "install", Services.perms.ALLOW_ACTION);
+  registerCleanupFunction(() => Services.perms.remove(testURI, "install"));
+
+  let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser);
+
+  gBrowser.selectedBrowser.loadURI(`${BASE}/file_install_extensions.html`);
+  await BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
+
+  ContentTask.spawn(gBrowser.selectedBrowser, `${BASE}/browser_webext_unsigned.xpi`, function*(url) {
+    content.wrappedJSObject.installTrigger(url);
+  });
+
+  let panel = await promisePopupNotificationShown("addon-webext-permissions");
+
+  is(panel.getAttribute("icon"), WARNING_ICON);
+  checkPermissionString(document.getElementById("addon-webext-perm-text").textContent,
+                        "webextPerms.unsignedWarning", null,
+                        "Install notification includes unsigned warning");
+
+  // cancel the install
+  let promise = promiseInstallEvent({id: ID}, "onInstallCancelled");
+  panel.secondaryButton.click();
+  await promise;
+
+  let addon = await AddonManager.getAddonByID(ID);
+  is(addon, null, "Extension is not installed");
+
+  await BrowserTestUtils.removeTab(tab);
+});
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..55779530ce60de67e342d16e84ebf0b3a310703d
GIT binary patch
literal 12620
zc$|H^WlSAR&^CMy?(Po7-QA_QQ=D>eDDDmicc&D0ch}-p+}+(>i@v>|=f{`4$@}eQ
zc4x9XS2nXhb~d?2MII6g3jhGX0f<Ai<gg#CTqplo_CNpt89)TEHL|lZH*<Dj{^4wI
z_e}#H07(!~qy3+_dLROTP!Iq1{g1nA?8J|LR;1x8PlN&!coe3Bu<S<&??BZ^i;9TU
z?plRm&D+bQB+-^$m&6ZJ5tpmvKoEsN!r4J+2%QvfnZ#DKCB!HYU!Kekr-EKgTR+SO
z@t~di170Y;b_sSS-O}mNRMEPg*B$!H>QiI&{>OASp<>v*)FxrpDBKUtJ2{FD^8NU`
z=lOQUdA?Y(-IUjWqyYwvyP;`@)NpJ19NU=NDP+U=m1xQXKd}#z)E^T*1TZPV!*nAi
z%+L~!%S^2kn<uEZlj*x8k8K$p_A38^f&loh{TGx@z5OC#769Nsf%_K}D-(M=W(PZq
z|G#)ds3=JzBM|%tf-EZ|srGLc{ZHUv{*C2Uj++1g0-KeDgo><$1euDHy}6Z*835ps
znU&(Mp}v9>Hr2_~sgj5mnLKT6sRki~+$od5OwR_7Cf5@Wpx~C&aFA3@D28LF-3Av(
zB-Bwvh5%LT&Y<um=N%oe2vcNDtMIpedtOasY>__sS?6?4ZCG6SF17>W--4j~6tv;N
zNO{^=J4b`zF;NyESRm3h0MZ7q?a<I5j`RE#A`QZ4Ioc)-^BK3Z9fj=gEB%~EbT8mD
zC%H|Bf(@XO8hv#8yrPefJHjiZl}Xj2Jd)bXsW{0hH%Xxr$gY{>e9Nfk^O$Ca%6G>e
zEQmkmJh^Ljy}wSg7sH3q6`cUW$3233Ze#DFHVJZ(4HX@--><{>QQ`*BCayCdI;)%7
zFqtIMvIjElc>=a&MhvfKS+vKeFvm~_C&zV}F(^yI@u~IILt~OKqjsjI6px|?$5~N$
zV!rIMEvMn@5bZbt%%|RTusm(?>nQ}5dHHx*ZJBJlXy^S6-ZB!O+)};=`(NTql0Nr8
zYWbxh18R%SnpR%IY^|^X24_H(j`y$$5DOr(zRMNG*O8>%=eyd#E~5oQ#rnFwJTS+a
zj^+63B?rY{!q8_*t!v}zz{uk+i8s-OP2xL`ow--B<iMZFU5CF&hdE)-q_7{ZBsl1A
zlwIL0$x@PI#R_B!DNTBRFvFqK#6v}&bJCwt`#%a-+EOA`pV6mNv>}Sf2}J!!0JQYz
zWbodm4AWP>h(pqle<z}5(o(Ztrvg8GwOSQE{@_sh$C^k>vbSQWPM)W~=|XUl0i;AB
zPelojAu)TPntRY&0jS%M5Ms39P>vwB?Le$}pd=YC7Pu)FFFCLZL{kdmnv2dE#O;9R
z5@52;$qUOIFb0BJ2dc56WP|Ch5ynN)f<ykGVXK9?kV*U@st?hQC)|gGmOxh_N`|A7
z5SM|#7Cp;VD<vuqJ<T&e);p$kA!r96OSI&wT4KCld%=ETg)i>atwpziZU8Cs!o>#T
z_KsY$^O7<Lw)FgTfb>DT3|8*{wT-TgAQDi54n{-g&yQk7$Laejp5Q?Vk4|0@k5LF=
zCAu0<Qb^hsDU(q0M-K}|N{UTIAsKO$6gy-$KP68ykGr5;6;>syRCxZ|JnavJ2Xw`+
z*7*}Nlg9uTMt=OPDCVzPxf#>M#|_8m_q;FIFhO}H(QL7J{t86Y*bNX3_zi?}v3w!;
zL(xXXb=sBui$rIU$b(L`#x`ut2;OMk7~aqVvA#iHc3m8rc@6aimBJYYzHRF|&^Ty0
zV7B7_#@Ix=ibfs0yB@nSd;aQ!>IWwhn?p{E84X_@EF(^D#FUpf{gqd~Ro+9465}CU
zX}}>L+#0GaD<~<bOhna1r7B}i$xRnPNp4GiL6b$XLD5N;H1gFH)k#oCVN=|WI){9V
zrdu_aUYj0@_8Lo*VV>57USHLtI9!WU<6c9*GPOoK&qLBt=B5ne`-n_L)qtvQkw$@w
z#!2XGBm1|NuY4MO5}plCQMb?s(pZdx;kyz$s*$v>v=+1`8o}ktX6kM8uJd0{bxwJa
zB{+(qr`4>A8tpBE8tJejBeUch<+9~sMjf%~i1P?%AdgS(*<XxaTwesfF@011)^$p~
zz`ejwUbApm>REcTAUD6d@O6H(jAPz+er~>{%)M-DPSh&ZD%g7e$N3Cz#f=M!ZR{A)
zWo9B@*wOl8FxLd<7fvn9%Q>Ry%*ENo+qu!%@>%|Z2aSyCi@dDzPKnpx$3m2E!-~?m
z4H8F%lO~}E{YeRvrKb06#V%Z~@2*ts5A8wi99~0Ss$L;p7hX^I@Gp$-l<&kZoiFMz
z{4nG&&@fdnEyy>ajQv>s2BGhvH8IgK#?jn(uJ}Uinj9#slRS1@UDo2<jyyW%vmmDl
zER#`oMUD+yuN5Tj1|E5~3N}LaunFRE=);bQFs5l7B^>c6m?%O8jJc$=ejBq`-C3p}
zCPbzV#vC1d?Lj@;hSQc8OI!OayA4a<;ZS2tOLfaRle>zlG^VBIp~qGITm7xJiX*ov
zUpouC;g&TM_qpsJq{iL7T}vN9K?Om7@+ORCXL{IX>K1QcqJ|JmY|XRW#RWY1s@(Vw
z?-y5kb<Ta3|Kj2n%csjnjTLwf-96tC9L2PqwmIpa85G$ewMe#f+Nrr4xW{@2y+We;
zqGn4c4F{K$S(G1%O<8<j{7zAWQnO@Z@hJC5XFsqu)iK~b9kz>kpnl=Jr8UK~(z4(_
zI<;vZvPI|L=pX;d{YePa1+Ie+!DXVuJwF3{#R_ww#TLX+11AEddWFaxWI%r&<2&w<
zj}VXCLjtG4(-(P9ebN0XA-<%s@TiD2@cwv4n5t+q-Qaf6NMH(d4Miu#7{!%jnxt&L
zR{?ebW`0J2;jqVW^016am9f^)_sF?$%mLS7lf8nyjNKC47smBA2f<$9Jl>rbiajaM
zC}ze*?aZ#{XN*CrOe$%NnFzKBrid%PyiAzM`&n>NlYB|5%_Z|CW;U!ntbO9uD9e#D
zWgGQR8X-A1#m#KNwB2mAgj<as91X<ml9!UjqAn#w#kHJAIw9&#A;@0|sg4>l=*94_
z>`feZ>|qV#4Ur9nW0}7$^tq`JFu2SlR-)=V202%z=D`D!_21dk_fpi8?x=bApJcL~
zvRUmxZ7a8mV>GwEcirCubbAeE^m6rTn?Wu`N24#_rpt>eytK}0n01A^hU_N-nu43G
zto>;lnHgDp+L+A^loK>(((~&c{Lb{Eup^}gdAM6`O4q_yX_t9htuBkp6-nhisBq=0
z<Qe3)><{g_o_|hg{WSDlO>8u)9nZ6w(j3>^Sv*@?Zy~1DVxD3lT_dUQbcQvN9*O-W
z@az1yijkITOH{3Vy}T~I{)&N_N>kIRudCdHOpKPIca`}?@#<2CXGhKX&GMXP$u}+C
zC%YQZ)r42~%Op%eXryndFW)N(_g9`r|B09OHrax*#*==(9lw)+a7f>Y*og_IbSASZ
zhl)biTTox`*p`R?+{Tbig?&lOFA|6_$}kfDjOUAoez7p`xZ2o8UyEl0TiB+8Ld;YB
zO}>Snvs4$cXC%S|9*r%-MJ0RQV^>e4b3&TV`Uf5>@O=^am^n&^Ihn#gT~AL=_UBAG
z<-M*lBZQo*Sbp1I+f1+A9r;XUojje3cy2zt)geye#(p<7IB(x~D0A-d%iV*0CFO@9
zh7kxO3TtN(Fu26e=JDB$eEm76)mf9>f#Yy7`{ylT=S+3Uep9BEymO@E@3H1f)lrMH
z-PF2{Gp=vTe)eo<<ZJp9p&#daoxv%YknpJx|23#LNWf&hjz+}n^WN|GG5KGk!Qe^B
zyDw|f!_>YsEF#~ZJ>Fy&lhR5CMHoKyU&r@X+`B#A*jcd!xIXmn-{xvE3`@J0KW8t^
zu3VPy-?i{-%)kHot?KW*&2(n_*^%mw$<cOIcf}x*>UaDX@BZepBw9Jg5ArGa?zM1S
zpAP__{39zVrs0vf;O*)2bD`<6;qkT0LYU@`C{Yxn4=vskM+{98ohct1yQX=eylQb)
zx2kz{QFm?i$Hjw}UR9Mu9X*Pa6k38O0!M%-TtK|%<VaeH`_;p{BZO|neEE~#R?Dro
zvY*AOMU6#GXQ)LD?z179A}l&ESJ~rkug3cGdh)YG9IQl^0kj<Ie*G2$5aR0*$-6rk
z`z62+8~{MdkOCR?5PSzD6}GO0QEEI<-t%a+5m+GrPykeLGEm4{EFQp2b1+Y>JBy2r
zWZ(V1LBN5>fiB@RJ;e@fG?&Z4OOll1IBJ-PMurC_HeCuhvlm-kFTy)@BNs7}q96*s
zS`aZg(j$ylSpb`gW-6mKz>fo(;is(v?(I=0CkaG+xDWQtc!Yf&q;i`J;ubm4tOLmx
z_-I6-j1wjuSkaDO73LPZkv67!O6vh<YS-7?pf`=yIom%M59H;1psf~U--ok=+H62b
zDj0p7szCp55X*QK(%*A(=M)B%W#pe}Z0rOx50b3Kv(hMIh*vJ2*aUD$i=2wIMX6~b
zcBqta>Big~PIJEms&E=24zB13$hr598i{Yrj%x_PQs81{2y;}4kLfekdt4DQlUl-w
zG(HEj1Bst;Q0#ZWey-~xa=<T3^a4o+9=VvC6h=1alOYcdA{ui!R+~aI2l6;aR%Lof
z?Rc8O0vCxRR8?gP<#cMSWky<pj{-&O#gE6+n(xlI;<IRsc%OZv-Ko$>NVY=(jf~T@
z5YALzE#kzalp)2x#qbu9imoLH9V7CBT3E>d=Bz5HKZHcKnS|3ef{929F|bUajc1{f
zr!^FYFxyt3tKkD8YlW^_3nnB7r$;*oG6*Z)m}uNWzo_;CI45Mq2h0w0Bd=Jx&o0AI
zi1{kH?bjA4^i}AMKjg8y&;Wr+c;h*!sW_!UO8d-s0mk+W`2{JUUUbs(jO-wuL-69c
zsNOVcE-V;Eg^>KFSR7ZHpy5|x@&HA;%5?B7S6TAc#D`R0J%{EF|LLZfB!(;bE0O6v
z++RX=alhX|T6Z^Dj4l)A$<+C5q_=W+Ijv_Y0+&Qw^_+GMt4wt=t!c!}vc(uS=|@gP
zq!6Nzs1UNSu1b7+7f}J3=()RcydLzSMKMFAsi>xS@ez0fAYAHSo2Uj58{hl~M^BT&
zhXI;^T!5U>F$%X1yg3dii_+^4vO4Y`P22UKnwx~$f<hG!4_B6hm|3<z$d9<}CnuPh
z3N};l^hpRbw&_~;vade2CmS_N*6VHKu0sM@IX56Et}PsHEP&equ<$*`kRwpqH)$&$
z8~`$a6_^c2cTur*`BGGtHX0072oq09Mk1{p)vNo7Q=VRd9%Tzv2OtA7n_6;knMOPP
z9NZfpKpQoFwtdBjI&Sp0yl(#eTIE>p7E4ki_ejz;yKAlPB$!a&IxD4|%(4E{YtrFt
zacjfb{w5qfs0fTEU;SHSfy92lWz*w=HcT8%ZMIuiJ_`;6BS<Ie1ykCHEBFK6V{j|r
z^1CQnuCQ<<gf_qh&9c77=Yf;k;MGLmMtesUqgW<XlAEzMn15!@4eud<2Z#+!0*ay^
z#DbKbmYry|ki?<DQh4V2ON=R{w2bA|#~Ym>pT0C|#(>gm?D6^mrUkiyx9M;NlpHy(
zP~?xa3665!?JI5``?GmeVxiCiSDN^riHe;w)9Ac5+h9`Og6(by&=3@8*R<9QmemAq
z6fq@tZy^ZovJ3(dSQ@7n2(b(pU{kTh_uBFys;Fs&jB<sIZjGS4hg!rgT>?NOvBHBD
z0VHH-(`@;ILK#0-a>B_|!)u2V72&a)`P6B6oM%EGc(~j)D^y`5P#?ftQ7Y6RFFBUo
z3N0dM$ycY(Mjw<oA|8EMFqISV$yKs(OYmXq-N?}WXYH{{58smr;8-p|-|qU|Syi7*
z<+zpP&#3fHm-=#=UL^PokCx~yS#TUm1CZGXslkc-zNvI?kwUKAA`ypKXo~kpWQsf?
zMn5TGc;-zu+e2g?d!amo@-cjzUhnu=(W%<K;z#*5msxi+A3ZZ;5A$lnX$t4Grnf1!
z{u`?~IOp8=;kqbhpv-Y=!j1c?m%(sCE5JkY?Qh7>TAeD|Q3g#e=^vP%5A%ClTA?NI
z0Vv2|!KKrjCh%A_#HlZwB4OCN1DbgwY=ZSrUf+7aF%Wq}?13(Y^LiZ#vKY2j0Ify4
z=T*~0xfZpmi+0`YE&=;0P?RIlFDMB`{NXXt>D$<4s62uF_vPDhXFrQ?W9<gk&UdhD
z#v4k4Hw#au8w0kx8UEhs1YhP<sPoB+K-5riw{}AUXFmD;q|%`@*dL<d%9&p9-(I=5
zu#@sE=+Nfz-Xh9a;UVBaN{8qC9B7D;aJ|v52{NfFI50;=z0PwkNV=Vn8%*Eh$*xPJ
zV6mZnxWFe84+2}gldFoy6X{6v^N_^@H|_7DTdH7A)-lS|$l&^thQ&*PTenEA%MO!&
zudG0<nE{!gZ!=Q0XuD9Hd5n(SRnd~k$<<Q<za~o50t6><ah(peUFSOv))6iw8-Uu>
zHcL6D(<Qy2qd`PR%6C_v?qo&e2QV9pY#K(N3z{!QgH|37si*4z@5g4$-g5I|0DMk=
z;>-KCtzN)sP5y{E-~+AnENefI)RzS7Q7i$VO{FNxDq%&Ck=8c4Nph^Oo>X^q!r(r&
z(FWRdUO04A&Q?WGv~2Ws$1YY*k6u8<+D@0|*?E82dmhT&dw!RA0%E|q0P_IO)41r$
z-S;JvmzTxvd4%Ic-$<#!Bc>sMp5A03_OQyd_8+JBz)rT=exvJNf^8!ng4;^o6IY6h
zOGH*LYfPo96MzehEV51Zmof^u?|veGM6N5u<@uHT_tKik019NYRJok}`KV5&g1<#p
zUk1vQUWeK*liQxgH@W^+!ys#V^CQ8|z!J9XY&2zDUqe2D2Hh=;N3|{`50>e8J&vJP
z3BCVaxtI3~RiT8x<AJ}(lp1k~wmvL8rppjCbrQ~EWsfDQ1yc<phtIy<YsbHJk%{&+
znb3|ftuMkuXnz=YFTaF&+{L>6IkXeS1eF0Ykg;O?>W$cFSO{1J%|)|T0wD2m0(w_g
zD&5_v%*~2Tg1l>qL}-0hu=mb?i97}z3|7Z;Bv{=<+84V<B*}aMwBF~prFsuO{F#^>
zB;L{wwea_X^by14YU1M6odegetDZL(TAw|3ZEZW2eD*F8POqHfAW_%Cj#N?)sDRCb
zQaI{)=TZ`cf^REhM+qUy2vE=FrYdubfv}2H>ofs@MyzYENq4^xIL(nfmL0A~yezr6
z;uHSRge@w&v?`DVf+kJluA_-G68K7zY=DtxuUqBr?>qb0uOyI-ua8_M5ftt!W8c8V
z(nfNi@lrW`&%Z?;+X-97hm8@bTxWp|{h@D0HXChWY5Dm#Sp~i&$_r4r-U__+xorq}
zx70yrYNCrG=&#<qudC#AW+IuKT+3*tD9#F4<|UyhE!_T;I#>=XW9aIB%hAG2OhVQA
z{C`sVevE5t+rM&~6AK3}T6~6o>2M23?fpz9^ofio8=Yd@w)`=ZzolVWVeS!EASNHt
zjmK<BpM^v3=P*gK*Ony##HdZe)$=Oenc3<@3Hv#{xEZqdK*Q!c3xx)iim%3YKG~pw
z`E>7bl4mF~^ZRPMS8-S=b9sIVTR(!dGh6KSEJE3DT2wj*cXw6co1l}p<7we~ow<H|
z!U4_%s{M)rAU?~s=ZA6;?XS2KRJFN!sbR0E$d`Ca7;63SzBecRTzrk`<v!T&-uPGk
z*TB+>vjzuFD2lIMU%TdXGJnmiF3fRq7CdiSWFp5Y+;A~W1ZyX$!M!^TNlEC{-I$Uu
zk~WYhxD!(=XNStOv;(*+u%`hWqbikTP(Y;0wN~^Xc{vsSR=m(W4l6P``~~UQ-L~#(
z%V%}z!AXb1^Iw(=#8>&A3^&-{e{vbuJO9Z?WPzLKYB_~3DXQ=`Bn0*p-dJ5f#9$Pd
zPgjd6C0Oxy<Ye$vyLD1nn@4VFCS>egEuO=#5R2{}EH(0Iby4qS5kuzPtAofWSR4L~
zO{yjv@EX}29*`2<+IgO8zYTnmZwTvbrS$Pp^=#GBgo0S*-Ur(+uojmhi>&+bk$9fl
zAD^5`=|;jb|3XxggTsiAG^+d2`f1TU^daP}`tR}hIO9PLk`WcFuRf9EfCDsES#R}e
zX}Q!~UccJyu1?xDc2Q?y`|6(d-Bo1?@CW{ghPV4cMGS}~g`Zt;MlH9Rt5W{awSF{&
z_4ILnaayN!VKdUWJY~(GAYdb;TRvP~)0%q-Y97W42?-Qf)qZ8=!u#VOOaVE?OEAN!
zr$YQlSOx39@s{DOh27;hsC4$xRA7uBfs>&gH^x1Fd^#}Hf^f67m)ZIl>b>o@vQv*E
zE(cA84+Sj3<Bp0QDt7bm_50moPDSy77Y>gUN*2>IE#6CeN~lzE$MQY+mGHyo#JxFM
zf0uF0ix0&AJFoZ){r#;qyvs8D1H^Gu0~!R{BvkyK^w;0+dfmCdAb@IPEW#>$8j_>0
zg_pIP&GvmmJBu|NFCXrH^>@ejq?EL%ZgJ`q%5WVUig>hwpLs8)p;B|p*(Yknn>c!;
z+Rjg~o_d%|L^}L7lVw!y7xirq<C4MI%J?ujbD_}%Rd6^T5CxMJ!T3qxgNiaEBjNdp
zAt7|w>vl9<PgQzkdq|2rJv}Q^GU{SWT)&@h&+=<Tg5{YrgV!aOkd{)-ewj{u7i2LT
z*oAnXH%9g|&O~8*i`Y-OeFXMWgSL!Nz6;zOw|A4$^POMS?X+wy4<soq&onbAXSwg#
z{q*0^J3-dk{J><}FMfdb%r;K<3ZbWC-mV<C31wQ?F1(;Y1v)v!3)yJP>D&xp2dSIC
z)9|?-wFkzW8R9=S>uQUPWx6=gx#CeHOz=MHu&Y=&?}^xT0qt4{XHDVq8}wx762qX?
z*ahu)M&+Z7(&=U8GTB;yXh?Z`DP~K(`Dd942@x((bFD0S>yN5OW^vtKDG5iMqEsX7
zzo3HYlIr{xa6ng9_d2%bppQm%f1M`(aGqIvbdk0nG!{hTSj0?j31->bX><16ol8pD
zCb6$G0()^>{)P-`*TrMmiFQn-3Z~fmD7?@Rzu)K8mWX08vGs{k-!HbF1Uo+h5ASGR
zE6Kg8Z#{i2kBAymc_=tmqeX_Yj$cMhXh#&J7?XMTL`0!dXM?A%l&i4-Wt90dP~nO4
zIs4Lo8MSX(B|WX+Gr1W8pcsi3F60_?_cn;D7)bqSX5W@*9XQig>jSId!JO0iD+5s$
z^%f7+k%L^)>hh<?*`c$HhO33UD1s`UL}NU-{rpE*BLz6Vo6}UcS7Xguj~(}hE6G~g
z25qaghviQc0h!(DJE>b|4~a2*`=fNYo(W>1?8}u+OS8|9btgfuV~+e)_!(o|xixgr
zll2sg-iKED{H~1SrD+Ojsd>qP8%Dh!oeS}5Mlbs};lWAN@)k~BFnF1byuy$WXfZ=Z
zO$6ZseU;<M!HOZBOjn)FeCzci(tYBU<G@o`v`AnaAzmVE^msp93)QMnDFfTy*-p}4
z^ZcQ+qC5YJVxN;cF8>pj=vZ8T3!7m_p@Z<Nc??=rnR=1^apqX-?J13k)q%)-_==q}
zX0#eU-28BJbCsV^1GBPL=Qfko+H*|b&ui~@hef`4XAAmjzwKYzysnHg5VQLY-s#u?
zV57SmH4}u-;{4QCQi|htpw%d<0V_=l!pXox2>~tML!&oD-74rV<2{!?=G%GYt!O<_
zu@iXimDfxXJ%;&U2r_QL%%-ib+tb{rCPxoaX_a_#s4`KL@vM0}B+2Rz!G+Y7-d|4d
zUDx03pw2~mx@7WKP@!3hKSPu2)82c4M@br-LJe((&juClRJNgNS^(eQFRtF%0j)x@
z>Luwa7!$)(ch!)9%I^*6K~b<q1L5q!Z;qDYl-LB?%ZraF@n7TR0wog%F$2+}26s@Q
zR8*2<!bN(E69I6V6@!$(y{Q_T3rB%&%?-WofR$Rz5mt^ffH0$t%ODsXdNh=*qM779
zv>F-~7s}9ZM$lz6W|H7b<67@fBV4DddZhL6QvRzc`XZdbY>7+0w+VX8R4ZYJ*Qfj)
zYPpIR>)c@R-QsA3S<q#t_unO)$qWglu!|h0;GK{I09cz62;OlMsI#8(OP!TGs6`ks
z!4O9?jb<}C_k3Qd@e7keWKQJHz@D*GfFq|(P+_eM)aq>4<ReDu+G(fak1%yxUfi@0
zbldup^@^(CY3$%>v<oJQys7mm?w752p;eZ&IIa%C4H!~}GBIrKI$dV8BA&fFFU~K|
z@PY`n!LriL*Ux9!2pq&by;=J*xU5Mc8L4KuDM%uefL}`Y3fzw%eiQ9ged#4O44OL$
zW;de7fM+_%o~$Le_~8_a22lx!l7P(USv2rAYS3kMGo@0X>m7G!WqMv4ZP8fhlGv3N
z(T^S1pdrhHQA&{NW(m~maz-6@sI{1Vt~)+IkFN2%dUqG-h!Z+h>aMKj_5S;ueQ8T`
zdiuFb<C&TmhCxaZFW79}a{|N84nIFNPdWv1SG|nSiDP|SCqpT=N5yuQ#G6kr9-Ouk
zO69D??B*53^A7bkI&;Z)+j}^+iQD_dlNm>t;um5DL7xzgNZv@vGx0_@h#3^mX$x@h
zVDxy+LU!OiPvx+thxqq%qT_bWZP!%D;CrpB!wzbwZaZi`lN$|-%x*@Rzg$~$zTVy}
zKg|A6uL^q-!rYeZ1{6B+uCmr+Ef=6Wpj)pZ#@A!!B-i>vI4hy0S7-g={%T~?YyX-4
zvgs~8knf~esbDS3J9AoVa&pjAN_(@Lm(}lR=|ieiO*_zH@s4KL{Z~%%3p^SWoa`9C
zceH!;s1djp1e2=pyWtUXJck33yW$%R1^GqdShd&P^vp(7l!>tES2nh>16q-bKdglP
zLf#v_f67t<*apB?pt45OLBJp@%rVhJL{e@X1sRkWdz4t4r=015#-y8mm#@t7l`iiy
z9RXp~O!|PzZ&MVh&i(*Wg{`2PX#SY1YT{_^M-0J-?V7|J&s^gmej37eWdH!c039|K
z=nESwO0Stj9h={A=~;RgG3+PYyXV;S+WDSLFSDvm!EZ+Y^6J}Dr<)%j9?+XvXb_&n
zAo{E|!0LOB&xZ#d{HhyDjIE<i;$Oa#Cr~l#Ml~w^Hjqks)jK1}O|mou3epLWlI9`X
zvKgY<T8(BaxJ5%wBg6O{=<qcs7mXLCBp8ZNN0w{B+kI>M<-=gptG>Qcn50I{5e1CI
zA+5eW!c9O>VH0Hro3nbv!k`Qn*hJ7?DrL659+`a9`uQzEf2}?Byi2>*zgHm=iK^+p
zYfL28(`_Y*VsmpLF(!wH5R(-qthllNUJ01v+;QVuxk8OF6nxP(DP?(vaFq*8cIwH;
z3ZM#(SGW&Jh6VVh1LBsz7f?v@5~o#P5(w5LOGJ*JA~wO%Jkm=(MZTp6S%#z?7lHW(
zQ`cSN1;3fz;m*Ith2Jk3AKuS^&=l0g!uPFS(`0==MiRzHCKgdi`0trlW&??=m7Lxn
zzp!7U(r`fmAz}DHVW=MgZ`Td)?H|9QR0vXPw`_XGVMp~$;8<ji=AaKi9XO0*?jf{^
zFQ-eJgnlntWdbSss_O#cEn$a%klFQwzu*18%NoHL<xU(RhO5c;1z`ta_g^^n9$g6c
z?PyY{9pM>(^FRRoKx3i-a*QJ<5pf^NpHTPeK<#1=R<-nS8Z6Ulu*o{ew0kkM`rB4d
zd^D#pYC^Uj$H!$klLR-Z&8-E_AVoaty!K~mk|BQqukT5coH+WiGnXDK4Ypew6Di3;
zI`}J8e{DwqFRIO7Wfg;<z(OPqhcZ|FQ<by%Op;H+;Wbr7QBr@k<sh}s>--Nj4u0x5
zQ7c}QW<Z}tj{=YR`g(wnvJbeObV|aLR<stqjk!>TP%w|Wuy5C{&fWj$nsZ044y;Ja
z8cZPL;IUn*1IHF`=~GWz1ggWUU55YWU0&z?3G{e<YqeVWCZjwBGJYq0!JSM^0|SC`
zK@`ZC#~Av5?ivNmkCP2BcxL(Cshb~Kc9bQjm$44hF2rRNp(7FThvOh;Br(8e><QA2
z%ZvzYgDRS$Ptx1A9B5_{@kSKJsW#-bkuvqQvYJ+jeit%#`QLq~jx|MCX=!vc_=sRQ
z11PWg(NG~1ERouaclPoN1N*JSlnq(@K93Ej=a$0q10l38aMm5p3|yve?bQ{iz4F?C
z*ifPtPffv;0FCfGynwPFNRv4r_%kY_P6NfcuxvxyuIJ`SIxGp&+@5I{QJSG`<6MtG
z%#?MgSev*n7-7PHP@Zn!yzV%)i4i7Q^Pc|xu;IdIFG2b%(-R0qiAPDvfyFUQ2PAiG
zabsUznL*aTLhs@IcRdnZ(mQw1@d??HIvmCM9u6cB@9--1QP!XXe3TMsnhd2qWtQL3
zo(&epmmzbtA3<3%%8Cagd&8DIn_a(Ij?a9gm&J%osbnMwO2oyC=!+dlf9uDN;Ki*B
z2C<nN;{~J|Ax!=pq{20^G7I`6(zhOsY!V0;r*nL0q<;6jOdg`Mgw&t?%l(VGtI<15
zJ}f63#PUJtyIwz=s{yL+$0m5M03jd**Ju+B_p77{oHY_0v^o5&;%o*L%0}(CGws$l
zmW8Kv$IgPHy0F(5?-BEcf`$%6CgO|b`YMF}QF+JV2_A9`S)_B%o@uV<K;cS{3q^hB
z1G7J4W8##SeYoet@-@}FHJ`&=zrDA}+dM`RuV6ccx^X4bcUynsA+i$UV)UomkumU~
zhWu@#WxV}T%@NEl#+nz5eR9aQ>Q<V7%2hq(-Tit`hFYeVtqZ7MMMtESlwd0LEFq}5
z3RfKg%i;iAS0GJ@CB~4+bp`PsYn1!UxQV%CSScJrjN`dOXQrdnxA=_=8miU;5`NBo
zU%7r9t$=npall)x7J_AKtVBA|VWu>uzVtp`0*!dw=e?pM4TwtC>T=pFw?p=a{Vbpr
z!R=K+5{Kg@f_Wt34HT~Vbu=YF>hJB#wc+(@urz#egDs)kVAaYv@j>$G!VGehtNjK+
z^pz86DJLEeB^D45rXW_5hrmM3FF6a>Txh)gfQPo_V-79DD)GqVZLc8c_N~&)gmEC~
z!GRDulFk<fADbX(>x3+qT3o-dlwaRAbX?yS<5aq1BvTtz+DccYvHnR89#W@Ka({RM
zvAJAcAd4<BIjmm5d6=-8^c0A6qYC>2GFr5HPZ}W<;6n59R8<3hSL#DaIKt%t$)JK9
z6^IPsGdAR6VlK434vJ29azw7BzvL<3XHa7fzv#~F^PtyDqQTJ(7~{Y#_7+O?fdf&X
z8N%`N;MBqDBS`|nwl_X<g#w@vrJjVtp3U+gUYC57vSHawt0!_8f6*Q#%D;&d2<5^^
zfBU!xTF%9dztJeYJpwdy5Y!4z3zZfQcRbelcM`%#+f8H~s}m8tq_uEw@0>)_Ve;T9
zO%pvzX;~!VT2RGJC>1cdGmux((!!~B$;4E~We<PB&D8c?-#RrmHYcR1yj9sVI)4}b
zO#G$GD9w&xl|8_AzKSQo3JNnflYwL91Z}H9;`RfAe@58a6z#pAeP{SsyZT=IpnO4I
zQ$xI#V++1A2<h4MKQEYtf!GHSLQjhd^@_&Aq#FgA@egE!Lsp4NY-ip=)-=2Bk0R({
z7S>m(-7YqwD!QHUja4~TRB{0s68*QYexU~~{+NRyp79vRClBI0F1+WDz)^3qaaDFs
zegn<le<%5|km-8{;J+x=@RYLXy6r{1E>^egd~Js}JDet;W3%wXbHrqYn}+E#cDjN2
zXaG;R;jOtZfeaUZ9A(VskeWSOU_503FxX%QL>}S&8jHlq%UZW7@v^8rm;y#S`F$=G
z(#-GH|NfaG%`CMx?E`j}H9?!uGXSAe)x=GR+pF`oaD&%QwoRIvew(c+?VFqRX+#z)
zrAu0fudO7#1wb*OYvFN}V}K=jvF2oH?^3L*4czR{PJV6L=(V_+YE6`>5v(Q;{-ttE
zy(zqavxJPPfij0|FM<`K+3HF9=4P4C;-VXYDH$D0xeKW<-EEVs0f~!_W<1@?7#Fye
z(eQS8wV|h~J5F<^C&h~)M!}qrm4z~aCeyTrejFDRj)o8ntjH1!kt!sz<7HQyc4-F^
za@!B}LEn*4<uHvFX*jf1g3L2{zr{73@#IaNg&5%#5)vF8q3CXEwD?ybKeB!)hN47=
ziL4DE5|ejAM~ZjopVbZHzb`-ygu-GA8ca*V0(^cgq2(Y8M!OEtuoGKZVliN4@jl47
z8vXbHQx}PI5)6i3==C7r2|4lN7}f*0863suPWCJOh1yRCOY{n?R_IQA^Pbm+;{?})
z&F9}j?hXwk$lyc&xyq$uzoHQLCMk=c_D|PY_6m+?vg2pFgaJh3K6h3SFMaLRsgrC>
zH8le@z-3riY)A%T^gsi2C`153p$u8dIMLMMC#iM9-^zdKVWyj=5{+CGOdLI-THirX
zRKl){NiJM43!a#~wZNj?GoZ!qGwgZh$<AVwHg}}!GQC5I=l3c~%dleEi@{6$>RHAY
z<EN2!>*8-nK_XZoG=s73TWirVYwp`?E$iVodtWIqB8=9m>4}!LhJP6f!#2^xk}hy5
zTc>eH?$&{)bAyRP4Z<Li5ZE~7iAG7nqJeU<P?Y__fiLqvF18@a@*w?i#S_3=Ck}y_
z+rjXnGEiU03tNToboijYFoc1gvVRCZU)$H-H?M(OR-lpk?ReB|(dWw5M%WK0H%pzb
zCd-ebRr_s}%=%L<z8zmY?aqYxhkL9KTzy^>p<LOCSGz)?aBEgLVoD!ZXm!83=dFyl
zOJ<p&7q4N!K@(2TG~&LdGqLKr@~VZJ7`MUF4N}oQoDaezg5cmvm5oA$1pt!Umf&r+
z>Dh(0Psw+>a#}(KuHn<`(F%Jp4)}J7;p@9m$D2w-HmhCBb<Z=V){B1$h=ur99V<C{
z^DNoFvUw1?SKepMIdbcMd*MUHU$K$G2J5YBdM<roulN1CB6m)3K`YT`wO&&Ux35nI
zHTKJmO>GyZXX@vgjf;9TQ^U(K8^<Sz<mh^FPYEG5065aV&BvQmOIxX_X}sO<!fQ}(
zBe(WC014S0GM6T<nwPV&8j-iLFu(Z6Q3m_6F*#;*D(J!E)3c#w1A*)5*x}l@4xYPY
zE0e+T#K4|fcTJ-BSQkPn88$e!GD-BdG6${xJYUz6uPQmH&Mc|1@37X_M>I=&?ITa%
zyyuv5i~Zj<vGb@z<w}B2Z-|C1_>-5VE#H=Rl3`WXx^S#_0+Uu}Vqr4P0m%U_lIYP7
z+Y|jEw84RWG|sb-XD?R(0GbROGPLI`_Dt8`%kq{FG^D@d%@;zuL(qokk$?@LPpuUx
zN=1L`-rCr63|EH6+pRol*U+KWahyOU26r<<m?J^;7x$5rE<WXr?z0XpL;Hqyq;=1y
z{^T^gF*=>V{#ZBL(Mq{<-Hy6DtvC@!`5s$eL}FqBjW>m-qm}mTe;M1ev_jT-?Uz8f
zIcfTlxUp_oV^(e1h-Pl|W2?8lT?X8@KHTe*7a0S=wnM%q$1P?Z=hkno_fNEOV^%-J
z3)0)YCW@@!H3JpU1gD#j>03`&j6V-;tDF04e%}m*hN{GcTT$Az|D~tTCd3UgC(!*K
zn&5H#D)O?%;(xcTfFIi}Wne&HdTw)80TVMtI|(Wc5P=XA1(3y(v4cKyl;V7qD5A*V
z#BcBpWRV%)51W2{wBGk2h7meKW5W{JA(|^?M-OYhF~#5hi8J(IP3K*PM75eN=IHpX
zoIb%)lk0~*L+?>6N0_CV`i^LCwwgO1%^7vb)!)Pw)>37?{C4h<aWvgEiZHz?M1Z-^
zcmKS8+Xf_K1x;a=m9>{!+ABF0nttCQ;4$jmt|uQvFEf3Jy^t<wa#fC5G~nvyz(7Pk
z8R1#}%An!%B)9V0n}h6@^{WAu8k2iD{M;GZeK2_ltW`0J_m%wabl$g9l}7xMRI>RJ
z&l?tc!y#K|0#3zZ*$8m}H7Ej5j>vjJ$r|pe4_m}EtHy#yU;p)E=G?=I$=mxAC4UBR
zl=tVE*uXoFEDE}|HW+0j)R*;WtY*gF&gZ9_7nc;}=Yua}j(pd)tuqvbjEwAeiXAFr
z)<IaGBpma>&hQ4Peg2h>9dVo(Z@y_m=s*-=v($hN6}5dMCZ+*)9I5enGD)<ZO_AL4
z_6#n=dR5U^QdN@YK0qcitHOAq@cpC;WD_>96zBjE&Ai}x3k7GyD(H|4EgXy{pDB8t
z3crZB%{WaqK!47cYZBN3)8tZ3c{mpTxkBhHa{C2|3_F*#2i_+&Z9D{f4iKCWHlnT1
ziC`t=ZruM!PXtDNKSDAxTwMRCkx2|kcMwx00Q3OGag?QEKZKP={hqbOKjP>=Kl9&e
zSpIwh74XRzroFH8{$tzAN-0TJi-Q7H<be<*kpHi;1ib%Y=KoUxg#rI*|5uR$^#79b
t|1U!R|3d!1Nd5l{3HTpK?0+u*AI1Owg$Df}ksko@um5-QpRE5`{|AU%&5i&7
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -36,16 +36,18 @@ xpinstallDisabledButton.accesskey=n
 # LOCALIZATION NOTE (webextPerms.header)
 # This string is used as a header in the webextension permissions dialog,
 # %S is replaced with the localized name of the extension being installed.
 # See https://bug1308309.bmoattachments.org/attachment.cgi?id=8814612
 # for an example of the full dialog.
 # Note, this string will be used as raw markup. Avoid characters like <, >, &
 webextPerms.header=Add %S?
 
+webextPerms.unsignedWarning=Caution: This add-on is unverified. Malicious add-ons can steal your private information or compromise your computer. Only install this add-on if you trust the source.
+
 # LOCALIZATION NOTE (webextPerms.listIntro)
 # This string will be followed by a list of permissions requested
 # by the webextension.
 webextPerms.listIntro=It requires your permission to:
 webextPerms.add.label=Add
 webextPerms.add.accessKey=A
 webextPerms.cancel.label=Cancel
 webextPerms.cancel.accessKey=C
--- a/browser/modules/ExtensionsUI.jsm
+++ b/browser/modules/ExtensionsUI.jsm
@@ -139,37 +139,41 @@ this.ExtensionsUI = {
       // Dismiss the progress notification.  Note that this is bad if
       // there are multiple simultaneous installs happening, see
       // bug 1329884 for a longer explanation.
       let progressNotification = target.ownerGlobal.PopupNotifications.getNotification("addon-progress", target);
       if (progressNotification) {
         progressNotification.remove();
       }
 
+      info.unsigned = info.addon.signedState <= AddonManager.SIGNEDSTATE_MISSING;
       let strings = this._buildStrings(info);
+
       // If this is an update with no promptable permissions, just apply it
       if (info.type == "update" && strings.msgs.length == 0) {
         info.resolve();
         return;
       }
 
+      let icon = info.unsigned ? "chrome://browser/skin/warning.svg" : info.icon;
+
       let histkey;
       if (info.type == "sideload") {
         histkey = "sideload";
       } else if (info.type == "update") {
         histkey = "update";
       } else if (info.source == "AMO") {
         histkey = "installAmo";
       } else if (info.source == "local") {
         histkey = "installLocal";
       } else {
         histkey = "installWeb";
       }
 
-      this.showPermissionsPrompt(target, strings, info.icon, histkey)
+      this.showPermissionsPrompt(target, strings, icon, histkey)
           .then(answer => {
             if (answer) {
               info.resolve();
             } else {
               info.reject();
             }
           });
     } else if (topic == "webextension-update-permissions") {
@@ -293,17 +297,18 @@ this.ExtensionsUI = {
       }
     }
 
     // Now figure out all the rest of the notification text.
     let name = this._sanitizeName(info.addon.name);
     let addonName = `<span class="addon-webext-name">${name}</span>`;
 
     result.header = bundle.formatStringFromName("webextPerms.header", [addonName], 1);
-    result.text = "";
+    result.text = info.unsigned ?
+                  bundle.GetStringFromName("webextPerms.unsignedWarning") : "";
     result.listIntro = bundle.GetStringFromName("webextPerms.listIntro");
 
     result.acceptText = bundle.GetStringFromName("webextPerms.add.label");
     result.acceptKey = bundle.GetStringFromName("webextPerms.add.accessKey");
     result.cancelText = bundle.GetStringFromName("webextPerms.cancel.label");
     result.cancelKey = bundle.GetStringFromName("webextPerms.cancel.accessKey");
 
     if (info.type == "sideload") {