Publish Firefox extension on addons.mozilla.org

[QJKX]

Creating an issue so I can be notified when it's available 🙂.

[robertknight]

Hello,

Our current plan is to host the Firefox extension ourselves (ie. make it available from https://web.hypothes.is) rather than list it on https://addons.mozilla.org, although it will still go through Mozilla's automated checking processes. The reason is because we make hundreds of small updates each year and addons listed on addons.mozilla.org have to go through a manual (rather than automated) review process, making it difficult to ensure users get updates quickly.

[QJKX]

Thanks for the reply. That's pragmatic but disappointing.

I suppose fixing that needs support from Mozilla's end (maybe through the "recommended extension" program?) https://support.mozilla.org/en-US/kb/recommended-extensions-program#w_may-i-suggest-extensions-to-become-recommended

[anavarre]

It's great you're considering a Firefox extension. An ETA would be really nice to see so expectations are set. If you need beta testers, it'd be great to know how to participate as well.

The reason is because we make hundreds of small updates each year and addons listed on addons.mozilla.org have to go through a manual (rather than automated) review process, making it difficult to ensure users get updates quickly.

While I understand the reasoning, I'd argue it's better to have something than nothing, so you could continue working at a fast pace and offer the extension via the official website but also publish on addons.mozilla.org as well. This could be on a quarterly basis for instance, and it'd increase discoverability of the service, bug reports / feature requests and overall popularity.

[robertknight]

An ETA would be really nice to see so expectations are set. If you need beta testers, it'd be great to know how to participate as well.

Thanks for the offer to help with testing. We have no ETA at present.

[ZiadJ]

So, if I got it right, Firefox support is not being considered as a priority for now. The only reason why I haven't recommended the Chrome plugin to others so far is because it is not cross-browser compatible so remains inaccessible by a good portion of the population. Firefox is the only major open source browser out there and those using it cannot be ignored if we want true freedom of information.

I'm wondering what the actual priorities are then if it's not to provide a seamless support across major browsers in a non-fragmented way. Again, I can't use nor can I recommend Hypothesis in its currently fragmented state so I'm really curious to know what those other priorities are that would make not worth an ETA. So my question is: Are the development requirements too high somehow for it to be worth it and, if so, what exactly is to be considered as more worthy for now?

[robertknight]

So my question is: Are the development requirements too high somehow for it to be worth it and, if so, what exactly is to be considered as more worthy for now?

Hypothesis' short/mid-term roadmap is currently mostly driven by the needs of users (students, teachers and institutional IT admins) in school/college/university contexts where the client is already embedded in the page by some other tool, such as our integration with Learning Management Systems (LMSes).

The Chrome extension is widely used, we're continuing to support it, and we still have ambitions to bring it to more browsers. I just can't make a firm promise right now of when that will happen.

FWIW I personally use Safari as my main browser and find I am able to use the bookmarklet on most websites, with occasional recourse to our proxy server (https://via.hypothes.is).

[diegodlh]

@ZiadJ , I know it's not perfect and I would also like to see a Firefox addon, but some friends and I have been using Hypothesis seamlessly in Firefox, both for desktop and for mobile, following the instructions I posted here: https://medium.com/@delahera/hypothesis-web-annotation-mobile-358db1f9ec46

[drjackal-git]

@robertknight if you need testers for firefox addon I can chip in.

[diegodlh]

I sent a pull request earlier today with a proposal to fix the login issues in the Firefox extension. Let's see what the maintainers think about it.

[andreicristianpetcu]

I spoke with somebody from support and they said they are ok with somebody publishing unofficial builds as long as they don't use the trademark. Are you interested? @diegodlh You can make an unlisted extension and ship updates to your users.

[diegodlh]

Hey, @andreicristianpetcu! That sounds like a great idea. I don't have much experience publishing Firefox addons, but I'm happy to learn.

Let me just confirm with the maintainers that they can't consider my pull requests right now. It's just a few changes to have the extension running, so I want to make sure they won't merge them into their code before going with an unofficial extension. I'm gonna write a message on the pull request now and wait for a few more days.

I also wonder what they meant exactly by not using their trademark. I can make it clear that it is an unofficial extension, but I think it would be unnecessarily cumbersome to remove the trademark from everywhere in the extension and in the embedded client. I don't think that's what they meant anyway. And why make unlisted?

I'll keep you posted!

[robertknight]

Let me just confirm with the maintainers that they can't consider my pull requests right now.

I'm afraid we've been pretty busy getting some new features ready specifically for our customers in education (who use Hypothesis as part of assignments etc). I would still like to look at this PR, but I'm afraid I can't make promises about when that will happen or when we'll be able to ship an official extension.

I also wonder what they meant exactly by not using their trademark.

Basically we want to avoid users mistaking custom builds maintained by a third-party for an officially supported product. Think of how custom Google Chrome builds ("Chromium") have a slightly different name and distinct logo. We haven't actually discussed what exact requirements would be internally, but I think modifying the extension metadata and icons (shown in the extension store and browser toolbar) would probably be enough.

[diegodlh]

Thank you, Robert. I will try to find some time to work on this after this weekend. I will follow your advice to make sure potential users won't mistake the custom build with an official product.

As soon as I have something online I will let you know so that someone can check if metadata and icons are OK, configure the redirect URL on the h server, and provide me with a client ID.

I'll keep you posted!

[andreicristianpetcu]

@diegodlh For publishing an extension outside of AMO you need:

a json pointing to updates like this one https://github.com/andreicristianpetcu/google_translate_this/blob/master/updates.json

You can publish your artifacts as github releases on your own fork.

Manifest.json pointing to update.json like so https://github.com/andreicristianpetcu/google_translate_this/blob/master/manifest_desktop.json#L53

An extension that is signed by mozilla at this url https://addons.mozilla.org/en-US/developers/addon/submit/upload-unlisted

Unlisted extensions still need to respect mozilla rules such as no remote code execution, no tracking etc.

Once there will be an official build on AMO, you can point to it as an update if you have the same manifest global id. Getting from unlisted to listed is easy. In Firefox, you can have more than one dev on AMO.

Maybe some people in this thread don't know AMO = Addons.Mozilla.Org

[diegodlh]

I published the unofficial extension for Firefox here: https://github.com/diegodlh/browser-extension/releases/latest

I changed the name of the extension to "Unofficial Hypothesis extension" and the homepage URL to my custom fork of the browser-extension repo: https://github.com/diegodlh/browser-extension. I changed the README there to make it clear that it is not officially supported. I also changed the icons by removing the "h." from inside the balloon. I hope this is enough. Let me know otherwise.

Upon signature of the xpi file, Mozilla assigned this UUID: {7dc760e7-5cc5-4e76-8468-18b2b003f22a}. The corresponding redirect URL is: https://22b339b709144d8f7f67048b95127b49fe1b7b09.extensions.allizom.org/

I used the official OAuth Client ID as found in settings/firefox-prod.json: 7fb28342-7793-11e7-90b5-7fed4053f592 @robertknight, could you or someone in our team update the OAuth client configuration on the h server to include the redirect URL indicated above? If you prefer to configure a new OAuth client instead, please send me the client ID so I rebuild the xpi file accordingly.

I included an update.json file as suggested by @andreicristianpetcu. I don't have experience with Jenkins to have the unofficial extension automatically republished every time a new version of the client is released, but I will try to keep it as up to date as possible.

As mentioned in the original pull request, this extension will not work in Firefox for Android because it does not support the Identity API. I wanted to try it in Firefox Preview for Android, but I didn't know how to change my development h server to listen to connections from my LAN. Once the extension is authorized on the official h server we will be able to try on Firefox Preview.

So far I've identified two bugs that I will be happy to work on once the extension is up and running:

1. In some sites, the badge says there are 27 annotations, regardless of how many annotations (if any) there truly are. Unfortunately, I don't remember any examples right now.
2. The extension does not work with PDF files, as reported here.

Finally, the extension failed some of the Mozilla automatic tests at signature. It complains about content_security_policy in manifest.json, "The Function constructor is eval" and "Unsafe assignment to innerHTML". If I find some time later, I would like to work on these too, to make sure the extension will pass manual review for listing in AMO.

[serovar]

@diegodlh I can't log in using your extension. If I click login, the hypothesis website sign-in page opens correctly, but when I log in I get a "302 Found" page with a message like this: The resource was found at moz-extension://32492fee-2d9f-49fe-b268-fe213f7019f0?code=pxdrv61YCejti2i7GBQyfrSUJ5J3d8&state=5c803d52497cf288; you should be redirected automatically. , but I am not redirected and the extension does not log me in (and when I close the hypothesis sign-in window, the extension says Error: User cancelled or denied access.

I am using Firefox Developer Edition (78.0b3) on Linux.

[robertknight]

@diegodlh - I registered a new OAuth client with the description "@diegodlh's unofficial Firefox extension". The OAuth client ID is "d3dbc80a-a95b-11ea-9dde-1ffed9ddee4e" and the redirect URL is set to https://22b339b709144d8f7f67048b95127b49fe1b7b09.extensions.allizom.org/.

Please give that OAuth client ID a try or let me know if you want me to make changes.

When you log in using this client ID you'll notice an extra screen in the login dialog that asks the user to confirm they want to share account access with this client. The official extensions are allowed to skip this step.

[robertknight]

As mentioned in the original pull request, this extension will not work in Firefox for Android because it does not support the Identity API.

If the extension can work in Firefox for Android that would be super cool, as Chrome does not support extensions on Android (at least, last I checked). I did look into this maybe 2 years ago and found that several essential APIs were not supported at the time but some of those have been since resolved.

[andreicristianpetcu]

you can sign/publish the extension in jenkins using web-ext cli https://extensionworkshop.com/documentation/develop/getting-started-with-web-ext/

publish with this https://github.com/remixz/publish-release/blob/master/README.md

[andreicristianpetcu]

I generate my update.json with this ugly script https://github.com/andreicristianpetcu/google_translate_this/blob/master/build.sh#L3

[serovar]

@diegodlh I can't log in using your extension. If I click login, the hypothesis website sign-in page opens correctly, but when I log in I get a "302 Found" page with a message like this: The resource was found at moz-extension://32492fee-2d9f-49fe-b268-fe213f7019f0?code=pxdrv61YCejti2i7GBQyfrSUJ5J3d8&state=5c803d52497cf288; you should be redirected automatically. , but I am not redirected and the extension does not log me in (and when I close the hypothesis sign-in window, the extension says Error: User cancelled or denied access.

I am using Firefox Developer Edition (78.0b3) on Linux.

Works fine with the new release, thanks!

[diegodlh]

I've just published v1.441.0.9 with the new OAuth Client ID provided by Robert. It should be working now. You can download it from here, or wait until it is updated automatically by your browser.

If the extension can work in Firefox for Android that would be super cool, as Chrome does not support extensions on Android (at least, last I checked).

I'm afraid the extension won't work in Firefox for Android right now because it does not support the Identity API. It might work with the upcoming version of Firefox for Android (right now Firefox Preview) but I couldn't test it yet; I will soon. Anyway, it looks like this new version will be more restricted regarding to addons than the current one: https://www.reddit.com/r/firefox/comments/fafx9m/for_addon_developers_wondering_about_fenix_it_is/

Chrome still doesn't support extensions on Android. One can use Yandex instead, or follow the instructions here or here for a workaround on mobile devices.

@andreicristianpetcu, thank you for sharing those resources. I will check them later this week.

Keep me posted of any bugs you may find! I guess we could try and fix them both at the main codebase and at my fork until the official extension is released.

[diegodlh]

The extension does not work with PDF files, as reported here.

I think I could fix this on the new release v1.441.0.10, although not for local PDFs apparently due to a separate issue. See here.

[Katharsas]

Thanks, the unofficial extension seems to work. But i have to click Login and then accept "@diegodlh's unofficial Firefox extension is requesting access to your Hypothesis account " repeatedly on every page/domain. Allowing hypothes.is cookies didnt change that.

[diegodlh]

Hi, @Katharsas. For what you describe this doesn't seem to be related to cookies. If it were, I think you would be asked to enter your username and password each time too.

It seems to be related to Local Storage instead. When you log in with the client included in the extension, an access token is saved to the extension's local storage. The situation you describe looks like the client injected by the extension on the new tab is not being able to read the token saved to the extension's local storage previously.

So far I've found two scenarios where this happens to me as well (possibly purposefully):

1. when tabs belong to different containers, and
2. when browsing in a private window.

Is your case either of these? Or maybe you are using another extension that may be causing this? What version of Firefox are you running, by the way?

[Katharsas]

I just updated to FF 78.0.1, same problem. I tried deactivating CanvasBlocker and uBlockOrigin entirely and setting FF tracking protection to Standard, but that didnt help either. Im not using private mode or containers.

When i am on a page where i am properly logged in already (for example github), i see

On a new page (for example wikipedia) its missing:

[diegodlh]

@Katharsas, I'm not sure what the reason could be.

Does the problem still occur in a brand new Firefox profile? You can browse to about:profiles to create and run a new one.

Can you try with the bookmarklet too, instead? Is your access token forgotten between pages with it too?

And maybe it'd be better if you open a separate issue instead, either here or in the unofficial-extension repo, so we don't add noise to this thread ;)

[Katharsas]

Seems this problem was fixed by Unofficial build #15 for v1.441.0, it works now : ) Or maybe i changed some FF setting? Not sure.

[diegodlh]

Just for the record, this issue from 2018 states that the Identity API is not supported in Firefox for Android. Apparently it is still not supported in the new Firefox for Android either :(

Edit: Someone from Mozilla's add-on review team replied here and said that some of their Recommended Extensions require the Identity API, so apparently there's hope they will implement it in Firefox for Android soon.

[krillin666]

Any update on this ? 👀

This is crucial for firefox users on android !

Nevertheless, thank you so much for this amazing FOSS project