How does Firefox generate the hash values when installing extensions

Question

I wrote some code that manually takes a XPI that was already installed from one Firefox profile, and set's up the xpi to be manually set up on a different profile or computer entirely.

So the I set everything up fine within the extensions.sqlite Database that is within the user profile folder. I can even rename the extension on the fly when I move the xpi itself into the extension folder.

Here's my question: When I extract the XPI, there is a file called 'harness-options.json'. Within that file there are two variables, docsSHA256 and jsSHA256.

These to hash variables must be based on the extension in some way, but I am not sure how exactly.

Could anyone point me in the right direction as to how firefox generates these hash codes?

Thanks.

Answer 1

Firefox does not generate these hashes at all. It is the Add-on SDK which does. The Firefox extension manager does not care about harness-options.json at all. The SDK loader in turn, does care about harness-options.json a bit, but doesn't do anything with jsSHA256 or docsSHA256 at the moment. Other tools, such as the validator that runs when you upload something to addons.mozilla.org, do care about jsSHA256 at least.

It should be noted that add-ons not using the SDK do not (normally) contain a harness-options.json file at all.

There will be one jsSHA256 per module lib/, e.g. one for main.js and so on.

docsSHA256 for main.js will be generated from README.md when the SDK builds the XPI. Apparantly, README.md is not packed into the XPI. For all other modules it appears docsSHA256 appears to be null.

The code in question lives in manifest.py.

In the end you shouldn't mess with the XPI (other than repacking an unpacked extension) and/or extensions.sqlite at all. Especially the latter isn't meant to be modified externally. Just drop the your XPIs files in the corresponding extensions/ folder of the profile and the Add-on manager will automatically pick them up the next time you start the browser.