David Stutzman wrote:
rob wrote:
I hope that this question is not too elementary for this group. I am
new to Firefox and the Mozilla platform, but I am trying to build a
Firefox extension. I want to sign my javascript (on Windows, the only
platform available to me), but I can't find the signtool.exe that
appears to be neccessary anywhere.
Signtool is a part of NSS. There are pre-built binaries available.
NSS can be had here:
ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_RTM/
[snip]
That may or may not be the version Rob needs.
NSS's signtool was originally developed to sign "JAR" files. JAR files are
ZIP files whose contents are organized according to the JAR specification.
mozilla's XPI files are similar to JAR files, and for years one could sign
XPI files with ordinary JAR signing tools, such as signtool.
But about a year ago mozilla was changed to require the files in the XPI to
be in a slightly different order than in the normal order for JAR files. :(
Consequently, the normal JAR file signing programs create signed XPI files
that are not in the order that mozilla now desires. :-(
Several months ago, someone contributed an enhancement to signtool so that
it can produce signed files that conform to the JAR specification, or that
conform to the XPI specification. That new version of signtool, known as
version 3.10, was (and is) intended to be released with NSS 3.10.
But NSS 3.10 has been delayed. It has been a year since 3.9 was released
and 3.10 has not yet been released. Consequently there are presently no
officially built, QAed and released binaries of signtool 3.10. People who
want signtool 3.10 presently must build it themselves, or get someone to
build it for them.
I have been told that it is possible to create an ordinary signed JAR file
using any of the older signtool versions, then unzip the contents onto a
local disk with an ordinary zip tool, and re-zip them into a new zip file
with the files in the order desired by mozilla. But I have never tried it.
--
Nelson B
_______________________________________________
mozilla-crypto mailing list
mozilla-crypto@mozilla.org
http://mail.mozilla.org/listinfo/mozilla-crypto
