A signed add-on has a META-INF folder. Recent add-ons can carry two
signatures side by side: one in the format of a signed JAR file, and one in COSE. An
older add-on may have only the first, under the names the old signing tools gave it.
The explorer lists these files and reads the list of digests. It does not check the
signatures.
The files
| File | What it is |
|---|---|
META-INF/manifest.mf | A digest of every file in the add-on, in the format of a JAR manifest: a Name line, then Digest-Algorithms, then a digest for each algorithm. |
META-INF/mozilla.sf | A signature file that holds digests of the manifest. |
META-INF/mozilla.rsa | A PKCS #7 signature over mozilla.sf, with Mozilla’s certificates. |
META-INF/cose.manifest | A list of digests for the COSE signature, in the same text format as manifest.mf. |
META-INF/cose.sig | A COSE signature over cose.manifest. |
META-INF/zigbert.sf, zigbert.rsa | The signature file and signature in older add-ons. |
The manifest format
The manifest starts with a header line, a blank line, then one section for each file:
Manifest-Version: 1.0
Name: popup.html
Digest-Algorithms: SHA1 SHA256
SHA1-Digest: 3Hh1…
SHA256-Digest: z/vd…The digests are written in base64.