When submitting an add-on to addons.mozilla.org (AMO), it is sometimes necessary to attach source code in addition to the xpi file. This usually applies to add-ons with obfuscated code, because a reviewer wouldn\u2019t be able to approve an add-on without reviewing what was obfuscated. Since these types of add-ons are more complex to review, I\u2019ve written some tips on what you can do to help them get through the queue faster.<\/p>\n
When the add-on xpi file you upload to addons.mozilla.org (AMO) contains code that is not completely readable by a human, it is probably a good idea to attach sources.<\/p>\n
For example, if you used tools like uglifyJS<\/a>, Google Closure Compiler<\/a>, browserify<\/a> or a custom pre-processor, you will have to upload sources. The same goes if you are using js-ctypes or including other binary components.<\/p>\n There are also a few cases where it is actually NOT required and in fact not recommended. If your library only contains third-party minified libraries (like jQuery or Angular), or if the libraries you are calling via js-ctypes are system libraries or open source, please do not upload sources. Instead, provide links to the repositories of the respective libraries.<\/p>\n When you attach sources, the add-on is marked for “admin-review”. This means that your sources and are only accessible to a small group of admins. We do this to protect your sources.<\/p>\n A very important aspect of reviewing sources is reproducing the obfuscation. As we need to treat every extension developer the same, we must verify that the source code we reviewed matches the uploaded xpi. If we skip this step, a malware author could provide us with legitimate-looking sources and add a backdoor to the previously minified xpi file.<\/p>\n Here are the steps we take:<\/p>\n In step 3, we use a diff tool to compare the generated sources to the add-on xpi file. There must be no differences at all. To save time, it is very important to provide us with all the <magic steps><\/i>. If you don\u2019t add this, we will have to get in touch with you, and that adds time to the review process.<\/p>\n The easiest way for you to provide the magic steps is to include a Please assume the reviewer has a vanilla operating system set up. You don\u2019t need to describe how to install common tools including npm, node, the add-on SDK, but please make sure the reviewer can figure out how to install everything needed to generate the xpi file.<\/p>\n Aside from the Common build tools used are make<\/a>, grunt<\/a>, gulp<\/a> and ant<\/a>. If you don’t already have a build target that runs the above steps, please add a target that does so. For example, allow us to run <\/p>\n If you can avoid obfuscating or minifying code, your review can be done by any reviewer. Should you still need to attach sources, make sure you provide clear instructions so that our admin reviewers can handle your add-on quickly. Responding to questions quickly and using well-known obfuscation tools also improve review time.<\/p>\n While our reviewers, both volunteer and staff, review add-ons around the clock, there may be times when it just takes longer. This can be due to anything from Firefox releases and major product changes, to holiday seasons.<\/p>\n I hope you\u2019ve found this post helpful. There\u2019s a lot to remember, but after you\u2019ve done this once or twice you should get the hang of it. If you\u2019d like a page to bookmark that contains this information and some more details on the topic, please head over to our new article on MDN<\/a>.<\/p>\n If you also have tips to share, or questions on this topic, please post in our forums<\/a>. Also, if you ever want to sit with developers on the other side of the table, perhaps consider applying to become an add-on reviewer<\/a>?<\/p>\n","protected":false},"excerpt":{"rendered":"What happens during reviews<\/b><\/h4>\n
\n
Providing instructions<\/b><\/h4>\n
README<\/code> file in the uploaded sources. If it is just one or two files that are obfuscated, the instructions can be something like “run uglifyjs data\/mycoolstuff.js”. If the extension is any more complex, please provide a script that we can run that takes care of everything at once. Things you should mention in your README<\/code> include:<\/p>\n\n
npm install<\/code> or a grunt target.<\/li>\n<\/ul>\nREADME<\/code> file, you also need to package everything required to build. If your add-on depends on a private repository or frameworks not commonly available, please include them as well.<\/p>\nDesired outcome<\/b><\/h4>\n
grunt firefox-dist<\/code> to create the generated xpi. Here is an example of what the sources could look like. The dist<\/code> directory is initially empty, until your build script (in this case grunt) generates the directory contents. You could then zip them up and upload them to AMO.<\/p>\nsources\r\n\u251c\u2500\u2500 README.md \r\n\u251c\u2500\u2500 Gruntfile.js \r\n\u251c\u2500\u2500 package.json \r\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 dist\r\n\u2502 \u251c\u2500\u2500 bootstrap.js\r\n\u2502 \u251c\u2500\u2500 install.rdf\r\n\u2502 \u251c\u2500\u2500 package.json\r\n\u251c\u2500\u2500 data \u251c\u2500\u2500 data\r\n\u2502 \u251c\u2500\u2500 js \u2502 \u251c\u2500\u2500 js\r\n\u2502 \u2502 \u251c\u2500\u2500 dialog.js \u2502 \u2502 \u251c\u2500\u2500 dialog.min.js\r\n\u2502 \u2502 \u2514\u2500\u2500 popup.js \u2502 \u2502 \u2514\u2500\u2500 popup.min.js\r\n\u2502 \u251c\u2500\u2500 scss \u2502 \u251c\u2500\u2500 css\r\n\u2502 \u2502 \u251c\u2500\u2500 popup.scss \u2502 \u2502 \u251c\u2500\u2500 popup.css\r\n\u2502 \u2502 \u251c\u2500\u2500 dialog.scss \u2502 \u2502 \u2514\u2500\u2500 dialog.scss\r\n\u2502 \u2502 \u2514\u2500\u2500 common.scss \u2502 \u2502\r\n\u2502 \u251c\u2500\u2500 html \u2502 \u251c\u2500\u2500 html\r\n\u2502 \u2502 \u251c\u2500\u2500 dialog.html \u2502 \u2502 \u251c\u2500\u2500 dialog.html\r\n\u2502 \u2502 \u2514\u2500\u2500 popup.html \u2502 \u2502 \u2514\u2500\u2500 popup.html\r\n\u2502 \u251c\u2500\u2500 vendor \u2502 \u251c\u2500\u2500 vendor\r\n\u2502 \u2502 \u2514\u2500\u2500 jquery-2.1.4.min.js \u2502 \u2502 \u2514\u2500\u2500 jquery-2.1.4.min.js\r\n\u2502 \u2514\u2500\u2500 images \u2502 \u2514\u2500\u2500 images\r\n\u2502 \u2514\u2500\u2500 logo.png \u2502 \u2514\u2500\u2500 logo.png\r\n\u251c\u2500\u2500 lib \u251c\u2500\u2500 lib\r\n\u2502 \u2514\u2500\u2500 main.js \u2502 \u2514\u2500\u2500 main.js\r\n\u2514\u2500\u2500 locale \u2514\u2500\u2500 locale\r\n \u2514\u2500\u2500 en-US.properties \u2514\u2500\u2500 en-US.properties<\/pre>\n
A few more tips<\/b><\/h4>\n
Some last words<\/b><\/h4>\n