Repository navigation
sign command should ignore web-ext-artifacts folder #1640
Description
Is this a feature request or a bug?
Bug
What is the current behavior?
The 'sign' command includes the web-ext-artifacts folder when packaging the extension.
What is the expected or desired behavior?
All web-ext commands should ignore the output folder used by web-ext. The 'build' command already does, which leads to someone testing with a correctly packaged extension and then publishing a bloated extension using the 'sign' command
Version information (for bug reports)
- Firefox version: 67.0.4
- Your OS and version: Windows 10 1903
- Paste the output of these commands:
node --version; npm --version; web-ext --version
v12.3.1
6.9.0
3.1.0
Additional details
It seems the 'sign' command filters out zip and xpi files. So in theory that would exclude whatever is in the artifacts folder. However, I build my extension for Chrome and Opera so there are nex and crx files in the folder, as well as my extension unpacked for testing in Chrome and Opera.
Here's a capture of the output from the sign command:
sign.log
Activity
Rob--W commentedon Jul 7, 2019
Could you also show the command that you used to generate the given output?
The observed behavior might be related to #1641
carlin-q-scott commentedon Jul 7, 2019
Sure, the command I used is:
web-ext sign --channel=unlisted --api-key ******* --api-secret *******Rob--W commentedon Aug 1, 2019
@carlin-q-scott Does this still happen with the latest version (3.1.1) ? That version contains a fix to #1641.
carlin-q-scott commentedon Sep 4, 2019
Yes, this issue is still present in v3.1.1
Rob--W commentedon Oct 8, 2026
After taking a closer look following the PR in #3834, I see where the issue is coming from.
The
signimplementation creates a temporary directory, but still prepares the (default) artifacts dir (=create empty directory if not already existent):web-ext/src/cmd/sign.js
Lines 45 to 46 in 3b0c95e
When it builds the package before signing, it outputs to a temporary directory:
web-ext/src/cmd/sign.js
Lines 58 to 60 in 3b0c95e
Not clear why exactly, maybe because there was the (mistaken?) belief that reusing the artifacts directory would cause conflicts? I don't see any justification in the original PR that introduced this, in #151. That PR used it for output only, which was fine.
Then PR #753 made the
artifactsDiralso an input to the file filter, but sincesignpasses a tmpdir, it would not match the actual artifacts directory left behind by previous runs (nor the directory thatprepareArtifactsDircall created), and consequently the ignores would not work.