Mozilla recently dropped support for Firefox XUL extensions.

The initial threat of this prompted me to discover how to re-enable XUL extensions by modifying Firefox's omni.ja file. That clearly is not going to last very long since Mozilla is also deleting XPCOM interfaces but I note the Tor Browser is temporarily still using XUL extensions.

Since I have some extensions I wrote for myself, I will need to rewrite them as WebExtension add-ons.

The first thing to do is check how to install WebExtension add-ons. My local XUL extensions are run from the corresponding git trees. Using an example extension I discovered that this no longer works. The normal way to install add-ons is to use the web-ext tool, upload to the Mozilla app store and then install from there. This seems like overkill for an unpolished local add-on. One way to workaround this is to disable signing but that seems suboptimal if one has installed Mozilla-signed add-ons, which I will probably have to do until Debian packages more add-ons. Luckily Mozilla offers alternative "sideloading" distribution mechanisms and Debian enables these by default for the Debian webext-* packages. Installing a symlink to the git repository into the extensions directory and adding a gecko identifier to the add-on manifest.json file works.

Then I started looking at how to rewrite XUL extensions and discovered the user-interface options are limited compared to XUL. So the Galeon-style smart-bookmarks workaround plugin I use a lot is not even possible to implement as a WebExtension add-on and will require some changes to search, bookmarks or WebExtensions user-interface APIs or a solution external to Firefox like a floating toolbar.

Another plugin I wrote adds a few buttons to the toolbar but WebExtension add-ons are only allowed to add one button to the toolbar. The plugin is more logical as an address bar button but again WebExtension add-ons are only allowed to add one button to the address bar. Each of these allow popups for additional user-interface. So the options are to split this into multiple plugins, one per button or to reqire a second click in the popups.

The remaining task is to migrate from each of the xul-ext-* Debian packages. Some folks have already completed their transition and documented it.

Some packages simply got updated to the corresponding webext-* packages. Some packages were updated upstream but aren't yet in webext-* packages.

Some packages were no longer developed upstream but were updated in forks or reimplementations:

Some packages are no longer useful upstream but alternatives are available:

  • Adblock Plus: acquired by the untrustworthy advertising industry, replaced by uBlock Origin
  • Stylish: acquired by the untrustworthy advertising industry, replaced by Stylus
  • Cookie Monster: cookie-autodelete or uMatrix are possible alternatives
  • DOM Inspector: the native web developer tools are almost the same
  • HTTPS Finder: smart-https, https-by-default are alternatives and https-everywhere is kind of an alternative
  • livehttpheaders: the native web developer tools are mostly an alternative but headers are missing from the page info dialog

Some packages are blocked by missing APIs because they are not yet permitted to replace the Certificate Authorities with alternate trust models such as DNSSEC+DANE, Certificate Patrol, Perspectives, Monkeysphere or Communism.

Like many technology transitions, this one was done for good reasons but is extremely disruptive and a time sink for users and developers. I still have floppy disks that could contain viruses or poetry but I will never find out their content.