Persistent XPI Toolkit

I put this together after trying to keep a local unsigned extension installed in normal Firefox. The usual about:config advice does not work there, and about:debugging only loads an extension temporarily.

This repository contains the exact patch and test scripts I used for Firefox 152.0.6. The result is a normal-release build where a trusted unsigned XPI can stay installed after Firefox restarts.

This is an unofficial project. It is not affiliated with or endorsed by Mozilla, and it does not contain a Firefox binary.

What is included

• A source patch for Firefox 152.0.6
• A Windows script that patches a disposable Firefox ZIP for testing
• A verifier that launches the browser twice and checks persistence
• A harmless unsigned test extension
• Notes on the Firefox code involved and earlier public work

The patch changes two things:

• xpinstall.signatures.required is allowed to control extension signing in a normal release build.
• extensions.sideloadScopes is opened to all supported scopes.

Language-pack signing stays enabled. Firefox permission prompts, sandboxing, and blocklist behaviour are not removed.

Verified result

I tested this against the official Windows Firefox 152.0.6 ZIP. The same unsigned extension was active on two consecutive browser starts with:

active: true
appDisabled: false
userDisabled: false
signedState: 0

The scripts also verify the expected upstream hashes and preserve Mozilla's optimized omni.ja layout.

Build from source

Use the Firefox source commit pinned in the patch:

27b462b22705a8860f7ab0d33aa5b4b658ae5932

Then apply and build:

git apply patches/firefox-152.0.6-persistent-sideload.patch
export MOZCONFIG=$topsrcdir/browser/config/mozconfigs/win64/sideload-release
./mach bootstrap
./mach build
./mach package

The custom mozconfig uses unofficial branding and a separate update channel so an ordinary Firefox update does not silently replace the patched build.

Quick portable test on Windows

These scripts create a disposable test copy; they do not modify an installed Firefox:

powershell -ExecutionPolicy Bypass -File .\tools\sideloading\build_portable.ps1
powershell -ExecutionPolicy Bypass -File .\tools\sideloading\verify_persistence.ps1

Installing your own extension

Give the extension a stable Firefox ID. For Manifest V3:

{
  "browser_specific_settings": {
    "gecko": {
      "id": "my-extension@example.local"
    }
  }
}

Zip the extension contents, rename the archive to .xpi, then use about:addons → Install Add-on From File.

Version support

The included patch and hashes are specifically for Firefox 152.0.6. Nearby Firefox versions and Firefox-based browsers will probably use the same general mechanism, but the patch must be reviewed and tested against their exact source and package version.

Do not apply the included hashes or diff blindly to another release.

Security

An unsigned extension should be treated as trusted local code. Review its source and packaged contents before installing it, and keep a patched browser separate from sensitive or anonymity-critical browsing.

The general technique predates this repository. RESEARCH.md contains the Mozilla sources and earlier public approaches I found.

License

The source and modifications in this repository are available under the Mozilla Public License 2.0.

Firefox and Mozilla are trademarks of the Mozilla Foundation and are mentioned only to identify the upstream browser this patch targets.