If you have API credentials, run:
cd /var$REPOS_DIR/fireflag/extension
npx web-ext sign \
--channel=listed \
--api-key=YOUR_API_KEY \
--api-secret=YOUR_API_SECRET \
--amo-metadata=../MOZILLA-LISTING.json- Go to https://addons.mozilla.org/developers/addon/api/key/
- Create new API credentials (JWT issuer + secret)
- Save them securely (they're shown only once)
If you prefer the web interface:
-
Navigate to: https://addons.mozilla.org/developers/addon/submit/upload-listed
-
Upload XPI:
extension/web-ext-artifacts/fireflag-0.1.0.zip -
Fill out listing using data from
MOZILLA-LISTING.md:- Name: FireFlag
- Summary: Safe Firefox/Gecko flag management...
- Description: (copy from MOZILLA-LISTING.md)
- Categories: Privacy & Security, Developer Tools
- Tags: firefox, flags, about:config, developer-tools, privacy
-
Upload screenshots from
.screenshots/store/:- 01-popup-overview.png
- 02-popup-flag-detail.png
- 03-sidebar-flags.png
- 04-sidebar-history.png
- 05-options.png
- 06-devtools.png
- 07-permission-dialog.png
-
Additional Information:
- License: Palimpsest License (PMPL-1.0-or-later)
- Homepage: https://github.com/hyperpolymath/fireflag
- Support: https://github.com/hyperpolymath/fireflag/issues
- Privacy Policy: Link to PRIVACY.md in repo
-
Submit for Review
Current validation results:
- ✅ 0 errors (data_collection_permissions fixed)
⚠️ 5 warnings (all unavoidable):- 1× innerHTML in safe utility function
- 2× Android API incompatibility (v142 required)
- 2× data_collection_permissions version warnings
Extension is ready for Mozilla review!
- Initial Review: 1-3 days
- Security Scan: Automated (immediate)
- Manual Review: If flagged for human review
- Approval: Listed on addons.mozilla.org
- Users Can Install: Immediately after approval
Once approved:
- Extension appears at: https://addons.mozilla.org/firefox/addon/fireflag/
- Users can install with one click
- Updates via same submission process (version bumps)
- First submission requires more review time
- Updates are usually faster
- Keep API credentials secure
- Never commit API keys to git