From 9844d2435b16619b5afb189b965f7634144d3f61 Mon Sep 17 00:00:00 2001
From: Fabian Freund <github@fabi.online>
Date: Tue, 24 Mar 2026 12:40:53 +0100
Subject: [PATCH] Revert "don't require requireBuiltInCerts when installing
 unsigned extensions"

This reverts commit 64d320cf055144b46a54930c32b9e9c083a078be.
---
 .../domain/services/browser_addon.dart        | 34 ++-----------------
 .../dialogs/install_local_addon_dialog.dart   |  2 +-
 2 files changed, 4 insertions(+), 32 deletions(-)

diff --git a/app/lib/features/geckoview/features/browser/domain/services/browser_addon.dart b/app/lib/features/geckoview/features/browser/domain/services/browser_addon.dart
index a78d2dd4..bc46df40 100644
--- a/app/lib/features/geckoview/features/browser/domain/services/browser_addon.dart
+++ b/app/lib/features/geckoview/features/browser/domain/services/browser_addon.dart
@@ -29,9 +29,6 @@ import 'package:weblibre/features/geckoview/domain/providers.dart';
 part 'browser_addon.g.dart';
 
 const _signatureRequiredPref = 'xpinstall.signatures.required';
-const _installRequireBuiltInCertsPref =
-    'extensions.install.requireBuiltInCerts';
-const _updateRequireBuiltInCertsPref = 'extensions.update.requireBuiltInCerts';
 
 @Riverpod(keepAlive: true)
 class BrowserAddonService extends _$BrowserAddonService {
@@ -76,13 +73,6 @@ class BrowserAddonService extends _$BrowserAddonService {
     bool allowUnsigned = false,
   }) async {
     final prefService = GeckoPrefService();
-    final unsignedInstallPrefs = {
-      _signatureRequiredPref: false,
-      _installRequireBuiltInCertsPref: false,
-      _updateRequireBuiltInCertsPref: false,
-    };
-
-    Map<String, Object>? previousUnsignedInstallPrefs;
 
     try {
       // Validate file exists and has .xpi extension
@@ -98,25 +88,7 @@ class BrowserAddonService extends _$BrowserAddonService {
 
       // Temporarily disable signature requirement if user allows unsigned
       if (allowUnsigned) {
-        final existingPrefs = await prefService.getPrefs(
-          unsignedInstallPrefs.keys.toList(),
-        );
-
-        previousUnsignedInstallPrefs = {
-          for (final entry in existingPrefs.entries)
-            if (entry.value.value case final Object value) entry.key: value,
-        };
-
-        await prefService.applyPrefs(unsignedInstallPrefs);
-
-        final appliedPrefs = await prefService.getPrefs(
-          unsignedInstallPrefs.keys.toList(),
-        );
-
-        logger.i(
-          'Prepared unsigned add-on install prefs: '
-          '${appliedPrefs.map((key, value) => MapEntry(key, value.value))}',
-        );
+        await prefService.applyPrefs({_signatureRequiredPref: false});
       }
 
       try {
@@ -129,8 +101,8 @@ class BrowserAddonService extends _$BrowserAddonService {
         return true;
       } finally {
         // Always restore signature requirement
-        if (allowUnsigned && previousUnsignedInstallPrefs != null) {
-          await prefService.applyPrefs(previousUnsignedInstallPrefs);
+        if (allowUnsigned) {
+          await prefService.applyPrefs({_signatureRequiredPref: true});
         }
       }
     } catch (e, s) {
diff --git a/app/lib/features/geckoview/features/browser/presentation/dialogs/install_local_addon_dialog.dart b/app/lib/features/geckoview/features/browser/presentation/dialogs/install_local_addon_dialog.dart
index ff235fe7..99b070c3 100644
--- a/app/lib/features/geckoview/features/browser/presentation/dialogs/install_local_addon_dialog.dart
+++ b/app/lib/features/geckoview/features/browser/presentation/dialogs/install_local_addon_dialog.dart
@@ -88,7 +88,7 @@ class _InstallLocalAddonSheet extends HookConsumerWidget {
         if (errorString.contains('NotSigned') ||
             errorString.contains('SIGNEDSTATE')) {
           errorMessage.value =
-              'This extension is not signed by Mozilla. Enable "Allow unsigned extensions" to retry.';
+              'This extension is not signed by Mozilla. Enable "Allow unsigned extensions" to install it.';
         } else {
           errorMessage.value = 'Installation failed: $errorString';
         }