Release email says add-on "is now signed" but downloaded Thunderbird XPI has no signature (META-INF missing, file identical to upload)

[GuyunLuke]

Summary

Submitting an unlisted Thunderbird add-on to addons.thunderbird.net triggers this release email after automatic review:

"Version 1.2.3 is now signed and ready for you to download."

But the downloaded file (thunderbird_translate_fork-1.2.3-tb.xpi) is byte-for-byte identical to the uploaded unsigned file (MD5 7a946ba2da63195d680f4fe055f114a7). It contains no META-INF signature directory (no manifest.mf, mozilla.sf, mozilla.rsa).

This matches every Thunderbird add-on I have installed from addons.thunderbird.net (filtaquilla, Mas, Close to Tray, original Thunderbird Translate): none of them contain META-INF. MDN distribution docs exclude Thunderbird/SeaMonkey add-ons from the Firefox signing requirement, and Thunderbird official builds disable signature enforcement via MOZ_REQUIRE_SIGNING.

So for Thunderbird add-ons, "signed" in the email appears to mean only "approved", with no file-level cryptographic signature applied.

Expected behavior

Either:

1. "signed" in the release email/version page should mean an actual file-level cryptographic signature (META-INF) for Thunderbird add-ons, or
2. the wording should be clarified or changed to "approved" (since Thunderbird add-ons are reviewed but not file-signed), and/or
3. the email should point to where the signed file (if one exists) can be downloaded.

The current wording is misleading for developers coming from the AMO/Firefox ecosystem, where "signed" is a tamper-proof signature over the XPI contents.

Originally filed at mozilla/addons#16396 and moved here per triage guidance.

[Sancus]

We don't sign add-ons nor does Thunderbird desktop verify signatures.

The message could use improvement but addons.thunderbird.net is kind of a best effort type thing so there are a lot of small issues like this.