Iceweasel for Fedora?

Mozilla's plan to require all extensions (also known as add-ons) to be signed by Mozilla before they can be installed in Firefox may lead Linux distributions down the same path that Debian has taken—a name change to avoid the Firefox trademark. The problem is that some distributions currently ship extensions that it will be difficult or impossible to get signed. The requirement can also be seen as a form of control over what users can install in their browser, which some see as running counter to the philosophical underpinnings of free software.

A Fedora Engineering Steering Committee (FESCo) bug report has called out the issue for Fedora. Kevin Kofler filed the bug, which calls for blocking any update to Firefox 44 (which will remove the about:config option for signature checking) in fairly strident terms (e.g. the bug is entitled "Software packaged in Fedora should not be allowed to implement DRM schemes that cannot be disabled"). He described the problem this way:

There is a mechanism provided by addons.mozilla.org (which is the site for Firefox extensions as well as for signing the packages) to automate the signing of existing extensions, but it would be quite cumbersome for Fedora to use. It would also leave users who want to install extensions they have built or have obtained in other ways out in the cold.

There are already two bug reports filed for Fedora packages (mozilla-adblockplus and mozilla-https-everywhere) that can't be installed in Firefox 43 without changing the value of xpinstall.signatures.required in about:config. When Firefox 44 comes along in late January, even that workaround won't suffice. But this requirement has been coming for some time; we covered the change back in February.

Others commented on the bug, mostly agreeing with Kofler's assessment. FESCo member Stephen Gallagher suggested that the committee communicate with Mozilla:

Kevin Fenzi, who is also a FESCo member, thought that it was important to include the Firefox package maintainer Martin Stransky into the discussion. As might be guessed, Stransky had a somewhat different view than many of the other commenters. He wondered about the value of Fedora packaging extensions. He also noted the Debian's rebranded Firefox (i.e. Iceweasel) is available in Fedora already, which might be an alternative for those who need it.

Several responded with reasons that Fedora wants or needs to package its own extensions, but there is more to it than that. For one thing, users may be willing to trust Fedora as a source for their extensions, but not Mozilla. There may also be distribution-specific changes that need to be made. As Gallagher put it:

Fundamentally it comes down to a question of software freedom, Gallagher concluded. In fact, Dominik "Rathann" Mierzejewski argued that updating Fedora to Firefox 43 without disabling the signature checking by default, as Stransky has done, is a violation of the update guidelines. He suggested updating the Firefox 43 package to disable signature checking and to "NOT update to FF44 in F22 and F23 until this is resolved".

The consensus in the bug is clearly to remove the signature checking by default one way or another. Gallagher suggested prompting users to decide if they want the checking, but even that requires changes to the Firefox code. And that will be the crux of the matter. Mozilla only allows using the Firefox trademark for modified versions of the browser if it approves of those changes. Concern about that trademark policy (and getting Mozilla's approval for every patch) is what led Debian to switch to Iceweasel. Kofler explicitly suggested that Fedora do the same.

Ultimately it will be up to Mozilla, as it can choose to allow distributions to remove the signature checking (or provide a way to disable it) or not. If it sticks to its guns and "forces" distributions to leave that part of the Firefox code alone, it may well push more Linux users into installing Iceweasel or the like, because that is what their distribution provides. At some point, FESCo will undoubtedly discuss the issue, but it is hard to see how the conflicts between the freedoms inherent in free software and a lockdown regime such as that being pushed by Mozilla (however well-intentioned) can coexist. Something has to give—if it isn't Mozilla, then replacing Firefox in Fedora with Iceweasel may not be far behind.