George Garside Blog

A place of many ramblings about macOS and development. If you find something useful on here, it's probably an accident.

Safari error message ‘Safari no longer supports the unsafe extension Tampermonkey’ with Tampermonkey showing in the background having been installed successfully

If you’ve just updated to macOS Mojave or the latest version of Safari Technology Preview, you might be greeted with the following message when you try to install an extension like you’ve always done in Safari. There doesn’t appear to be any way round the problem, with existing extensions removed and unable to be added again even if you download the package for the extension as worked in previous versions.

Safari no longer supports the unsafe extension
Safari no longer supports the unsafe extension.
You can find newer extensions reviewed by Apple in the App Store or Safari Extensions Gallery.

With Mojave now being released, some extension developers have released extensions through an Apple-approved process. Here’s links to some popular extensions which would have brought this message up, but now work fine if installed through the gallery!

ExtensionOfficial siteApple-approved download
uBlock Originhttps://github.com/el1t/uBlock-Safarihttps://safari-extensions.apple.com/details/?id=com.el1t.uBlock-3NU33NW2M3
Tampermonkeyhttps://tampermonkey.nethttps://safari-extensions.apple.com/details/?id=net.tampermonkey.safari-G3XV72R5TC

If the extension you’re looking to install isn’t available on the Safari Extensions Gallery or App Store, not all hope is lost. It requires manually installing the extension, so you won’t get automatic updates for it in the future, but it’s still perfectly usable and is the only way to get certain functionality until developers update their extensions for you (which some might not even do). This article presumes you’ve checked whether your extension exists in an Apple-approved form elsewhere, for example if you’ve installed uBlock Origin from uBlock0.safariextz you’ll get the message that the extension was removed, but it is available to download from the Safari Extensions Gallery (here’s a link to get uBlock Origin without going through this process). However, not all extensions are available there and it is soon to be discontinued anyway with App Extensions the only way forward. So begins how to install any extension blocked by Safari:

Download and unzip the extension

The first step is to download the .safariextz file. This will be from the developer’s website, how you usually installed the extension previously. In this tutorial, I will use Tampermonkey as the example as it is my preferred userscripts extension for Safari and is not available on the App Store or the Gallery. Rename the file’s extension from .safariextz to .zip, then extract the zip by double-clicking on the file. This gives you a .safariextension which is a folder containing the JavaScript and other files which make up the extension. You’re ready to add the extension to Safari!

Getting a .zip.cpgz instead?

If you’re not able to extract the extension, it may be because the underlying archive is an xar instead. You can confirm this with Terminal:

$ file betterttv.zip
betterttv.zip: xar archive version 1, SHA-1 checksum

To extract the file, rename the file extension to .xar and use The Unarchiver, or with Terminal:

xar -xf betterttv.xar

Add safariextension to Extension Builder

The Develop menu needs to be enabled to use the Extension Builder, which can be enabled from Safari → Preferences → Advanced → Show Develop menu in menu bar.

Once the Develop menu is enabled, open it and select Show Extension Builder. You’ll be presented with a window, and if you’ve never built an extension before it will be blank. Click the + button and choose Add Extension…. Select the .safariextension folder that you extracted and choose the Select button.

Run the extension in Safari

The extension folder you added will be shown in the builder, and some extension information should be shown too such as a logo and author details. Click the Run button in the top-right to run the extension. You will be prompted to authenticate the action, which you can do by entering your account password or with Touch ID. The extension will be installed and be available from the usual places, such as a menu bar button and Safari Preferences. Enjoy your unblocked extension!

Import previous settings into new extension

Settings for an extension you previously had installed won’t be seen by this extension you’ve run manually. If you don’t mind setting up the extension from scratch, or it had no options, there’s no need to worry about this step. Otherwise you can import these settings by copying them from the old extension to the new extension which has a different team ID. Open ~/Library/Preferences/com.apple.Safari.Extensions.plist with something like Xcode. Find the extension you just added, which should be at the bottom, and delete its dictionary using the minus sign. Go to the dictionary with the same extension name, click on the name and replace the team ID with 0000000000, 10 zeros. Save the file and reload the extension in Safari to see your settings imported.

Safari extensions settings plist to copy preferences from an older version of the extension

To expand some more on precisely what this does: when you install an extension built by someone else usually, that extension will be signed with a Safari Extensions certificate. The package that is created has this certificate inside it, and this contains a Team ID which is the ID of the developer or organisation which built and signed the extension. Your previous installation of the extension will have a Team ID because of this signing process, however the extension you have packed yourself and run manually will not since you did not use a certificate. Therefore, the Team ID for your unsigned certificate is ten zeros, so you’ll need to rename the old extension’s Team ID to be zeros for it to associate it with your new extension.

Next steps

Next time you relaunch Safari, the extension will still be in Extension Builder but won’t be ‘Run’. You can automatically run the extension with the following AppleScript. Add this script to ~/Library/Scripts/Applications/Safari (you may need to create the folders along this path, note the ~ reference to your home folder rather than the root Library folder).

tell application "System Events"
  tell process "Safari"
    set frontmost to true
    click menu item "Show Extension Builder" of menu "Develop" of menu bar 1
    delay 0.5
    click button "Run" of splitter group 1 of window "Extension Builder"
    click button 1 of window "Extension Builder"
  end tell
end tell

You can also prevent Safari from inexplicably throwing away your extension settings by locking the preferences file. Get Info (⌘I) on the com.apple.Safari.Extensions.plist preferences file, then check the box labelled Locked. This prevents changes to the file and will ensure Safari doesn’t throw away the preferences for the extension on quit.

Safari extensions preferences file locked in Finder Get Info

Leave a Reply

Your email address will not be published. Required fields are marked *

Author’s avatar

This haven’t worked for me as some mentioned. But the second I deleted the “locked” Extensions file in ~/Library/Safari/ and restarted Safari, it worked just fine.

Reply
Author’s avatar

everything seems fine, yet after pushing ‘run’ it shows ‘no safari extensions certificate’ – what to do now?

Reply
Author’s avatar

I’ve altered the AppleScript a bit to loop through multiple extensions.

I’ve also created an Automator app to launch Safari, and run the script.

Details for both of these here: https://github.com/zachdrago/Unsafe-Safari-Extensions/blob/master/README.md

Reply
Author’s avatar

Wonderful thanks a lot!

I got the .zip.cpgz also, simply using The Unarchiver on the .zip worked perfectly though. Thanks a lot!

Reply
Author’s avatar

Fantastic – this resurrected the extensions Mojave killed. Thank you!

Reply
Author’s avatar

When I open com.apple.Safari.Extensions.plist in XCode, it is empty — All I see is “Root”, containing 0 items. I need to be able to restore the scripts I’d written with the extension I am trying to restore. Does anyone know why “com.apple.Safari.Extensions.plist” is empty and/or what I can do to bypass this problem?

Reply
Author’s avatar

Where is the location of “com.apple.Safari.Extensions.plist”? I couldn’t find it on “~Users/name/Library/Preferences/”!!

Reply
Author’s avatar

thank you

Reply
Author’s avatar

@grgarside. Thanks for your instructional. Some feedback re macOS Mojave and uBlock Origin for Safari. UBO1.16.0 was released with functional issues and UBO1.15.4 is the better operational option of the two. I downloaded the latter Source Code (zip) file from the developers Github site and opened it with Apple Unarchiver app. and loaded it into Safari. I ‘re-imported’ my ‘exported’ settings into UBO and under the Safari ‘Develop’ drop-down menu checked ‘Allow Unsigned Extensions’ and everything’s working fine (for now).

Note… 1. ~/Library/Preferences/com.apple.Safari.Extensions.plist and the

com.apple.Safari.Extensions.plist preferences file do not exist in Mojave.

2. I cut and pasted your user script into Apple Script Editor app and hit Run but it came back with this result… (Error: “System Events got an error: Can’t get button \”Run\” of splitter group 1 of window \”Extension Builder\” of process \”Safari\”.” number -1728 from button “Run” of splitter group 1 of window “Extension Builder” of process “Safari”).

3. Worthy of note is that Safari ‘Cross-Site Tracking Protection’ function over-rides the UBO ‘strict’ 3P blocking function and allows 3P’s access and this is evidenced by going to Preferences=>Privacy=>Manage Website Data… where a list of allowed 3P’s are populated even tho set to be blocked by UBO. These aspects of UBO’s compromised functionality are not to be trusted or relied upon in the new Safari operating environment.

4. As a result I have chosen to use Firefox as my default browser with UBO and uMatrix enabled and consistently updated and it works great with peace of mind and without the security and privacy compromises that Safari has now built into its OS. My use of Safari is now less than 5% of my online activity and i clear the History and delete the Cache files on closing.

5. This is a gravely serious issue and once the Safari community and UBO users at large realise just how dire the compromise is, I am sure many will vote with their feet but sadly, just as many will choose to bury there heads in the proverbial Mojave sands and chose to be a part of the compromise, in spite of knowing better. Adguard has also taken a huge hit and I am sure it is all part of much larger orchestrated plan of the global corporate clan who seek protection of valuable streams of advertising and data revenue.

Thanks for your contribution…. Kind Regards… Jim

Reply
Author’s avatar

Great job you saved my journey!

Reply
Author’s avatar

Man, beer for you

Reply
Author’s avatar

thank you

Reply
Author’s avatar

Could you update the script to automatically run several extensions, not only one? I have no idea how to do that. Thank you!

Reply
Author’s avatar

This is what I’m using to loop through multiple extensions. You will have to type in your system password for each one, though.


tell application "Safari" to activate

tell application "System Events"

tell process "Safari"

set frontmost to true

click menu item "Show Extension Builder" of menu "Develop" of menu bar 1

set frontmost to true

delay 0.5
    set myCount to count row of table 1 of scroll area 1 of splitter group 1 of window "Extension Builder"

    repeat 6 times
        key code 125
    end repeat

    repeat with counter from 1 to myCount
        click row counter of table 1 of scroll area 1 of splitter group 1 of window "Extension Builder"
        click button "Run" of splitter group 1 of window "Extension Builder"
        delay 0.5
        key code 126
    end repeat

    click button 1 of window "Extension Builder"
end tell

end tell
Reply
Author’s avatar

This doesn’t work with extensions that use local storage. For example the Sessions extension. The database contents at ~/Library/Safari/Databases/safari-extension_yoo.david.sessions-0000000000_0 are deleted when Safari quits, defeating the purpose of the extension. Is there a way to turn off this behaviour of the extension builder?

Reply
Author’s avatar

Hi, Aaron, you can lock ~/Library/Safari/Databases/safari-extension_yoo.david.sessions-0000000000_0 folder this way Session settings are not removed after re-run.

Reply
Author’s avatar

Does this mean you managed to get the sessions.safariextension?

I always end up with a .zip.cpgz that turns to a textedit document (no suffix) after unarchiving the .var renamend file. Any tipps?

Reply
Author’s avatar

This doesn’t work for me. When I rename the extensions as a .zip and try unzipping them, they turn into .cpgz files which if “unzipped” turn back into a .zip, ad infinitum. How can I avoid this?

Reply
Author’s avatar

Thanks for all your work, George. The problem with your AppleScript is that it doesn’t include a line after the Run command which would allow us to authenticate with our user password.

Could you possibly modify the script to include the authentication process?

Reply
Author’s avatar

How do you ‘tell’ OSX to run the above AppleScript every time Safari is launched? I tried saving the script with a file name ‘com.apple.SafariOktaExtension’ and restarted Safari but it did not ‘Run’ the extension builder.

Reply
Author’s avatar

Thanks for this. The apple script works* if I open and run it. Is there something else I can do to make it run automatically whenever Safari opens?

*Every time it runs I have to put in my system password

Reply
Author’s avatar

Any better solutions guys? Regarding keeping the extensions when closing and restarting Safari.

Any body found a permanent fix?

Reply
Author’s avatar

If there will be no other solution , people might stop using safari :/

Reply
Author’s avatar

How to setup apple script to work automatically after Safari is open, I already put in to folder you said, also how to make it run for multiple extensions

Thx

Reply
Author’s avatar

Archive Utility won’t open the zip file. It creates a duplicate file.

Reply
Author’s avatar

any solution ?

Reply
Author’s avatar

Grayside, you have done great work with this tweak. However, I found that in Mojave, the settings for all the extensions are not stored in the com.apple.Safari.Extensions.plist. Since it was not originally there when I installed Apple signed extensions and also when I installed third party extension. But I created it anyway by modifying an old one from High Sierra. It does not seem to have any effect, I have changed all the team ID to be 0s. Could you double check if all the settings for extensions are indeed stored in the same plist in Mojave?

Thanks

Reply
Author’s avatar

I can’t find ~/Library/Preferences/com.apple.Safari.Extensions.plist

that does not exist…

Reply
Author’s avatar

this method does not work for AdBlock

Reply
Author’s avatar

Would it be possible to change the last screenshot into another little animation like the 1st one? I’m trying to support users (of varying technical capabilities) while not, myself, having a Mac. I think you’re implying that there would have been another ExtensionSettings-net.tampermoney.safari-${GIBBERISH}, which was automatically created by the new installation of the unpacked extension; which the user is supposed to delete, then rename the old one with GIBBERISH=’0000000000′. But seeing it all in animation would be far clearer.

Also slightly concerned about the idea that the one at the bottom will be the newest — is that a constant inherent property of the Xcode plist browser (and/or any other plist browser someone might use based on your ‘something like Xcode’)? It seems to me the user might in fact be presented with two …-${GIBBERISH} dictionaries without such an obvious way of choosing between. I see that in your static near-the-end-of-the-operation image, the one that’s being renamed to ‘0000000000’ has 205 items; might a better heuristic be ‘keep the one with the higher number of items’? The animation could start by circling ‘%d items’ in each, pointing out which is larger, destroying the smaller one, finally renaming the larger.

Reply
Author’s avatar

How can I do to make the extension was not uninstalled after browser restart?Now I have to go back to extension builder and click Run after browser restart.

Reply
Author’s avatar

Does this trick persist across browser restarts? I followed these instructions. Tampermonkey ran the first time, but after I quit Safari Technology Preview and started it up again, the extension was uninstalled. I had to go back to extension builder and click Run, but all my scripts were deleted. Am I missing a step?

Reply