George Garside Blog

A place of many ramblings about macOS and development. If you find something useful on here, it's probably an accident.

The error message ‘Safari no longer supports the unsafe extension’ in macOS Catalina or Mojave with the latest version of Safari might appear. This can happen either on attempting to install an extension or immediately after updating macOS when an unsafe extension was previously installed in Safari.

There doesn't appear to be any way round the problem, with existing extensions removed and unable to be added again even if you download the package for the extension as worked in previous versions.

Safari no longer supports the unsafe extension
Safari no longer supports the unsafe extension.
You can find newer extensions reviewed by Apple in the App Store or Safari Extensions Gallery.
Some of your extensions are no longer supported in Safari
Some of your extensions are no longer supported in Safari
Tampermonkey can no longer be used. You can find new and updated extensions in the App Store or from developers’ websites.

With Mojave now being released, some extension developers have released extensions through an Apple-approved process. Here's links to some popular extensions which would have brought this message up, but now work fine if installed through the gallery!

ExtensionOfficial siteApple-approved download
uBlock Originhttps://github.com/el1t/uBlock-Safarihttps://safari-extensions.apple.com/details/?id=com.el1t.uBlock-3NU33NW2M3
Tampermonkeyhttps://tampermonkey.nethttps://safari-extensions.apple.com/details/?id=net.tampermonkey.safari-G3XV72R5TC

If the extension you're looking to install isn't available on the Safari Extensions Gallery or App Store, not all hope is lost. It requires manually installing the extension, so you won't get automatic updates for it in the future, but it's still perfectly usable and is the only way to get certain functionality until developers update their extensions for you (which some might not even do). This article presumes you've checked whether your extension exists in an Apple-approved form elsewhere, for example if you've installed uBlock Origin from uBlock0.safariextz you'll get the message that the extension was removed, but it is available to download from the Safari Extensions Gallery (here's a link to get uBlock Origin without going through this process). However, not all extensions are available there and it is soon to be discontinued anyway with App Extensions the only way forward. So begins how to install any extension blocked by Safari:

Download and unzip the extension

The first step is to download the .safariextz file. This will be from the developer's website, how you usually installed the extension previously. In this tutorial, I will use Tampermonkey as the example as it is my preferred userscripts extension for Safari and is not available on the App Store or the Gallery. Rename the file's extension from .safariextz to .zip, then extract the zip by double-clicking on the file. This gives you a .safariextension which is a folder containing the JavaScript and other files which make up the extension. You're ready to add the extension to Safari!

Getting a .zip.cpgz instead?

If you're not able to extract the extension, it may be because the underlying archive is an xar instead. You can confirm this with Terminal:

$ file betterttv.zip
betterttv.zip: xar archive version 1, SHA-1 checksum

To extract the file, rename the file extension to .xar and use The Unarchiver, or with Terminal:

xar -xf betterttv.xarCode language: CSS (css)

Add safariextension to Extension Builder

The Develop menu needs to be enabled to use the Extension Builder, which can be enabled from Safari → Preferences → Advanced → Show Develop menu in menu bar.

Once the Develop menu is enabled, open it and select Show Extension Builder. You'll be presented with a window, and if you've never built an extension before it will be blank. Click the + button and choose Add Extension…. Select the .safariextension folder that you extracted and choose the Select button.

Run the extension in Safari

The extension folder you added will be shown in the builder, and some extension information should be shown too such as a logo and author details. Click the Run button in the top-right to run the extension. You will be prompted to authenticate the action, which you can do by entering your account password or with Touch ID. The extension will be installed and be available from the usual places, such as a menu bar button and Safari Preferences. Enjoy your unblocked extension!

Import previous settings into new extension

Settings for an extension you previously had installed won't be seen by this extension you've run manually. If you don't mind setting up the extension from scratch, or it had no options, there's no need to worry about this step. Otherwise you can import these settings by copying them from the old extension to the new extension which has a different team ID. Open ~/Library/Preferences/com.apple.Safari.Extensions.plist with something like Xcode. Find the extension you just added, which should be at the bottom, and delete its dictionary using the minus sign. Go to the dictionary with the same extension name, click on the name and replace the team ID with 0000000000, 10 zeros. Save the file and reload the extension in Safari to see your settings imported.

Safari extensions settings plist to copy preferences from an older version of the extension

To expand some more on precisely what this does: when you install an extension built by someone else usually, that extension will be signed with a Safari Extensions certificate. The package that is created has this certificate inside it, and this contains a Team ID which is the ID of the developer or organisation which built and signed the extension. Your previous installation of the extension will have a Team ID because of this signing process, however the extension you have packed yourself and run manually will not since you did not use a certificate. Therefore, the Team ID for your unsigned certificate is ten zeros, so you'll need to rename the old extension's Team ID to be zeros for it to associate it with your new extension.

Next steps

Next time you relaunch Safari, the extension will still be in Extension Builder but won't be ‘Run’. You can automatically run the extension with the following AppleScript. Add this script to ~/Library/Application Scripts/com.apple.Safari (you may need to create the folders along this path, note the ~ reference to your home folder rather than the root Library folder).

tell application "System Events"
	tell process "Safari"
		set frontmost to true
    	click menu item "Show Extension Builder" of menu "Develop" of menu bar 1
    	delay 0.5
    	click button "Run" of splitter group 1 of window "Extension Builder"
    	click button 1 of window "Extension Builder"
	end tell
end tellCode language: AppleScript (applescript)

Enable the Application Scripts menu in Script Editor → Preferences → General under ‘Show Script menu in menu bar’, then when launching Safari you can open the Script menu and choose the script you added under Safari Scripts. The script will pause when you're prompted for authentication, at which point you can Touch ID or enter your password.

You can also prevent Safari from inexplicably throwing away your extension settings by locking the preferences file. Get Info (⌘I) on the com.apple.Safari.Extensions.plist preferences file, then check the box labelled Locked. This prevents changes to the file and will ensure Safari doesn't throw away the preferences for the extension on quit.

Safari extensions preferences file locked in Finder Get Info

Leave a Reply

5

Could you update the script to automatically run several extensions, not only one? I have no idea how to do that. Thank you!

Reply
1

This is what I'm using to loop through multiple extensions. You will have to type in your system password for each one, though.


tell application "Safari" to activate

tell application "System Events"

tell process "Safari"

set frontmost to true

click menu item "Show Extension Builder" of menu "Develop" of menu bar 1

set frontmost to true

delay 0.5
    set myCount to count row of table 1 of scroll area 1 of splitter group 1 of window "Extension Builder"

    repeat 6 times
        key code 125
    end repeat

    repeat with counter from 1 to myCount
        click row counter of table 1 of scroll area 1 of splitter group 1 of window "Extension Builder"
        click button "Run" of splitter group 1 of window "Extension Builder"
        delay 0.5
        key code 126
    end repeat

    click button 1 of window "Extension Builder"
end tell

end tell
Reply
3

How to setup apple script to work automatically after Safari is open, I already put in to folder you said, also how to make it run for multiple extensions

Thx

Reply
0

Archive Utility won't open the zip file. It creates a duplicate file.

Reply
0

any solution ?

Reply
0

Use an app like Lingon to fire the script whenever ~/Library/Safari/History.db-shm is modified; it seems to only change on Safari launching, so that will trigger the script being run (though you might want to put a delay on the script to make sure it does all the other stuff on launching, especially if you have Safari launching as a login item, so the delay means it runs when everything else has happened, so you can be sure the script works.

Reply
2

Hello, George,

Looks like Safari 13.0.3 has made this impossible. There's no Extension Builder any more.

Is it possible just to put the .safariextz file to some system folder in order to make it work?

Reply
2

Did you try to use this with 1password extension on Mojave?

I'm trying to install but I can't and the safari extension script what you mentioned doesn't exist on the library preference folder. Could you help me? because I don't know how to move forward.

Thanks!

Reply
1

Hello, does this still work in Safari 13 on High Sierra? I don’t have the “Show Extension Builder” in the Develop menu any longer after updating from Safari 12.

Reply
1

I’ve downgraded to Safari 12 but some extensions are still missing and the “Show Extension Builder” is likewise missing from the Develop drop-down menu. Any advice on hot to get it back?

Reply
0

You've downgraded to safari 12? how?

Reply
0

just reinstall macos, for example with mbp2013 sierra i get safari 10 instead of 12.

Reply
0

I too don't haev the 'Show Extensions Builder" option in my Develop menu (MacOS High Sierra, Safari 13.0.2) 🙁

Reply
1

You are a SuperStar!!! You have answered a question that I had been unable to resolve anywhere else, including multiple Apple focused sites. Thank you.

I had avoided upgrading to Mojave, because I did not wish to use Safari 12, but updating High Sierra has just installed Safari 12. I have been using a great extension 'Sessions' which is brilliant for keeping a record of all tabs/windows in a clear view. I have searched for alternatives, but none come close to its excellence - Vivaldi has something similar, but it is nowhere near as useful.

I have just followed your steps (used Unarchiver to unzip) and Sessions is installed and working, its like meeting an old friend, even though it is only a day or so since we saw each other!

Reply
1

Hey 🙂

Thanks for your great article!

Sadly I cannot get any Apple Script to Autostart with Safari's startup.

I tried chmod +x on the .scpt file in "~/Library/Scripts/Applications/Safari".

Furthermore I enabled Assistive Access in Privacy & Security for Safari (and Apple Script Editor).

When run from the Script Editor it works just fine. Just does not run when I start Safari.

Is there anything else I can try?

Thank you! 🙂

PS: I'm running High Sierra 10.13.6.

Reply
1

Great job you saved my journey!

Reply
1

Thanks for this. The apple script works* if I open and run it. Is there something else I can do to make it run automatically whenever Safari opens?

*Every time it runs I have to put in my system password

Reply
1

I have the same problem... Can you help us running the script automatically when safari starts?

Reply
1

Still looking for a solution too 🙁

Reply
0

I can't get this to work with Open search extension. When i press 'run' nothing happens, no promt, nothing installed. I am running safari 12.1.2 on os Sierra.

Reply
0

Anyone have package .safariextz of Lastpass, Translate? Plz

Reply
0

I'm not able to download tamper monkey. It is not available apparently. My updated iOS removed it so I don't have it on my computer. 🙁 Any suggestions?

Reply
0

Awesome, thank you for this. It brought a very important extension that I like to use.

Reply
0

Macintosh Mojave Dark Mode MacOS 10.14.3

Safari.app 12.0.3

I have stylish.safariextension I did follow your direct it work then quit Safari.app then open Safari cause Stylish force to be delete itself make me frustrate.

Reply
0

Hello,

I'm trying to use/convert mailto.safariextz to make clicking on the "Mail this webpage" icon in the Safari Toolbar to pull up a Gmail window and not the Mail app.

I'm using Mojave 10.14.2 and Safari 12.0.2

I cannot get to the point of creating a ". . . .safariextension folder . . . ".

While I can rename mailto.safariextz to mailto.zip, doing so creates mailto.zip.cpgz .

I tried using Terminal with this command:

$ file mailto.zip
mailto.zip: xar archive version 1, SHA-1 checksum

and an error: -bash: $: command not found.

You advise, "To extract the file, rename the file extension to .xar and use The Unarchiver . . . ," yields a "TextEdit.app Document" called "mailto".

The contents of "mailto" are:

60401./mailto.zipxar!8xx⁄‘VYè‚H~G‚?îz—4æ∞aT›£Ùmc|oæÅç

and continues from there with similar characters, symbols, etc.

I have enabled Developer in Safari but I cannot add an extension that Extension Builder is looking for; all the possibles are greyed-out when trying to select.

Please advise how to install the gmail mailto extension.

Thank you.

Reply
0

I am completely lost regarding these steps. I "upgraded" to a newer Mac which lost me the ability to run Xactimate.com in Safari through the Silverlight plug-in. This has disabled me from getting work done in the field forcing me to return to the office to use Internet Explorer. Can someone PLEEEASE help me get this back?!?!

Reply
0

I was trying to install the mailto extension for gmail. It installs and I can select the email service I want to use and it says save. If I go into extensions, it is there. But each time I rebooted safari per the instructions it would disappear from the extensions folder in ~/Libary/Safari/. I tried locking the plist file but the extension would delete as soon as I rebooted safari. Locking both the plist and the mailto extension seemed to do the trick, at first, as the file doesn't delete when I reboot. But it won't work after the safari reboot and I have to re-run the installation each time I open Safari. I'm out of ideas.

Reply
0

This haven't worked for me as some mentioned. But the second I deleted the "locked" Extensions file in ~/Library/Safari/ and restarted Safari, it worked just fine.

Reply
0

everything seems fine, yet after pushing 'run' it shows 'no safari extensions certificate' - what to do now?

Reply
0

I've altered the AppleScript a bit to loop through multiple extensions.

I've also created an Automator app to launch Safari, and run the script.

Details for both of these here: https://github.com/zachdrago/Unsafe-Safari-Extensions/blob/master/README.md

Reply
0

Wonderful thanks a lot!

I got the .zip.cpgz also, simply using The Unarchiver on the .zip worked perfectly though. Thanks a lot!

Reply
0

Fantastic - this resurrected the extensions Mojave killed. Thank you!

Reply
0

When I open com.apple.Safari.Extensions.plist in XCode, it is empty -- All I see is "Root", containing 0 items. I need to be able to restore the scripts I'd written with the extension I am trying to restore. Does anyone know why "com.apple.Safari.Extensions.plist" is empty and/or what I can do to bypass this problem?

Reply
0

Where is the location of "com.apple.Safari.Extensions.plist"? I couldn't find it on "~Users/name/Library/Preferences/"!!

Reply
0

The com.apple.Safari.Extensions.plist file has been moved with Mojave to ~\⁨Library⁩\Containers⁩\com.apple.Safari⁩\⁨Data⁩\Library⁩\Preferences\

Reply
0

Thanks!

Reply
0

thank you

Reply
0

@grgarside. Thanks for your instructional. Some feedback re macOS Mojave and uBlock Origin for Safari. UBO1.16.0 was released with functional issues and UBO1.15.4 is the better operational option of the two. I downloaded the latter Source Code (zip) file from the developers Github site and opened it with Apple Unarchiver app. and loaded it into Safari. I 're-imported' my 'exported' settings into UBO and under the Safari 'Develop' drop-down menu checked 'Allow Unsigned Extensions' and everything's working fine (for now).

Note... 1. ~/Library/Preferences/com.apple.Safari.Extensions.plist and the

com.apple.Safari.Extensions.plist preferences file do not exist in Mojave.

2. I cut and pasted your user script into Apple Script Editor app and hit Run but it came back with this result... (Error: "System Events got an error: Can’t get button \"Run\" of splitter group 1 of window \"Extension Builder\" of process \"Safari\"." number -1728 from button "Run" of splitter group 1 of window "Extension Builder" of process "Safari").

3. Worthy of note is that Safari 'Cross-Site Tracking Protection' function over-rides the UBO 'strict' 3P blocking function and allows 3P's access and this is evidenced by going to Preferences=>Privacy=>Manage Website Data... where a list of allowed 3P's are populated even tho set to be blocked by UBO. These aspects of UBO's compromised functionality are not to be trusted or relied upon in the new Safari operating environment.

4. As a result I have chosen to use Firefox as my default browser with UBO and uMatrix enabled and consistently updated and it works great with peace of mind and without the security and privacy compromises that Safari has now built into its OS. My use of Safari is now less than 5% of my online activity and i clear the History and delete the Cache files on closing.

5. This is a gravely serious issue and once the Safari community and UBO users at large realise just how dire the compromise is, I am sure many will vote with their feet but sadly, just as many will choose to bury there heads in the proverbial Mojave sands and chose to be a part of the compromise, in spite of knowing better. Adguard has also taken a huge hit and I am sure it is all part of much larger orchestrated plan of the global corporate clan who seek protection of valuable streams of advertising and data revenue.

Thanks for your contribution.... Kind Regards... Jim

Reply
0

Man, beer for you

Reply
0

thank you

Reply
0

How can I do to make the extension was not uninstalled after browser restart?Now I have to go back to extension builder and click Run after browser restart.

Reply
0

Would it be possible to change the last screenshot into another little animation like the 1st one? I'm trying to support users (of varying technical capabilities) while not, myself, having a Mac. I think you're implying that there would have been another ExtensionSettings-net.tampermoney.safari-${GIBBERISH}, which was automatically created by the new installation of the unpacked extension; which the user is supposed to delete, then rename the old one with GIBBERISH='0000000000'. But seeing it all in animation would be far clearer.

Also slightly concerned about the idea that the one at the bottom will be the newest -- is that a constant inherent property of the Xcode plist browser (and/or any other plist browser someone might use based on your 'something like Xcode')? It seems to me the user might in fact be presented with two ...-${GIBBERISH} dictionaries without such an obvious way of choosing between. I see that in your static near-the-end-of-the-operation image, the one that's being renamed to '0000000000' has 205 items; might a better heuristic be 'keep the one with the higher number of items'? The animation could start by circling '%d items' in each, pointing out which is larger, destroying the smaller one, finally renaming the larger.

Reply
0

this method does not work for AdBlock

Reply
0

Does this trick persist across browser restarts? I followed these instructions. Tampermonkey ran the first time, but after I quit Safari Technology Preview and started it up again, the extension was uninstalled. I had to go back to extension builder and click Run, but all my scripts were deleted. Am I missing a step?

Reply
0

I can't find ~/Library/Preferences/com.apple.Safari.Extensions.plist

that does not exist...

Reply
0

Grayside, you have done great work with this tweak. However, I found that in Mojave, the settings for all the extensions are not stored in the com.apple.Safari.Extensions.plist. Since it was not originally there when I installed Apple signed extensions and also when I installed third party extension. But I created it anyway by modifying an old one from High Sierra. It does not seem to have any effect, I have changed all the team ID to be 0s. Could you double check if all the settings for extensions are indeed stored in the same plist in Mojave?

Thanks

Reply
0

Any better solutions guys? Regarding keeping the extensions when closing and restarting Safari.

Any body found a permanent fix?

Reply
0

If there will be no other solution , people might stop using safari :/

Reply
0

This doesn't work with extensions that use local storage. For example the Sessions extension. The database contents at ~/Library/Safari/Databases/safari-extension_yoo.david.sessions-0000000000_0 are deleted when Safari quits, defeating the purpose of the extension. Is there a way to turn off this behaviour of the extension builder?

Reply
0

Hi, Aaron, you can lock ~/Library/Safari/Databases/safari-extension_yoo.david.sessions-0000000000_0 folder this way Session settings are not removed after re-run.

Reply
0

Does this mean you managed to get the sessions.safariextension?

I always end up with a .zip.cpgz that turns to a textedit document (no suffix) after unarchiving the .var renamend file. Any tipps?

Reply
0

Yes i am using it in mojave

Reply
0

I'm using El Capitan (Safari 11) and there isn't folder "~/Library/Safari/Databases/safari-extension_yoo.david.sessions-0000000000_0". Instead of this when I install a extension the message "Without a Safari Extensions Certificate, this extension will only be available until you quit Safari." appears...

Reply
0

This doesn't work for me. When I rename the extensions as a .zip and try unzipping them, they turn into .cpgz files which if "unzipped" turn back into a .zip, ad infinitum. How can I avoid this?

Reply
0

Hi, before you unzip the .zip file or the .xar file, open Unarchiver, click on the Extraction tab, and, under "Create a new folder for the extracted files:" check "Always".

This will create a folder, and inside the folder there'll be another folder with the extension .safariextension, which you'll use on the Extension Builder.

Reply
0

Thanks for all your work, George. The problem with your AppleScript is that it doesn't include a line after the Run command which would allow us to authenticate with our user password.

Could you possibly modify the script to include the authentication process?

Reply
0

How do you 'tell' OSX to run the above AppleScript every time Safari is launched? I tried saving the script with a file name 'com.apple.SafariOktaExtension' and restarted Safari but it did not 'Run' the extension builder.

Reply