How does a packager determine what the gecko id should be?

It is in the manifest.json file in the field id. If the field id does not exist, as reported in this PR content, the extension cannot work.

So this will be in that file, and that file will exist, in every extension?

yes. Manifest file is mandatory for each extension.

Ok, thank you!

One significant problem I see with this is that it's just not OK to just take the .xpi file from upstream and copy it over and be done, just as it's not acceptable to copy an upstream compiled binary into _bindir. We don't know what's in there; it could have minimized javascript sources or the output of something that compilers to javascript. In fact, I'd argue that even if there wasn't anything but a single javascript file in there, we still shouldn't be shipping the upstream .xpi file.

One of the best-packaged extensions is mozilla-ublock-origin. That spec is way more complicated: it lists out all of the bundled javascript libraries, it invokes the upstream source build script and it recreates all of the .wasm files. I expect that most extensions would be simpler but that the common case is that there is still something bundled or something that needs building.

If you are concerned about security, I think that the best option should be still to get the .xpi file directly from Mozilla store, because the AMO team actually performs security checks.

uBlock Origin can be packaged in that manner because it is a particular case (give a look to the source repository) and usually, the most of extensions don't have that structure. I think the most generic way is the one described in the proposed PR.

Guidelines already require that code be rebuilt from source. Even if there isn't anything to be rebuilt, I would expect that the .xpi at least be unpacked and repacked (as in the missing ID example) so that the contents can be verified.

This .xpi file should be built from source like any other artifact. See for example mozilla-noscript or mozilla-privacy-badger.

Yes. I need to change the source and point to their git source repository.