Install the extension from the update server during setup
Both installers ended by telling you to load the folder unpacked, which is the one install that can never update itself. They now offer the policy install as a last step instead, and only fall back to those instructions when it is declined or fails. Windows writes to the user's own policy hive rather than HKLM, so the step needs no elevation and no separate admin shell; -Scope Machine is still there for every-account installs. Linux gets the counterpart script — a managed policy file under /etc, which is root-only because Chrome reads policy from nowhere else on that platform. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
co-authored by
Claude Opus 5
Claude Opus 5
parent
035f93d220
commit
b9da419ebc
@@ -3,29 +3,38 @@
|
||||
Install the AutoFirmer extension from our own update server, via policy.
|
||||
|
||||
.DESCRIPTION
|
||||
Chrome will not side-load an extension on Windows, and it will not update an
|
||||
unpacked one. The supported way to run an extension you host yourself is an
|
||||
enterprise policy: ExtensionInstallForcelist names the extension id and the
|
||||
update manifest, and from then on Chrome installs it, keeps it updated on its
|
||||
own schedule, and re-installs it if it goes missing.
|
||||
Chrome will not side-load an extension on Windows — dropping a CRX on
|
||||
chrome://extensions is refused — and it will not update an unpacked one. The
|
||||
supported way to run an extension you host yourself is a policy:
|
||||
ExtensionInstallForcelist names the extension id and the update manifest, and
|
||||
from then on Chrome installs it, keeps it updated on its own schedule, and
|
||||
re-installs it if it goes missing.
|
||||
|
||||
Needs an elevated PowerShell — the policy lives under HKLM.
|
||||
Defaults to the current user's policy hive, which needs no elevation.
|
||||
-Scope Machine writes to HKLM instead, for every account on the box; that
|
||||
one does need an elevated shell. Where both exist, HKLM wins.
|
||||
|
||||
After this runs:
|
||||
* Remove the unpacked copy from chrome://extensions. It has the same id
|
||||
now, and Chrome will not load both.
|
||||
* Restart Chrome, or open chrome://policy and press "Reload policies".
|
||||
* A force-installed extension cannot be disabled or removed from the
|
||||
extensions page. Re-run this with -Remove to take it off.
|
||||
extensions page. Re-run with -Remove to take it off.
|
||||
|
||||
.EXAMPLE
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
|
||||
|
||||
.EXAMPLE
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Scope Machine -Browser Edge
|
||||
#>
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
[ValidateSet('Chrome', 'Edge', 'Brave')]
|
||||
[string]$Browser = 'Chrome',
|
||||
|
||||
[ValidateSet('User', 'Machine')]
|
||||
[string]$Scope = 'User',
|
||||
|
||||
# Derived from the signing key on the droplet. It only changes if the key does.
|
||||
[string]$Id = 'lkjbblagjjbldlkeaaffhiopdlhniaan',
|
||||
|
||||
@@ -36,23 +45,27 @@ param(
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
$roots = @{
|
||||
Chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
|
||||
Edge = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
|
||||
Brave = 'HKLM:\SOFTWARE\Policies\BraveSoftware\Brave'
|
||||
$vendors = @{
|
||||
Chrome = 'Google\Chrome'
|
||||
Edge = 'Microsoft\Edge'
|
||||
Brave = 'BraveSoftware\Brave'
|
||||
}
|
||||
|
||||
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
|
||||
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||
throw 'Run this from an elevated PowerShell — the policy key is under HKLM.'
|
||||
$hive = if ($Scope -eq 'Machine') { 'HKLM:' } else { 'HKCU:' }
|
||||
|
||||
if ($Scope -eq 'Machine') {
|
||||
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
|
||||
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||
throw 'Run this from an elevated PowerShell for -Scope Machine, or drop the flag to install it for this user only.'
|
||||
}
|
||||
}
|
||||
|
||||
$key = Join-Path $roots[$Browser] 'ExtensionInstallForcelist'
|
||||
$key = "$hive\SOFTWARE\Policies\$($vendors[$Browser])\ExtensionInstallForcelist"
|
||||
$entry = "$Id;$UpdateUrl"
|
||||
|
||||
if ($Remove) {
|
||||
if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no forcelist for $Browser."; exit 0 }
|
||||
if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no $Scope forcelist for $Browser."; exit 0 }
|
||||
$props = Get-ItemProperty $key
|
||||
$found = $false
|
||||
foreach ($name in ($props.PSObject.Properties.Name | Where-Object { $_ -notlike 'PS*' })) {
|
||||
@@ -62,7 +75,7 @@ if ($Remove) {
|
||||
$found = $true
|
||||
}
|
||||
}
|
||||
if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser forcelist." }
|
||||
if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser $Scope forcelist." }
|
||||
Write-Host "`nRestart $Browser to let the change take effect."
|
||||
exit 0
|
||||
}
|
||||
@@ -78,15 +91,16 @@ $existing = $props.PSObject.Properties |
|
||||
|
||||
if ($existing) {
|
||||
Set-ItemProperty -Path $key -Name $existing.Name -Value $entry
|
||||
Write-Host "Updated $Browser forcelist entry $($existing.Name):"
|
||||
Write-Host "Updated the $Browser $Scope forcelist entry $($existing.Name):"
|
||||
} else {
|
||||
$used = $props.PSObject.Properties.Name |
|
||||
Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ }
|
||||
$slot = if ($used) { (($used | Measure-Object -Maximum).Maximum + 1) } else { 1 }
|
||||
New-ItemProperty -Path $key -Name "$slot" -Value $entry -PropertyType String -Force | Out-Null
|
||||
Write-Host "Added $Browser forcelist entry ${slot}:"
|
||||
Write-Host "Added $Browser $Scope forcelist entry ${slot}:"
|
||||
}
|
||||
|
||||
Write-Host " $key"
|
||||
Write-Host " $entry"
|
||||
Write-Host @"
|
||||
|
||||
|
||||
Executable
+82
@@ -0,0 +1,82 @@
|
||||
#!/usr/bin/env bash
|
||||
# Install the AutoFirmer extension from our own update server, via policy.
|
||||
#
|
||||
# The Linux counterpart to install-extension-policy.ps1. Chrome reads managed
|
||||
# policy from JSON files under /etc, so unlike Windows there is no per-user
|
||||
# option here — it needs root, and it applies to everyone on the machine.
|
||||
#
|
||||
# sudo scripts/install-extension-policy.sh # install
|
||||
# sudo scripts/install-extension-policy.sh --remove # take it back off
|
||||
set -euo pipefail
|
||||
|
||||
ID="${EXTENSION_ID:-lkjbblagjjbldlkeaaffhiopdlhniaan}"
|
||||
UPDATE_URL="${EXTENSION_UPDATE_URL:-https://ext.juicerroom.com/updates.xml}"
|
||||
FILE=autofirmer.json
|
||||
|
||||
REMOVE=0
|
||||
[ "${1:-}" = "--remove" ] && REMOVE=1
|
||||
|
||||
info() { printf ' %s\n' "$1"; }
|
||||
fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }
|
||||
|
||||
[ "$(id -u)" -eq 0 ] || fail "run this with sudo — Chrome only reads policy from /etc"
|
||||
|
||||
# Every Chromium-family browser reads the same policy format from its own
|
||||
# directory. Only the ones actually installed are touched: creating the
|
||||
# directory for a browser that is not there would do nothing but confuse
|
||||
# whoever finds it later.
|
||||
CANDIDATES="
|
||||
/etc/opt/chrome/policies/managed
|
||||
/etc/chromium/policies/managed
|
||||
/etc/chromium-browser/policies/managed
|
||||
/etc/opt/edge/policies/managed
|
||||
/etc/brave/policies/managed
|
||||
"
|
||||
|
||||
touched=0
|
||||
for dir in $CANDIDATES; do
|
||||
parent=$(dirname "$(dirname "$dir")") # e.g. /etc/opt/chrome
|
||||
[ -d "$parent" ] || [ -d "$dir" ] || continue
|
||||
|
||||
if [ "$REMOVE" -eq 1 ]; then
|
||||
if [ -f "$dir/$FILE" ]; then
|
||||
rm -f "$dir/$FILE"
|
||||
info "removed $dir/$FILE"
|
||||
touched=$((touched + 1))
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
|
||||
mkdir -p "$dir"
|
||||
# Its own file rather than an edit of someone else's: Chrome merges every
|
||||
# JSON in this directory, so a separate file cannot corrupt a policy set by
|
||||
# something else. Two files setting ExtensionInstallForcelist would collide,
|
||||
# which is worth knowing if this machine is centrally managed.
|
||||
cat > "$dir/$FILE" <<JSON
|
||||
{
|
||||
"ExtensionInstallForcelist": ["$ID;$UPDATE_URL"]
|
||||
}
|
||||
JSON
|
||||
chmod 644 "$dir/$FILE"
|
||||
info "wrote $dir/$FILE"
|
||||
touched=$((touched + 1))
|
||||
done
|
||||
|
||||
if [ "$touched" -eq 0 ]; then
|
||||
if [ "$REMOVE" -eq 1 ]; then
|
||||
info "nothing to remove"
|
||||
else
|
||||
fail "found no Chrome, Chromium, Edge or Brave installation to configure"
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo
|
||||
if [ "$REMOVE" -eq 1 ]; then
|
||||
info "Restart the browser to let the change take effect."
|
||||
else
|
||||
info "Next:"
|
||||
info " 1. Remove any unpacked copy from chrome://extensions (same id — both cannot load)."
|
||||
info " 2. Restart the browser, or open chrome://policy and press \"Reload policies\"."
|
||||
info " 3. The card should read \"Installed by enterprise policy\"."
|
||||
fi
|
||||
Reference in New Issue
Block a user