senofy/autofirmer-expanded
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Install the extension from the update server during setup

Browse Source 
Both installers ended by telling you to load the folder unpacked, which is the
one install that can never update itself. They now offer the policy install as
a last step instead, and only fall back to those instructions when it is
declined or fails.

Windows writes to the user's own policy hive rather than HKLM, so the step
needs no elevation and no separate admin shell; -Scope Machine is still there
for every-account installs. Linux gets the counterpart script — a managed
policy file under /etc, which is root-only because Chrome reads policy from
nowhere else on that platform.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
2026-08-31 13:06:29 -05:00
co-authored by Claude Opus 5
parent 035f93d220
commit b9da419ebc
6 changed files with 587 additions and 414 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/install-extension-policy.ps1
+34 -20
View File
@@ -3,29 +3,38 @@
Install the AutoFirmer extension from our own update server, via policy.
.DESCRIPTION
Chrome will not side-load an extension on Windows, and it will not update an
unpacked one. The supported way to run an extension you host yourself is an
enterprise policy: ExtensionInstallForcelist names the extension id and the
update manifest, and from then on Chrome installs it, keeps it updated on its
own schedule, and re-installs it if it goes missing.
Chrome will not side-load an extension on Windows — dropping a CRX on
chrome://extensions is refused — and it will not update an unpacked one. The
supported way to run an extension you host yourself is a policy:
ExtensionInstallForcelist names the extension id and the update manifest, and
from then on Chrome installs it, keeps it updated on its own schedule, and
re-installs it if it goes missing.
Needs an elevated PowerShell — the policy lives under HKLM.
Defaults to the current user's policy hive, which needs no elevation.
-Scope Machine writes to HKLM instead, for every account on the box; that
one does need an elevated shell. Where both exist, HKLM wins.
After this runs:
* Remove the unpacked copy from chrome://extensions. It has the same id
now, and Chrome will not load both.
* Restart Chrome, or open chrome://policy and press "Reload policies".
* A force-installed extension cannot be disabled or removed from the
extensions page. Re-run this with -Remove to take it off.
extensions page. Re-run with -Remove to take it off.
.EXAMPLE
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
.EXAMPLE
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Scope Machine -Browser Edge
#>
[CmdletBinding()]
param(
[ValidateSet('Chrome', 'Edge', 'Brave')]
[string]$Browser = 'Chrome',
[ValidateSet('User', 'Machine')]
[string]$Scope = 'User',
# Derived from the signing key on the droplet. It only changes if the key does.
[string]$Id = 'lkjbblagjjbldlkeaaffhiopdlhniaan',
@@ -36,23 +45,27 @@ param(
$ErrorActionPreference = 'Stop'
$roots = @{
Chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
Edge = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
Brave = 'HKLM:\SOFTWARE\Policies\BraveSoftware\Brave'
$vendors = @{
Chrome = 'Google\Chrome'
Edge = 'Microsoft\Edge'
Brave = 'BraveSoftware\Brave'
}
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
throw 'Run this from an elevated PowerShell — the policy key is under HKLM.'
$hive = if ($Scope -eq 'Machine') { 'HKLM:' } else { 'HKCU:' }
if ($Scope -eq 'Machine') {
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
throw 'Run this from an elevated PowerShell for -Scope Machine, or drop the flag to install it for this user only.'
}
}
$key = Join-Path $roots[$Browser] 'ExtensionInstallForcelist'
$key = "$hive\SOFTWARE\Policies\$($vendors[$Browser])\ExtensionInstallForcelist"
$entry = "$Id;$UpdateUrl"
if ($Remove) {
if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no forcelist for $Browser."; exit 0 }
if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no $Scope forcelist for $Browser."; exit 0 }
$props = Get-ItemProperty $key
$found = $false
foreach ($name in ($props.PSObject.Properties.Name | Where-Object { $_ -notlike 'PS*' })) {
@@ -62,7 +75,7 @@ if ($Remove) {
$found = $true
}
}
if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser forcelist." }
if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser $Scope forcelist." }
Write-Host "`nRestart $Browser to let the change take effect."
exit 0
}
@@ -78,15 +91,16 @@ $existing = $props.PSObject.Properties |
if ($existing) {
Set-ItemProperty -Path $key -Name $existing.Name -Value $entry
Write-Host "Updated $Browser forcelist entry $($existing.Name):"
Write-Host "Updated the $Browser $Scope forcelist entry $($existing.Name):"
} else {
$used = $props.PSObject.Properties.Name |
Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ }
$slot = if ($used) { (($used | Measure-Object -Maximum).Maximum + 1) } else { 1 }
New-ItemProperty -Path $key -Name "$slot" -Value $entry -PropertyType String -Force | Out-Null
Write-Host "Added $Browser forcelist entry ${slot}:"
Write-Host "Added $Browser $Scope forcelist entry ${slot}:"
}
Write-Host " $key"
Write-Host " $entry"
Write-Host @"