Brandon LiandClaude Opus 5
b9da419ebc
Both installers ended by telling you to load the folder unpacked, which is the one install that can never update itself. They now offer the policy install as a last step instead, and only fall back to those instructions when it is declined or fails. Windows writes to the user's own policy hive rather than HKLM, so the step needs no elevation and no separate admin shell; -Scope Machine is still there for every-account installs. Linux gets the counterpart script — a managed policy file under /etc, which is root-only because Chrome reads policy from nowhere else on that platform. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
116 lines
4.5 KiB
PowerShell
116 lines
4.5 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Install the AutoFirmer extension from our own update server, via policy.
|
|
|
|
.DESCRIPTION
|
|
Chrome will not side-load an extension on Windows — dropping a CRX on
|
|
chrome://extensions is refused — and it will not update an unpacked one. The
|
|
supported way to run an extension you host yourself is a policy:
|
|
ExtensionInstallForcelist names the extension id and the update manifest, and
|
|
from then on Chrome installs it, keeps it updated on its own schedule, and
|
|
re-installs it if it goes missing.
|
|
|
|
Defaults to the current user's policy hive, which needs no elevation.
|
|
-Scope Machine writes to HKLM instead, for every account on the box; that
|
|
one does need an elevated shell. Where both exist, HKLM wins.
|
|
|
|
After this runs:
|
|
* Remove the unpacked copy from chrome://extensions. It has the same id
|
|
now, and Chrome will not load both.
|
|
* Restart Chrome, or open chrome://policy and press "Reload policies".
|
|
* A force-installed extension cannot be disabled or removed from the
|
|
extensions page. Re-run with -Remove to take it off.
|
|
|
|
.EXAMPLE
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
|
|
|
|
.EXAMPLE
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Scope Machine -Browser Edge
|
|
#>
|
|
[CmdletBinding()]
|
|
param(
|
|
[ValidateSet('Chrome', 'Edge', 'Brave')]
|
|
[string]$Browser = 'Chrome',
|
|
|
|
[ValidateSet('User', 'Machine')]
|
|
[string]$Scope = 'User',
|
|
|
|
# Derived from the signing key on the droplet. It only changes if the key does.
|
|
[string]$Id = 'lkjbblagjjbldlkeaaffhiopdlhniaan',
|
|
|
|
[string]$UpdateUrl = 'https://ext.juicerroom.com/updates.xml',
|
|
|
|
[switch]$Remove
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$vendors = @{
|
|
Chrome = 'Google\Chrome'
|
|
Edge = 'Microsoft\Edge'
|
|
Brave = 'BraveSoftware\Brave'
|
|
}
|
|
|
|
$hive = if ($Scope -eq 'Machine') { 'HKLM:' } else { 'HKCU:' }
|
|
|
|
if ($Scope -eq 'Machine') {
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
|
|
[Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this from an elevated PowerShell for -Scope Machine, or drop the flag to install it for this user only.'
|
|
}
|
|
}
|
|
|
|
$key = "$hive\SOFTWARE\Policies\$($vendors[$Browser])\ExtensionInstallForcelist"
|
|
$entry = "$Id;$UpdateUrl"
|
|
|
|
if ($Remove) {
|
|
if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no $Scope forcelist for $Browser."; exit 0 }
|
|
$props = Get-ItemProperty $key
|
|
$found = $false
|
|
foreach ($name in ($props.PSObject.Properties.Name | Where-Object { $_ -notlike 'PS*' })) {
|
|
if ($props.$name -like "$Id;*") {
|
|
Remove-ItemProperty -Path $key -Name $name
|
|
Write-Host "Removed $name ($($props.$name))"
|
|
$found = $true
|
|
}
|
|
}
|
|
if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser $Scope forcelist." }
|
|
Write-Host "`nRestart $Browser to let the change take effect."
|
|
exit 0
|
|
}
|
|
|
|
if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
|
|
|
|
# The forcelist is a list expressed as numbered values, so adding to it means
|
|
# finding a free number rather than overwriting whatever is already there —
|
|
# another extension may well be in the list.
|
|
$props = Get-ItemProperty $key
|
|
$existing = $props.PSObject.Properties |
|
|
Where-Object { $_.Name -notlike 'PS*' -and $_.Value -like "$Id;*" }
|
|
|
|
if ($existing) {
|
|
Set-ItemProperty -Path $key -Name $existing.Name -Value $entry
|
|
Write-Host "Updated the $Browser $Scope forcelist entry $($existing.Name):"
|
|
} else {
|
|
$used = $props.PSObject.Properties.Name |
|
|
Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ }
|
|
$slot = if ($used) { (($used | Measure-Object -Maximum).Maximum + 1) } else { 1 }
|
|
New-ItemProperty -Path $key -Name "$slot" -Value $entry -PropertyType String -Force | Out-Null
|
|
Write-Host "Added $Browser $Scope forcelist entry ${slot}:"
|
|
}
|
|
|
|
Write-Host " $key"
|
|
Write-Host " $entry"
|
|
Write-Host @"
|
|
|
|
Next:
|
|
1. Remove the unpacked copy from chrome://extensions (same id — both cannot load).
|
|
2. Restart $Browser, or open chrome://policy and press "Reload policies".
|
|
3. Check chrome://extensions: the card should say "Installed by enterprise policy".
|
|
|
|
From here $Browser updates it on its own. The extension also asks for a check as
|
|
soon as the dashboard reports a newer version, so a release normally lands in
|
|
seconds rather than waiting out Chrome's own cycle.
|
|
"@
|