I am developing an extension that uses chrome's Native messaging. After setting the key value in my extension (for native messaging) chrome goes bananas and deletes my files after closing chrome. Turning off sync extensions somehow keeps my files in tact, but it still removes the extension from itself every reboot. I can't figure out if this is some bizarre bug I've stumbled upon or this has to do with not being able to install non web-store extensions
Problem
As you can read on google forums (productforums.google.com), posted on 04.09.2015, new versions of Google Chrome will automatically disable extension that are have not been installed from Chrome Web Store. There is no option to change this behaviour.
Some extensions come bundled with others, which causes Chrome to ask
whether you want to install them (or not). However, bad actors have
abused this mechanism, bypassing the prompt to silently install
malicious extensions that can override browser settings and alter the
user experience in undesired ways.
...
Since these malicious extensions are not hosted on the Chrome Web
Store, it’s difficult to limit the damage they can cause. This is why
we announced in November that as part of our continuing security
efforts, all extensions for Windows users must be hosted in the
Chrome Web Store.
Solutions
1. Use a different browser. For example, Opera (version > 15) and SRWare Iron browsers extensions are 100% compatible and they don't get disabled on each browser startup. All the tools from Google Chrome are available in these browsers.
2. Pack the extension (idea taken from this url). Open the extension page, activate "Developer Mode"; Click "Load unpacked extension..."; Search trough your directory tree for the directory where you unpacked your extension and click OK; Disadvantages: Chrome nags you to disable the extension at each start up
If you are copy/pasting an installed extension that no longer exists, you can modify the manifest and remove:
the key
the update_url
Then load it again and it will work and assume you are developing it.
Related
I am creating a website that have a link to download my chrome CRX app to install it on chrome, the problem is whenever I try to download it it's give me an error that says: " Package is invalid: 'CRX_REQUESTED_PROOF_MISSING' ".
How can I fix this problem?
NOTE: my app is working when I install it using developer tools.
My manifest.json:
{"name":"MY_APP_NAME",
"version":"0.0.1",
"manifest_version":2,
"minimum_chrome_version":"37.0.0.0",
"permissions":["webview","power","storage","videoCapture","geolocation","pointerLock","system.display",{"fileSystem":["write","retainEntries","directory"]},"accessibilityFeatures.read","accessibilityFeatures.modify"],"app":{"background":{"scripts":["js/foam.js","js/cab.js","config.js","background_main.js"]}},
"default_locale":"en",
"icons":{"128":"img/128.png"}}
I'm also currently having this issue and trying to find workarounds for it. Unfortunately it seems that due to Chrome's security policy, plugins needs to go through their webstore in order to have the multiple levels of "proof" before chrome will accept it as a legit extension. So far it seems the only way to get it to work is to load it as an unpacked extension, go through the webstore, or force install it via group policy.
Links and refs:
https://developer.chrome.com/apps/external_extensions
https://support.google.com/chrome/a/answer/6306504?hl=en
https://github.com/oncletom/crx/issues/109
According to documentation, Chrome does not allow installing CRX from outside of their store, unless in developer mode or through enterprise policy: https://developer.chrome.com/extensions/hosting_changes, or on Linux (it's mentioned at the beginning of linux_hosting i linked in my previous comment).
So that may be a reason, because in their source, that "proof missing" error is returned only if either public key is missing, or "required key" is missing:
https://github.com/chromium/chromium/blob/c48c9b176af94f7ec65e20f21594524526d2a830/components/crx_file/crx_verifier.cc#L178
"required key" seems to be their predefined key:
https://github.com/chromium/chromium/blob/c48c9b176af94f7ec65e20f21594524526d2a830/components/crx_file/crx_verifier.cc#L134
and
https://github.com/chromium/chromium/blob/c48c9b176af94f7ec65e20f21594524526d2a830/components/crx_file/crx_verifier.cc#L42
I'm guessing that's the public part of Chrome Web Store key? There's no easy or even "practical" way to create signature that will match their key.
So, either it's the missing Chrome Web Signature key, or something is wrong with how we create signature using developer's key.
How can I distribute my extension if I cannot upload it to the Chrome Web Store for policy reasons?
These changes are effective only on Windows stable and beta channel. Users who want to get extensions that are not hosted on the Chrome Web Store can do so on Chrome dev/canary channels in Windows or on all Chrome channels in other operating systems.
What are the supported deployment options for extensions after this change?
Apart from users installing extensions from the Chrome Web Store, the following deployment options will be supported:
For OSX and Linux, extensions can be installed via a preferences JSON file.
For Windows, extensions can be installed via the Windows registry. In the Windows registry, ensure that the update_url registry key points to the following URL: https://clients2.google.com/service/update2/crx. Local .crx installs via the path registry key are deprecated. Note that this deployment option works only for Chrome Web Store hosted extensions, and update_url cannot point to any other host other than https://clients2.google.com/service/update2/crx.
For Enterprises, we’ll continue to support group policy to install extensions, irrespective of where the extensions are hosted. Note that the user's machine has to join a domain for GPO policy pushes to be effective.
There's this extension popup warning "Disable developer mode extensions" which shows up on every browser start, even on the dev-channel.
This is annoying beyond belief, but what is even worse, is that there is no clear step by step tutorial on how to allow the automatic execution of an unpacked extension via policies, which they say is the only way to remove the popup.
So, is it even possible to remove the popup for unpacked extensions which resides in a directory on the windows desktop?
How do I go about configuring the computer in such a way that the browser won't bug me on every new browser launch?
There is no intention to pack this extension until it has been fully developed and debugged.
You can't do it without building your own Chrome or hacking the chrome.dll
Here is one example, don't know if it works anymore.
I have developed a Chrome extension and I have packed it.
I sent my extension to some people to try it, but Chrome started to block extensions that it does not find in the store.
Is there any way to install my extension without getting blocked by Chrome?
EDIT
Is there any way to install extension as developer mode? I read that only extensions that installed in developer mode will not blocked.
For regular Windows users who are not skilled with computers, it is practically not possible to install and use extensions from outside the Chrome Web Store.
Users of other operating systems (Linux, Mac, Chrome OS) can easily install unpacked extensions (in developer mode).
Windows users can also load an unpacked extension, but they will always see an information bubble with "Disable developer mode extensions" when they start Chrome or open a new incognito window, which is really annoying. The only way for Windows users to use unpacked extensions without such dialogs is to switch to Chrome on the developer channel, by installing https://www.google.com/chrome/browser/index.html?extra=devchannel#eula.
Extensions can be loaded in unpacked mode by following the following steps:
Visit chrome://extensions (via omnibox or menu -> Tools -> Extensions).
Enable Developer mode by ticking the checkbox in the upper-right corner.
Click on the "Load unpacked extension..." button.
Select the directory containing your unpacked extension.
If you have a crx file, then it needs to be extracted first. CRX files are zip files with a different header. Any capable zip program should be able to open it. If you don't have such a program, I recommend 7-zip.
These steps will work for almost every extension, except extensions that rely on their extension ID. If you use the previous method, you will get an extension with a random extension ID. If it is important to preserve the extension ID, then you need to know the public key of your CRX file and insert this in your manifest.json. I have previously given a detailed explanation on how to get and use this key at https://stackoverflow.com/a/21500707.
For Windows, you can also whitelist your extension through Windows policies. The full steps are details in this answer, but there are quicker steps:
Create the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist.
For each extension you want to whitelist, add a string value whose name should be a sequence number (starting at 1) and value is the extension ID.
For instance, in order to whitelist 2 extensions with ID aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa and bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb, create a string value with name 1 and value aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa, and a second value with name 2 and value bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb. This can be sum up by this registry file:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist]
"1"="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
"2"="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
EDIT: actually, Chromium docs also indicate how to do it for other OS.
EDIT (06/05/2022): ExtensionInstallWhitelist is deprecated since Chrome 100, it has been renamed to ExtensionInstallAllowlist (answer updated)
We built a chrome extension to be used only inside our company by selective people. We do not want to publish this on chrome web store. We could do this before by just drag & drop the crx file in the extensions page.
But in the latest version of chrome(i use 35.x), we are not able to do this anymore. Whenever we try to install the crx file, chrome automatically disables it and shows a message
"This extension is not listed in the Chrome Web Store and may have been added without your knowledge"
with a link to https://support.google.com/chrome/answer/2811969 where it says
"You're seeing this notification because one or more of your Chrome extensions has been turned off to make Chrome safer. The extensions didn't come from the Chrome Web Store or were installed without your permission."
So, Does this mean we can never install crx file from now on? No workaround?
I know we can install using Group Policy method, but is that the only way we can do this?
Thanks in advance.
Yes, this has been disabled as a protection against malware.
The only workarounds I'm aware of are:
turn on Developer Mode and have users install as an unpacked extension after unzipping the CRX
publish unlisted or to a Google Group: https://support.google.com/chrome/a/answer/2663860?hl=en
If I want to install the Chrome App Launcher and navigate to https://chrome.google.com/webstore/launcher , then click the only button over there, that page will install Chrome App Launcher shortcut to my Windows taskbar without any confirmation from the operating system whatsoever.
If I use a different browser, other than Chrome, I get redirected to the Chrome Webstore, with a message "You will need Google Chrome to install most apps, extensions and themes." showing. I guess, Chrome is able to place a shortcut from within a web page to my Desktop/Taskbar via its inner methods, as it's a general executable and may do "a lot" on its own.
How can I add my (any) shortcut from within a web page rendered in Chrome the same (or another) way the Chrome App Launcher has been installed?
Sorry, the webstore has special powers in chrome which regular web sites don't get. This is how it can also install extensions and apps, see whether you have particular extensions and apps installed, etc. You can see API by which it gets these special privileges here.
This API is made available by chrome just to the webstore.