bmatthews68 / crx-maven-plugin Goto Github PK

View Code? Open in Web Editor NEW

17.0 17.0 4.0 1019 KB

Maven plugin to package a Chrome extension

JavaScript 9.78% Java 86.40% HTML 3.82%

crx-maven-plugin's People

Contributors

Stargazers

Watchers

Forkers

sankooc yoannguion spyhunter99 cromoose

crx-maven-plugin's Issues

Add crx-verify goal that can be used to verify the signature on a crx artifact

Update the README documentation

Update the README documentation for the project using the contents of my blog posting:

http://blog.btmatthews.com/2012/08/10/release-announcement-crx-maven-plugin-1-1-0/

Refactor code to leverage plexus-archiver

Introduce a CRXArchiver class that extends AbstractArchiver encapsulating the code that packages and signs the CRX archive. The idea is that we want to enable the CRX format in an assembly plug-in.

The project site for plexus-archiver is:

http://plexus.codehaus.org/plexus-components/plexus-archiver/

Change Since Chrome 73, only CRX3 format is supported

CRX_HEADER_INVALID while dropping .crx into chrom://extensions tab

Failure to load since Chrome V73 is not considered an failure, but working as intended.

Seems that current format known as CRX2 used sha1,
CRX3 has hash upgrade to sha2 (haven't found detail on which sha2...)

Starting with Chrome 75, all force-installed extensions will need to be packaged in the CRX3 format. Privately hosted extensions that were packaged using a custom script or a version of Chrome prior to Chrome 64.0.3242.0 must be repackaged.If your organization is force-installing privately hosted extensions packaged in CRX2 format and you don’t repackage them, they’ll stop updating in Chrome 75. New installations of the extension will fail.Why is this change happening?

CRX2 uses SHA1 to secure updates to the extension. Breaking SHA1 is technically possible. So, an attacker might intercept the extension update and inject arbitrary code into it. CRX3 uses a stronger algorithm, avoiding this risk.

Feature request

Support CRX3
Support multiple formats (CRX2 might go, but CRX4 may come eventually...)
For our users using old chrome version we might need to support building a CRX2 and CRX3.
Would be nice to be able to do so in the same build, so would be helpful to be able to specify executions for multiple outputs, but default build of latest version seems reasonable.

Finalize the site documentation for 1.0.0 release

Release 1.0.0 to Maven Central

no such algorithm: RSA for provider BC

I'm not sure why but I"m getting this when in a multi-module reactor.

It might be one of the other modules screwing things up but I''m not sure why this could happen.

If I run mvn package on the specific sub-module, it works just fine.

Add support for filtering of text assets

Support for JKS based keys (or smartcards)

Would it be possible to specify a JKS key store, key alias, key pass and store pass?

Chrome complains about signature

I'm having problem using the maven plugin.
The maven build completes, but the signature of the produced CRX file seems to be invalid.

Running mvn crx:crx-verify reports java.security.InvalidKeyException: RSA keys must be at least 512 bits long
And trying to load it into Chrome causes an error: CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED

The .pem file was created with Chrome and the CRX produced by Chrome works fine.

pom.xml:

<project>
   ...
   <packaging>crx</packaging>
   ...
   <build>
        <plugins>
            <plugin>
                <groupId>com.btmatthews.maven.plugins</groupId>
                <artifactId>crx-maven-plugin</artifactId>
                <version>1.1.1</version>
                <extensions>true</extensions>

                <configuration>
                    <pemFile>src/main/chrome.pem</pemFile>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

I'd be happy to provide more information but I'm not sure what :)

Create blog post for release announcement

Custom domain reference for CRX Maven Plugin failing

The readme.md has link CRX Maven Plugin http://crx-maven-plugin.btmatthews.com/
Displays error page.

Oh no! It looks like this Pages site has been disabled due to a misconfigured custom domain.

Can still get to doc at
http://bmatthews68.github.io/crx-maven-plugin/

ClassCastException Using Chrome-Generated PEM

Caused by: java.lang.ClassCastException: org.bouncycastle.jcajce.provider.asymmetric.rsa.BCRSAPrivateCrtKey cannot be cast to java.security.KeyPair
    at com.btmatthews.maven.plugins.crx.CRXArchiverImpl.getKeyPair(CRXArchiverImpl.java:161)
    at com.btmatthews.maven.plugins.crx.CRXArchiverImpl.execute(CRXArchiverImpl.java:129)
    at org.codehaus.plexus.archiver.AbstractArchiver.createArchive(AbstractArchiver.java:904)
    at com.btmatthews.maven.plugins.crx.CRXMojo.execute(CRXMojo.java:137)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:101)
    ... 20 more

Empty extension using a .pem file generated by Chrome as per the steps here. This happens both when omitting the <pemPassword> tag and leaving it blank.

This happens on both v1.0.0 and v1.1.0.

realm =    plugin>com.btmatthews.maven.plugins:crx-maven-plugin:1.1.0
strategy = org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy
urls[0] = file:/Users/jw/.m2/repository/com/btmatthews/maven/plugins/crx-maven-plugin/1.1.0/crx-maven-plugin-1.1.0.jar
urls[1] = file:/Users/jw/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.47/bcprov-jdk15on-1.47.jar
urls[2] = file:/Users/jw/.m2/repository/org/bouncycastle/bcpkix-jdk15on/1.47/bcpkix-jdk15on-1.47.jar
urls[3] = file:/Users/jw/.m2/repository/org/apache/maven/plugin-tools/maven-plugin-annotations/3.1/maven-plugin-annotations-3.1.jar
urls[4] = file:/Users/jw/.m2/repository/org/sonatype/sisu/sisu-inject-bean/2.3.0/sisu-inject-bean-2.3.0.jar
urls[5] = file:/Users/jw/.m2/repository/org/sonatype/sisu/sisu-guice/3.1.0/sisu-guice-3.1.0-no_aop.jar
urls[6] = file:/Users/jw/.m2/repository/org/sonatype/sisu/sisu-guava/0.9.9/sisu-guava-0.9.9.jar
urls[7] = file:/Users/jw/.m2/repository/org/sonatype/aether/aether-util/1.13.1/aether-util-1.13.1.jar
urls[8] = file:/Users/jw/.m2/repository/org/codehaus/plexus/plexus-interpolation/1.14/plexus-interpolation-1.14.jar
urls[9] = file:/Users/jw/.m2/repository/org/codehaus/plexus/plexus-component-annotations/1.5.5/plexus-component-annotations-1.5.5.jar
urls[10] = file:/Users/jw/.m2/repository/org/sonatype/plexus/plexus-sec-dispatcher/1.3/plexus-sec-dispatcher-1.3.jar
urls[11] = file:/Users/jw/.m2/repository/org/sonatype/plexus/plexus-cipher/1.4/plexus-cipher-1.4.jar
urls[12] = file:/Users/jw/.m2/repository/org/codehaus/plexus/plexus-utils/3.0.3/plexus-utils-3.0.3.jar
urls[13] = file:/Users/jw/.m2/repository/org/codehaus/plexus/plexus-archiver/2.1.2/plexus-archiver-2.1.2.jar
urls[14] = file:/Users/jw/.m2/repository/junit/junit/3.8.1/junit-3.8.1.jar
urls[15] = file:/Users/jw/.m2/repository/org/codehaus/plexus/plexus-io/2.0.4/plexus-io-2.0.4.jar