Sideloading will be disabled Firefox (#24)

* Include Mozilla AMO signed extension IB-6115 Signed-off-by: Raul Metsma <[email protected]> * Install OSX/Win policy IB-6115 Signed-off-by: Raul Metsma <[email protected]>
open-eid · Dec 10, 2019 · 0ec87c5 · 0ec87c5
1 parent 447a0d7
commit 0ec87c5
Show file tree

Hide file tree

Showing 6 changed files with 27 additions and 12 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -1,7 +1,8 @@
 cmake_minimum_required(VERSION 3.0)
-project(firefox-pkcs11-loader VERSION 3.13.3 LANGUAGES NONE)
+project(firefox-pkcs11-loader VERSION 3.13.4 LANGUAGES NONE)
 
 set(UUID "{02274e0c-d135-45f0-8a9c-32b35110e10d}" CACHE STRING "Extension UUID")
+set(URL "https://addons.mozilla.org/firefox/downloads/latest/pkcs11-module-loader/latest.xpi" CACHE STRING "Mozilla AMO URL")
 set(SIGNCERT "" CACHE STRING "Common name of certificate to used sign packages, empty skip signing")
 
 add_custom_target(extension
@@ -16,8 +17,7 @@ else()
     set(PKG_VERSION "${PROJECT_VERSION}")
 endif()
 if(APPLE)
-    install(FILES ${PROJECT_BINARY_DIR}/${UUID}.xpi
-        DESTINATION "/Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/")
+    configure_file(${PROJECT_SOURCE_DIR}/macos-postinstall.in ${PROJECT_BINARY_DIR}/scripts/postinstall @ONLY)
     install(FILES ${PROJECT_SOURCE_DIR}/onepinopenscpkcs11-mac.json RENAME onepinopenscpkcs11.json
         DESTINATION "/Library/Application Support/Mozilla/PKCS11Modules")
     install(FILES ${PROJECT_SOURCE_DIR}/idemiaawppkcs11-mac.json RENAME idemiaawppkcs11.json
@@ -28,7 +28,7 @@ if(APPLE)
     add_custom_target(installer
         COMMENT "Creating installer"
         COMMAND make install DESTDIR=root
-        COMMAND pkgbuild --root root ${PKG_EXTRA} --version "${PKG_VERSION}$ENV{VER_SUFFIX}"
+        COMMAND pkgbuild --root root --scripts scripts ${PKG_EXTRA} --version "${PKG_VERSION}$ENV{VER_SUFFIX}"
                 --identifier "ee.ria.${PROJECT_NAME}" ${PROJECT_NAME}_${PKG_VERSION}$ENV{VER_SUFFIX}.pkg
     )
 elseif(UNIX)
@@ -54,13 +54,13 @@ elseif(WIN32)
     set(MSI_FILE "${PROJECT_NAME}_${PKG_VERSION}$ENV{VER_SUFFIX}")
     add_custom_target(installer
         COMMENT "Creating installer"
-        COMMAND "$ENV{WIX}bin\\candle.exe" -nologo -arch x86 -dPlatform=x86 "${CANDLE_EXTRA}" -dsrc="${PROJECT_SOURCE_DIR}" -dGUID="${UUID}"
+        COMMAND "$ENV{WIX}bin\\candle.exe" -nologo -arch x86 -dPlatform=x86 "${CANDLE_EXTRA}" -dsrc="${PROJECT_SOURCE_DIR}" -dURL="${URL}"
             -dMSI_VERSION=${PKG_VERSION} ${CMAKE_SOURCE_DIR}/${PROJECT_NAME}.wxs
         COMMAND "$ENV{WIX}bin\\light.exe" -nologo -o "${MSI_FILE}.x86.msi" ${PROJECT_NAME}.wixobj -ext WixUIExtension
             -dWixUILicenseRtf=${CMAKE_SOURCE_DIR}/LICENSE.LGPL.rtf
             -dWixUIDialogBmp=${CMAKE_SOURCE_DIR}/dlgbmp.bmp
             -dWixUIBannerBmp=${CMAKE_SOURCE_DIR}/banner.bmp
-        COMMAND "$ENV{WIX}bin\\candle.exe" -nologo -arch x64 -dPlatform=x64 "${CANDLE_EXTRA}" -dsrc="${PROJECT_SOURCE_DIR}" -dGUID="${UUID}"
+        COMMAND "$ENV{WIX}bin\\candle.exe" -nologo -arch x64 -dPlatform=x64 "${CANDLE_EXTRA}" -dsrc="${PROJECT_SOURCE_DIR}" -dURL="${URL}"
             -dMSI_VERSION=${PKG_VERSION} ${CMAKE_SOURCE_DIR}/${PROJECT_NAME}.wxs
         COMMAND "$ENV{WIX}bin\\light.exe" -nologo -o "${MSI_FILE}.x64.msi" ${PROJECT_NAME}.wixobj -ext WixUIExtension
             -dWixUILicenseRtf=${CMAKE_SOURCE_DIR}/LICENSE.LGPL.rtf

diff --git a/FirefoxAction.CA.dll b/FirefoxAction.CA.dll
diff --git a/firefox-pkcs11-loader.wxs b/firefox-pkcs11-loader.wxs
@@ -8,18 +8,23 @@
     <MajorUpgrade AllowSameVersionUpgrades="yes" Schedule="afterInstallInitialize" DowngradeErrorMessage=
       "A newer version of [ProductName] is already installed. If you are trying to downgrade, please uninstall the newer version first."/>
     <UIRef Id="WixUI_Minimal"/>
+    <!-- https://github.com/open-eid/windows-installer/blob/master/FirefoxActionWix/README.md -->
+    <Binary Id="FirefoxAction.CA.dll" SourceFile="$(var.src)\FirefoxAction.CA.dll" />
+    <CustomAction Id="ExtensionSettingsInstall" Return="check" Execute="firstSequence"
+      BinaryKey="FirefoxAction.CA.dll" DllEntry="ExtensionSettingsInstall" />
+    <CustomAction Id="ExtensionSettingsRemove" Return="check" Execute="firstSequence"
+      BinaryKey="FirefoxAction.CA.dll" DllEntry="ExtensionSettingsRemove" />
+    <Property Id="EXTENSIONSETTINGS_URL" Value="$(var.URL)" />
+    <Property Id="EXTENSIONSETTINGS_UUID" Value="{02274e0c-d135-45f0-8a9c-32b35110e10d}" />
 
     <Directory Id="TARGETDIR" Name="SourceDir">
       <Directory Id="ProgramFilesFolder">
         <Directory Id="APPLICATIONFOLDER" Name="Firefox PKCS11 Loader">
           <Component Id="FirefoxPKCS11Loader" Guid="cf9e4ad5-8015-42f8-9400-3742a521071d" Win64="no">
-            <RegistryValue Root="HKLM" Key="Software\Mozilla\Firefox\Extensions" Name="$(var.GUID)"
-                           Value="[APPLICATIONFOLDER]\$(var.GUID).xpi" Type="string" Action="write"/>
             <RegistryValue Root="HKLM" Key="Software\Mozilla\PKCS11Modules\onepinopenscpkcs11"
                            Value="[APPLICATIONFOLDER]onepinopenscpkcs11.json" Type="string" Action="write"/>
             <RegistryValue Root="HKLM" Key="Software\Mozilla\PKCS11Modules\idemiaawppkcs11"
                            Value="[APPLICATIONFOLDER]idemiaawppkcs11.json" Type="string" Action="write"/>
-            <File Source="$(var.GUID).xpi" />
             <File Source="$(var.src)\onepinopenscpkcs11-win.json" Name="onepinopenscpkcs11.json"/>
             <File Source="$(var.src)\idemiaawppkcs11-win.json" Name="idemiaawppkcs11.json"/>
 <?ifdef var.opensc_path ?>
@@ -48,15 +53,17 @@
       </Directory>
 <?endif ?>
       <Component Id="FirefoxPKCS11Loader_X64" Win64="yes">
-        <RegistryValue Root="HKLM" Key="Software\Mozilla\Firefox\Extensions" Name="$(var.GUID)"
-                       Value="[APPLICATIONFOLDER]\$(var.GUID).xpi" Type="string" Action="write"/>
         <RegistryValue Root="HKLM" Key="Software\Mozilla\PKCS11Modules\onepinopenscpkcs11"
                        Value="[APPLICATIONFOLDER]onepinopenscpkcs11.json" Type="string" Action="write"/>
         <RegistryValue Root="HKLM" Key="Software\Mozilla\PKCS11Modules\idemiaawppkcs11"
                        Value="[APPLICATIONFOLDER]idemiaawppkcs11.json" Type="string" Action="write"/>
       </Component>
 <?endif ?>
     </Directory>
+    <InstallExecuteSequence>
+      <Custom Action="ExtensionSettingsInstall" Before="WriteRegistryValues">NOT Installed</Custom>
+      <Custom Action="ExtensionSettingsRemove" Before="InstallFinalize">Installed AND NOT UPGRADINGPRODUCTCODE</Custom>
+    </InstallExecuteSequence>
 
     <Feature Id="extension" Title="Firefox PKCS11 Loader">
       <ComponentRef Id='FirefoxPKCS11Loader'/>

diff --git a/macos-postinstall.in b/macos-postinstall.in
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+PLIST=/Library/Preferences/org.mozilla.firefox.plist
+URL=@URL@
+UUID=@UUID@
+
+defaults write ${PLIST} EnterprisePoliciesEnabled -bool true
+defaults write ${PLIST} ExtensionSettings -dict-add "'${UUID}'" "{ 'installation_mode' = 'normal_installed'; 'install_url' = '${URL}'; }"
diff --git a/webextension/manifest.json b/webextension/manifest.json
@@ -3,7 +3,7 @@
   "name": "PKCS11 loader",
   "description": "Configures Firefox to use PKCS11 for authentication",
   "homepage_url": "https://github.com/open-eid/firefox-pkcs11-loader",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "icons": { "32": "id-32.png" },
   "permissions": [ "pkcs11" ],
   "background": { "scripts": ["background.js"] },

diff --git a/{02274e0c-d135-45f0-8a9c-32b35110e10d}.xpi b/{02274e0c-d135-45f0-8a9c-32b35110e10d}.xpi