crx3-utils

Create CRX3 files without Chrome, extract public keys, verify signatures; cli & api

Downloads in past

Stats

StarsIssuesVersionUpdatedCreatedSize
crx3-utils
1510.0.35 years ago5 years agoMinified + gzip package size for crx3-utils in KB

Readme

crx3-utils
Starting with Chrome 73, Chrome changed the package format for extensions to the CRX3 file format.
$ npm -g i crx3-utils
Usage:
$ crx3-new private.pem < file.zip
The util is intentionally bare bone: it doesn't generate a private key for you (use openssl for that) & it doesn't compress your directory (use zip for that).
Print info for a .crx downloaded from the Chome Web Store:
~ $ crx3-info < file.crx id ckbpebiaofifhmkecjijobfafcfngfkj header 1322 payload 8233 sha256withrsa 2 mainidx=1 sha256withecdsa 1 ~
(main_idx is the index of AsymmetricKeyProof that contains a public key from which the id was derived during the .crx creation.)
Extract zip:
~ $ crx3-info < file.crx | awk '/^header/ {print $2}' \ | xargs -I% dd if=file.crx iflag=skip_bytes skip=% > file.zip ~
Extract the 1st rsa public key:
~ $ crx3-info rsa 0 < file.crx -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj/u/XDdjlDyw7gHEtaaa sZ9GdG8WOKAyJzXd8HFrDtz2Jcuy7er7MtWvHgNDA0bwpznbI5YdZeV4UfCEsA4S rA5b3MnWTHwA1bgbiDM+L9rrqvcadcKuOlTeN48Q0ijmhHlNFbTzvT9W0zw/GKv8 LgXAHggxtmHQ/Z9PP2QNF5O8rUHHSL4AJ6hNcEKSBVSmbbjeVm4gSXDuED5r0nwx vRtupDxGYp8IZpP5KlExqNu1nbkPc+igCTIB6XsqijagzxewUHCdovmkb2JNtskx /PMIEv+TvWIx2BzqGp71gSh/dV7SJ3rClvWd2xj8dtxG8FfAWDTIIi0qZXWn2Qhi zQIDAQAB -----END PUBLIC KEY----- ~
Validate (returns 0 on success):
$ crx3-verify rsa 0 public.pem < file.crx

License

MIT.