Sideloading will be disabled Firefox (#153)

* Include Mozilla AMO signed extension

IB-6115

Signed-off-by: Raul Metsma <raul@metsma.ee>

* Install OSX/Win policy

IB-6115

Signed-off-by: Raul Metsma <raul@metsma.ee>

VERSION.mk

@@ -18,6 +18,6 @@
 
 MAJOR_VERSION=1
 MINOR_VERSION=1
-RELEASE_VERSION=0
+RELEASE_VERSION=1
 VERSION=$(MAJOR_VERSION).$(MINOR_VERSION).$(RELEASE_VERSION)
 VERSIONEX=$(VERSION).$(BUILD_NUMBER)

extension/manifest.json

@@ -1,6 +1,6 @@
 {
     "name": "Token signing",
-    "version": "0.0.30",
+    "version": "0.0.31",
     "minimum_chrome_version": "40.0",
     "manifest_version": 2,
     "description": "Use your eID smart card on the web",

host-linux/chrome-token-signing.pro

@@ -2,7 +2,7 @@ TEMPLATE = app
 CONFIG += console c++11 link_pkgconfig
 CONFIG -= app_bundle
 QT += widgets network
-isEmpty(VERSION):VERSION=1.1.0.0
+isEmpty(VERSION):VERSION=1.1.1.0
 PKGCONFIG += libpcsclite
 INCLUDEPATH += ../host-shared
 LIBS += -ldl

host-osx/Info.plist

@@ -15,11 +15,11 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>$(VERSION)</string>
+	<string>$(MARKETING_VERSION)</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleVersion</key>
-	<string>$(BUILD_NUMBER)</string>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>$(MACOSX_DEPLOYMENT_TARGET)</string>
 	<key>LSUIElement</key>

host-osx/Makefile

@@ -16,86 +16,86 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 #
 
-EXTERNAL_PATH = /Library/Application\ Support/Google/Chrome/External\ Extensions
-NATIVE_PATH = /Library/Google/Chrome/NativeMessagingHosts
-FIREFOX_PATH = /Library/Application\ Support/Mozilla/NativeMessagingHosts
-FFEXTENSION_PATH = /Library/Application\ Support/Mozilla/Extensions/\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\}
-
 BUILD_NUMBER ?= 0
 include ../VERSION.mk
-
 SIGNER ?= Riigi Infosüsteemi Amet
-TMPROOT = $(PWD)/tmp
+PATH_EXTERNAL = /Library/Application\ Support/Google/Chrome/External\ Extensions
+PATH_NATIVE = /Library/Google/Chrome/NativeMessagingHosts
+PATH_FIREFOX = /Library/Application\ Support/Mozilla/NativeMessagingHosts
+PATH_PREFERENCES = /Library/Preferences
+TMP_ROOT = $(PWD)/tmp
 TMP_CHROME = $(PWD)/tmp_chrome
 TMP_FIREFOX = $(PWD)/tmp_firefox
-POLICYROOT = $(PWD)/tmp_policy
-POLICYSIGNED = $(PWD)/tmpsigned
-TARGET = $(TMPROOT)/Library/Google/Chrome/NativeMessagingHosts/chrome-token-signing.app
-PKG_CHROME = token-signing-chrome.pkg
-PKG_FIREFOX = token-signing-firefox.pkg
-POLICY = token-signing-chrome-policy.pkg
-
-PROJ = xcodebuild -project chrome-token-signing.xcodeproj -configuration Release VERSION=$(VERSION) BUILD_NUMBER=$(BUILD_NUMBER)
-PKG_BUILD = pkgbuild --version $(VERSION) --install-location / 
+TMP_POLICY = $(PWD)/tmp_policy
+TMP_POLICY_SIGNED = $(PWD)/tmp_signed
+PKG_BUILD = pkgbuild --version $(VERSION) --install-location /
 PKG_BUILD_SIGNED = $(PKG_BUILD) --sign "Developer ID Installer: $(SIGNER)"
+PKG_CHROME = token-signing-chrome
+PKG_FIREFOX = token-signing-firefox
+PKG_POLICY = token-signing-chrome-policy
+PROJ = xcodebuild -project chrome-token-signing.xcodeproj -configuration Release MARKETING_VERSION=$(VERSION) CURRENT_PROJECT_VERSION=$(BUILD_NUMBER)
+TARGET = $(TMP_ROOT)/Library/Google/Chrome/NativeMessagingHosts/chrome-token-signing.app
 
 $(TARGET): *.mm
-	$(PROJ) install DSTROOT=$(TMPROOT)
-	$(MAKE) separate
+	$(PROJ) install DSTROOT=$(TMP_ROOT)
 
-codesign: $(TARGET) 
+codesign: $(TARGET)
 	codesign -f --entitlements chrome-token-signing.entitlements --options=runtime -s "Developer ID Application: $(SIGNER)" $<
 
 clean:
 	$(PROJ) clean
 	git clean -dfx
 
-$(PKG_CHROME): $(TARGET)
-	$(PKG_BUILD) --root $(TMP_CHROME) --identifier ee.ria.token-signing-chrome $@
+$(TMP_CHROME): $(TARGET)
+	mkdir -p $@/$(PATH_NATIVE) $@/$(PATH_EXTERNAL)
+	cp -R $< $@/$(PATH_NATIVE)
+	cp -v ee.ria.esteid.json $@/$(PATH_NATIVE)
+	cp -v ../ckjefchnfjhjfedoccjbhjpbncimppeg.json $@/$(PATH_EXTERNAL)
 
-$(PKG_FIREFOX): $(TARGET)
-	$(PKG_BUILD) --root $(TMP_FIREFOX) --identifier ee.ria.token-signing-firefox $@
+$(TMP_FIREFOX): $(TARGET)
+	mkdir -p $@/$(PATH_NATIVE) $@/$(PATH_FIREFOX)
+	cp -R $< $@/$(PATH_NATIVE)
+	cp -v ee.ria.esteid.firefox.json $@/$(PATH_FIREFOX)/ee.ria.esteid.json
 
-$(POLICY):
-	mkdir -p $(POLICYROOT)
-	$(PKG_BUILD) --root $(POLICYROOT) --identifier ee.ria.token-signing-chrome-policy --scripts scripts $@
+$(TMP_POLICY):
+	mkdir -p $@
 
-pkg: $(PKG_CHROME) $(PKG_FIREFOX) $(POLICY)
+$(PKG_CHROME): $(TMP_CHROME)
+	$(PKG_BUILD) --root $< --identifier ee.ria.$@ $@.pkg
 
-signed: codesign
-	$(PKG_BUILD_SIGNED) --root $(TMP_CHROME) --identifier ee.ria.token-signing-chrome $(PKG_CHROME)
-	$(PKG_BUILD_SIGNED) --root $(TMP_FIREFOX) --identifier ee.ria.token-signing-firefox $(PKG_FIREFOX)
-	mkdir -p $(POLICYROOT) $(POLICYSIGNED)
-	cp scripts/postinstall $(POLICYSIGNED)
-	security cms -S -N "Developer ID Application: $(SIGNER)" -i scripts/force-install.plist -o $(POLICYSIGNED)/force-install.plist
-	$(PKG_BUILD_SIGNED) --root $(POLICYROOT) --identifier ee.ria.token-signing-chrome-policy --scripts $(POLICYSIGNED) $(POLICY)
+$(PKG_FIREFOX): $(TMP_FIREFOX)
+	$(PKG_BUILD) --root $< --identifier ee.ria.$@ --scripts scripts_firefox $@.pkg
 
-# helpers
+$(PKG_POLICY): $(TMP_POLICY)
+	$(PKG_BUILD) --root $< --identifier ee.ria.$@ --scripts scripts_policy $@.pkg
 
-separate:
-	mkdir -p $(TMP_CHROME)/$(NATIVE_PATH) $(TMP_CHROME)/$(EXTERNAL_PATH)
-	cp -R $(TARGET) $(TMP_CHROME)/$(NATIVE_PATH)
-	cp -v ee.ria.esteid.json $(TMP_CHROME)/$(NATIVE_PATH)
-	cp -v ../ckjefchnfjhjfedoccjbhjpbncimppeg.json $(TMP_CHROME)/$(EXTERNAL_PATH)
-	mkdir -p $(TMP_FIREFOX)/$(NATIVE_PATH) $(TMP_FIREFOX)/$(FIREFOX_PATH) $(TMP_FIREFOX)/$(FFEXTENSION_PATH)
-	cp -R $(TARGET) $(TMP_FIREFOX)/$(NATIVE_PATH)
-	cp -v ee.ria.esteid.firefox.json $(TMP_FIREFOX)/$(FIREFOX_PATH)/ee.ria.esteid.json
-	cp -v ../{443830f0-1fff-4f9a-aa1e-444bafbc7319}.xpi $(TMP_FIREFOX)/$(FFEXTENSION_PATH)
+pkg: $(PKG_CHROME) $(PKG_FIREFOX) $(PKG_POLICY)
+
+signed: codesign $(TMP_CHROME) $(TMP_FIREFOX) $(TMP_POLICY)
+	$(PKG_BUILD_SIGNED) --root $(TMP_CHROME) --identifier ee.ria.$(PKG_CHROME) $(PKG_CHROME).pkg
+	$(PKG_BUILD_SIGNED) --root $(TMP_FIREFOX) --identifier ee.ria.$(PKG_FIREFOX) --scripts scripts_firefox $(PKG_FIREFOX).pkg
+	mkdir -p $(TMP_POLICY_SIGNED)
+	cp scripts_policy/postinstall $(TMP_POLICY_SIGNED)
+	security cms -S -N "Developer ID Application: $(SIGNER)" -i scripts_policy/force-install.plist -o $(TMP_POLICY_SIGNED)/force-install.plist
+	$(PKG_BUILD_SIGNED) --root $(TMP_POLICY) --identifier ee.ria.$(PKG_POLICY) --scripts $(TMP_POLICY_SIGNED) $(PKG_POLICY).pkg
+
+# helpers
 
 install:
-	mkdir -p $(NATIVE_PATH) $(FIREFOX_PATH) $(FFEXTENSION_PATH) $(EXTERNAL_PATH)
-	cp -rv build/Release/chrome-token-signing.app $(NATIVE_PATH)
-	cp -v ee.ria.esteid.json $(NATIVE_PATH)
-	cp -v ee.ria.esteid.firefox.json $(FIREFOX_PATH)/ee.ria.esteid.json
-	cp -v ../{443830f0-1fff-4f9a-aa1e-444bafbc7319}.xpi $(FFEXTENSION_PATH)
-	cp -v ../ckjefchnfjhjfedoccjbhjpbncimppeg.json $(EXTERNAL_PATH)
+	$(PROJ)
+	mkdir -p $(PATH_NATIVE) $(PATH_FIREFOX) $(PATH_EXTERNAL)
+	cp -rv build/Release/chrome-token-signing.app $(PATH_NATIVE)
+	cp -v ee.ria.esteid.json $(PATH_NATIVE)
+	cp -v ee.ria.esteid.firefox.json $(PATH_FIREFOX)/ee.ria.esteid.json
+	cp -v ../ckjefchnfjhjfedoccjbhjpbncimppeg.json $(PATH_EXTERNAL)
+	cp -v org.mozilla.firefox.plist $(PATH_PREFERENCES)/
 
 uninstall:
-	rm -f $(EXTERNAL_PATH)/ckjefchnfjhjfedoccjbhjpbncimppeg.json
-	rm -f $(NATIVE_PATH)/ee.ria.esteid.json
-	rm -f $(FIREFOX_PATH)/ee.ria.esteid.json
-	rm -f $(FFEXTENSION_PATH)/{443830f0-1fff-4f9a-aa1e-444bafbc7319}.xpi
-	rm -rf $(NATIVE_PATH)/chrome-token-signing.app
+	rm -f $(PATH_EXTERNAL)/ckjefchnfjhjfedoccjbhjpbncimppeg.json
+	rm -f $(PATH_NATIVE)/ee.ria.esteid.json
+	rm -f $(PATH_FIREFOX)/ee.ria.esteid.json
+	rm -rf $(PATH_NATIVE)/chrome-token-signing.app
+	rm -f $(PATH_PREFERENCES)/org.mozilla.firefox.plist
 
 test:
 	python ../host-test/stateless-test.py $(TARGET)/Contents/MacOS/chrome-token-signing

host-osx/chrome-token-signing.xcodeproj/project.pbxproj

@@ -3,7 +3,7 @@
 	archiveVersion = 1;
 	classes = {
 	};
-	objectVersion = 48;
+	objectVersion = 51;
 	objects = {
 
 /* Begin PBXBuildFile section */
@@ -207,7 +207,7 @@
 		4E532CD81A96379500D28E40 /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				LastUpgradeCheck = 0930;
+				LastUpgradeCheck = 1120;
 				ORGANIZATIONNAME = RIA;
 				TargetAttributes = {
 					4E532CDF1A96379500D28E40 = {
@@ -222,7 +222,7 @@
 				};
 			};
 			buildConfigurationList = 4E532CDB1A96379500D28E40 /* Build configuration list for PBXProject "chrome-token-signing" */;
-			compatibilityVersion = "Xcode 8.0";
+			compatibilityVersion = "Xcode 10.0";
 			developmentRegion = en;
 			hasScannedForEncodings = 0;
 			knownRegions = (
@@ -264,7 +264,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 1;
 			shellPath = /bin/sh;
-			shellScript = "EXTERNAL_PATH=${INSTALL_ROOT}/Library/Application\\ Support/Google/Chrome/External\\ Extensions\nNATIVE_PATH=${INSTALL_ROOT}/Library/Google/Chrome/NativeMessagingHosts\nFIREFOX_PATH=${INSTALL_ROOT}/Library/Application\\ Support/Mozilla/NativeMessagingHosts\nFFEXTENSION_PATH=${INSTALL_ROOT}/Library/Application\\ Support/Mozilla/Extensions/\\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\\}\nmkdir -p \"${NATIVE_PATH}\" \"${EXTERNAL_PATH}\" \"${FIREFOX_PATH}\" \"${FFEXTENSION_PATH}\"\ncp ${SRCROOT}/ee.ria.esteid.json \"${NATIVE_PATH}\"\ncp ${SRCROOT}/ee.ria.esteid.firefox.json \"${FIREFOX_PATH}/ee.ria.esteid.json\"\ncp ${SRCROOT}/../ckjefchnfjhjfedoccjbhjpbncimppeg.json \"${EXTERNAL_PATH}\"\ncp ${SRCROOT}/../{443830f0-1fff-4f9a-aa1e-444bafbc7319}.xpi \"${FFEXTENSION_PATH}\"";
+			shellScript = "EXTERNAL_PATH=${INSTALL_ROOT}/Library/Application\\ Support/Google/Chrome/External\\ Extensions\nNATIVE_PATH=${INSTALL_ROOT}/Library/Google/Chrome/NativeMessagingHosts\nFIREFOX_PATH=${INSTALL_ROOT}/Library/Application\\ Support/Mozilla/NativeMessagingHosts\nPREFERENCES_PATH=${INSTALL_ROOT}/Library/Preferences\nmkdir -p \"${NATIVE_PATH}\" \"${EXTERNAL_PATH}\" \"${FIREFOX_PATH}\" \"${PREFERENCES_PATH}\"\ncp ${SRCROOT}/ee.ria.esteid.json \"${NATIVE_PATH}\"\ncp ${SRCROOT}/ee.ria.esteid.firefox.json \"${FIREFOX_PATH}/ee.ria.esteid.json\"\ncp ${SRCROOT}/../ckjefchnfjhjfedoccjbhjpbncimppeg.json \"${EXTERNAL_PATH}\"\ncp ${SRCROOT}/org.mozilla.firefox.plist \"${PREFERENCES_PATH}\"\n";
 			showEnvVarsInLog = 0;
 		};
 /* End PBXShellScriptBuildPhase section */
@@ -290,7 +290,6 @@
 		4E532CFB1A96379500D28E40 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				BUILD_NUMBER = 0;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -317,7 +316,9 @@
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				CODE_SIGN_IDENTITY = "-";
 				COPY_PHASE_STRIP = NO;
+				CURRENT_PROJECT_VERSION = 0;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
@@ -335,16 +336,15 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 10.11;
+				MARKETING_VERSION = 1.1.1;
 				ONLY_ACTIVE_ARCH = YES;
 				SDKROOT = macosx;
-				VERSION = 1.1.0;
 			};
 			name = Debug;
 		};
 		4E532CFC1A96379500D28E40 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				BUILD_NUMBER = 0;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -371,7 +371,9 @@
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				CODE_SIGN_IDENTITY = "-";
 				CODE_SIGN_INJECT_BASE_ENTITLEMENTS = NO;
+				CURRENT_PROJECT_VERSION = 0;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
@@ -384,9 +386,9 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 10.11;
+				MARKETING_VERSION = 1.1.1;
 				OTHER_CODE_SIGN_FLAGS = "--timestamp --options=runtime";
 				SDKROOT = macosx;
-				VERSION = 1.1.0;
 			};
 			name = Release;
 		};

host-osx/org.mozilla.firefox.plist

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>EnterprisePoliciesEnabled</key>
+	<true/>
+	<key>Extensions</key>
+	<dict>
+		<key>Install</key>
+		<array>
+			<string>https://addons.mozilla.org/firefox/downloads/file/3441541/token_signing-0.0.31-fx.xpi</string>
+		</array>
+	</dict>
+</dict>
+</plist>

host-osx/scripts_firefox/postinstall

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+PLIST=/Library/Preferences/org.mozilla.firefox.plist
+UUID="{443830f0-1fff-4f9a-aa1e-444bafbc7319}"
+URL=https://addons.mozilla.org/firefox/downloads/latest/token-signing2/latest.xpi
+
+defaults write ${PLIST} EnterprisePoliciesEnabled -bool true
+defaults write ${PLIST} ExtensionSettings -dict-add "'${UUID}'" "{ 'installation_mode' = 'normal_installed'; 'install_url' = '${URL}'; }"

host-windows/chrome-token-signing.props

@@ -4,7 +4,7 @@
   <PropertyGroup Label="UserMacros">
     <MAJOR_VERSION>1</MAJOR_VERSION>
     <MINOR_VERSION>1</MINOR_VERSION>
-    <RELEASE_VERSION>0</RELEASE_VERSION>
+    <RELEASE_VERSION>1</RELEASE_VERSION>
     <BUILD_NUMBER>0</BUILD_NUMBER>
   </PropertyGroup>
   <PropertyGroup>

host-windows/chrome-token-signing.wxs

@@ -44,6 +44,14 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
     <Property Id="FORCEINSTALL" Value="1"/>
     <Property Id="CHROMEINSTALL" Value="1"/>
     <Property Id="FIREFOXINSTALL" Value="1"/>
+    <!-- https://github.com/open-eid/windows-installer/blob/master/FirefoxActionWix/README.md -->
+    <Binary Id="FirefoxAction.CA.dll" SourceFile="host-windows\FirefoxAction.CA.dll" />
+    <CustomAction Id="ExtensionSettingsInstall" Return="check" Execute="firstSequence"
+      BinaryKey="FirefoxAction.CA.dll" DllEntry="ExtensionSettingsInstall" />
+    <CustomAction Id="ExtensionSettingsRemove" Return="check" Execute="firstSequence"
+      BinaryKey="FirefoxAction.CA.dll" DllEntry="ExtensionSettingsRemove" />
+    <Property Id="EXTENSIONSETTINGS_URL" Value="https://addons.mozilla.org/firefox/downloads/latest/token-signing2/latest.xpi" />
+    <Property Id="EXTENSIONSETTINGS_UUID" Value="{443830f0-1fff-4f9a-aa1e-444bafbc7319}" />
     <MajorUpgrade AllowSameVersionUpgrades="yes" DowngradeErrorMessage=
       "A newer version of [ProductName] is already installed. If you are trying to downgrade, please uninstall the newer version first."/>
     <Condition Message="[ProductName] requires Windows 7 or higher.">
@@ -69,9 +77,6 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
           <Component Id="FirefoxApplication" Guid="8c52d631-7da9-46d3-89c6-8248f94fa25c" Transitive="yes" >
             <Condition><![CDATA[(FIREFOXINSTALL = 1)]]></Condition>
             <File Source="host-windows/ee.ria.esteid.firefox.json"/>
-            <File Source="{443830f0-1fff-4f9a-aa1e-444bafbc7319}.xpi"/>
-            <RegistryValue Root="HKLM" Type="string" Value="[APPLICATIONFOLDER]\{443830f0-1fff-4f9a-aa1e-444bafbc7319}.xpi"	
-                Key="SOFTWARE\Mozilla\Firefox\Extensions" Name="{443830f0-1fff-4f9a-aa1e-444bafbc7319}" />
           </Component>
           <Component Id="ForceInstall" Guid="b02ebb46-a515-4821-82af-29f8c6073544" Win64="no" Transitive="yes">
             <Condition><![CDATA[(FORCEINSTALL = 1 AND CHROMEINSTALL = 1)]]></Condition>
@@ -81,29 +86,24 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
           </Component>
         </Directory>
       </Directory>
-<?if $(var.Platform) = "x64" ?>
-      <Component Id="Firefox_X64" Win64="yes" Transitive="yes" >
-        <Condition><![CDATA[(FIREFOXINSTALL = 1)]]></Condition>
-        <RegistryValue Root="HKLM" Type="string" Value="[APPLICATIONFOLDER]\{443830f0-1fff-4f9a-aa1e-444bafbc7319}.xpi"
-            Key="SOFTWARE\Mozilla\Firefox\Extensions" Name="{443830f0-1fff-4f9a-aa1e-444bafbc7319}" />
-      </Component>
-<?endif ?>
       <Component Id="Firefox" Guid="60c6e502-529b-4d28-9e92-4cdbf1176afb" Win64="$(var.Win64)" Transitive="yes" >
         <Condition><![CDATA[(FIREFOXINSTALL = 1)]]></Condition>
         <RegistryValue Root='HKLM' Type='string' Value='[APPLICATIONFOLDER]ee.ria.esteid.firefox.json'
             Key='SOFTWARE\Mozilla\NativeMessagingHosts\ee.ria.esteid' />
       </Component>
     </Directory>
 
+    <InstallExecuteSequence>
+      <Custom Action="ExtensionSettingsInstall" Before="WriteRegistryValues">NOT Installed</Custom>
+      <Custom Action="ExtensionSettingsRemove" Before="InstallFinalize">Installed AND NOT UPGRADINGPRODUCTCODE</Custom>
+    </InstallExecuteSequence>
+
     <Feature Id="Install" Level="1" Title="Chrome Token Signing" Display="expand" ConfigurableDirectory="APPLICATIONFOLDER">
       <ComponentRef Id="Application"/>
       <ComponentRef Id="ForceInstall"/>
       <ComponentRef Id="Firefox"/>
       <ComponentRef Id="FirefoxApplication"/>
       <ComponentRef Id="Chrome"/>
-<?if $(var.Platform) = "x64" ?>
-      <ComponentRef Id="Firefox_X64"/>
-<?endif ?>
     </Feature>
   </Product>
 </Wix>