Are Extension IDs static?

[Joshua Deltener]

Does anyone know if extension IDs are static? For example, if I
upload an extension to google and they assign it an ID, will everyone
on the planet see that ID in their extension tab when they install
it?

Example: I have 2 extensions, one needs to talk to the other, but
needs the ID to do so. If the ID for the target extension will always
be XYZ and never ever change then I don't need the user to enter the
ID for the sending extension..

[Aaron Boodman]

On Thu, Mar 18, 2010 at 2:51 PM, Joshua Deltener <heckt...@gmail.com> wrote:
> Does anyone know if extension IDs are static?  For example, if I
> upload an extension to google and they assign it an ID, will everyone
> on the planet see that ID in their extension tab when they install
> it?

Yes, the extension IDs in the gallery are permanently and globally
assigned per-extension.

- a

[Joshua Deltener]

SWEEEET. Is there any documentation about IDs and how they are
generated or is that a google secret :B

[Matt Mastracci]

Extension IDs are effectively a hash of a public key used to sign the extension. The extension gallery (or yourself if you self-sign) holds the private key. The public key is tacked on to the start of the extension .crx as seen below. Chrome hashes the public key and uses that to determine if you are installing a new extension or replacing an existing one:

| version (2) | DER-format public key | signature | zip file |

http://en.wikipedia.org/wiki/Public-key_cryptography

On 2010-03-18, at 3:55 PM, Joshua Deltener wrote:

> SWEEEET. Is there any documentation about IDs and how they are
> generated or is that a google secret :B
>

> --
> You received this message because you are subscribed to the Google Groups "Chromium-extensions" group.
> To post to this group, send email to chromium-...@chromium.org.
> To unsubscribe from this group, send email to chromium-extens...@chromium.org.
> For more options, visit this group at http://groups.google.com/a/chromium.org/group/chromium-extensions/?hl=en.
>

[Mark Wubben]

I posted about deriving the extension ID from the private key here:

<http://supercollider.dk/2010/01/calculating-chrome-extension-id-from-your-private-key-233>

On Mar 18, 2010, at 22:55 , Joshua Deltener wrote:

> SWEEEET. Is there any documentation about IDs and how they are
> generated or is that a google secret :B
>

> --
> You received this message because you are subscribed to the Google Groups "Chromium-extensions" group.
> To post to this group, send email to chromium-...@chromium.org.
> To unsubscribe from this group, send email to chromium-extens...@chromium.org.
> For more options, visit this group at http://groups.google.com/a/chromium.org/group/chromium-extensions/?hl=en.
>

--
Mark Wubben

http://supercollider.dk

[Aaron Boodman]

I'm not sure if there's a part of the docs that deals specifically
with the background about how IDs are generated, but I think it would
be interesting for certain users.

Part of the CRX packaging process is associating an extension with a
key pair (http://en.wikipedia.org/wiki/Public-key_cryptography). The
public key is the extension's unique identity; it is reused across all
versions of the extension. Since the public key is so long, though, we
usually use a short form of it created by hashing it. This short ID is
the one you see in the management page and is used with APIs like
chrome.extension.connect().

Each CRX is signed with it's private key, and Chrome verifies this
during installation. This enforces that an ID is only used by its
owner. One cool result of this is that nobody can reuse an ID
accidentally or maliciously unless they know the corresponding private
key.

Typically, extension developers don't deal with these details because
the gallery creates a key pair for each extension and does the signing
internally.

If you're curious you can see what's going on at a lower level by
creating CRX files manually, following these instructions:

http://code.google.com/chrome/extensions/packaging.html

- a

On Thu, Mar 18, 2010 at 2:55 PM, Joshua Deltener <heckt...@gmail.com> wrote:
> SWEEEET.  Is there any documentation about IDs and how they are
> generated or is that a google secret :B
>