My extension doesn't properly install/enable when using code --install-extension ...

[cristian-spiescu]

Hi,

Within the team we start VS Code w/ a command line such as code --install-extension ... --install-extension .... This way we ensure that all the team members have a common set of extensions.

I developed an extension, and I wanted to "propagate" it to the team using the same process. However I was surprised to see that the extension was installed:
1/ in some kind of disabled state,
2/ from which I couldn't just click enable

As a workaround, I needed to to this:

BTW: this was the command used (and my extension):

code --install-extension famiprog.featurebook

I couldn't find much resources about this topic. But I suspect something related to trust and trust level. If so, maybe I need to add additional things in the manifest. And/or other actions.

[alefragnani]

Hi @cristian-spiescu ,

I'm not what means this disabled state you are referring to, but maybe it is indeed related to the recent Extension runtime security feature, available starting in January. More details here (https://code.visualstudio.com/updates/v1_97#_trusting-extension-publishers) and here (https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security).

If that's the case, it would require you to update your user settings and add the publisher and/or extension to the allowed list. Something like this:

    "extensions.allowed": {
        "famiprog": true,
    }

More details https://code.visualstudio.com/docs/setup/enterprise#_configure-allowed-extensions

If that's not the case, I would suggest you to try out using the Extensions: Install from VSIX command instead of the command line, to see if your the extension is shown in the same disabled state.

Hope this helps

[cristian-spiescu]

Hi @alefragnani,

Thanks for your answer and links. They are helpful. Some remarks:

1/ actually I was a bit wrong here:

we start VS Code w/ a command line such as code --install-extension ... --install-extension ....

Actually we have such a command line in the file ~/.vscode-server/server-env-setup. I.e. each time the vs code server starts, this command is executed. This file is centralized/propagated to all the PCs of the team. However, I don't think this changes something in the discussion.

2/ The doc says:

Important

When you install extensions by using the VS Code command line, the extension's publisher is not automatically trusted.

So that means that our practice to centralize the extensions cf. 1/: it doesn't work any more. Because if I want to add a new extension (to be propagated to the team, coming from a new publisher) => the extension won't install (i.e. cf. symptoms described in my first post). So the issue is not only for my newly developed extension, but for all extensions that I want to propagate to the team in the future.

3/ I find this sad. That means that I need to complement centralizing ~/.vscode-server/server-env-setup w/ a way to centralize also the file you are mentioning. I investigated this in the past, and I remember this was challenging to have a centralized files merged w/ local files for e.g. settings.

4/ Doing a manual uninstall/install of the extension (w/ the intention to have the publisher accepted): didn't work always. I didn't understand exactly when exactly it worked and when it didn't.

5/ I removed from the command line the section ... --install-extension famiprog.featurebook. After this, I could do an "uninstall/install" of the extension.

6/ Curious: during 5/, I didn't get a popup as described here. But after 5/, the publisher did appear in the list of trusted publishers (seen via command Extensions: Manage Trusted Extensions Publishers).

[alefragnani]

Hi @cristian-spiescu ,

I wonder if the Enterprise support page would help you, specially the Device management section. I mean, based on the documentation, I undersand that configuring AllowedExtensions there would allow extension to be installed without a security warnings.

If even with the Device Management setting you still faces issues, I would suggest you to open a feature request in the VS Code repo, so the team could evaluate your scenario. Maybe the trust feature hasn’t been updated yet to follow that device management settings.

Hope this helps

[cristian-spiescu]

I wonder if the Enterprise support page would help you,

1/ You mean to propagate the allowed extensions via Windows policy. Indeed, this is on the roadmap as thing to try.

2/ We'll also investigate some kind of "merge" mechanism of the settings files. Merge w/ local stuff + stuff from server/centralized to the team. This way, we could propagate extensions.allowed. And additionally other settings that we want to uniformize across the team.

3/ Regarding my 6/ from my last note: we started a new PC w/ a new VS Code w/ no extensions. And the technique w/ CLI (i.e. `code --install-extension ... --install-extension ....) has worked OK for the handful of extensions that we currently use. I'm wondering why in their case, there is no block because the publishers were not explicitly accepted. Maybe some "reputed" publishers are trusted by default?