senofy/autofirmer-expanded
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enrol Chrome from the installers, and drop load-unpacked

Browse Source 
Both setup scripts ended by telling you to load the folder unpacked, which is
the one install that cannot update itself - and the policy install they moved
to next does nothing on an unmanaged machine. Enrolment is the step that
actually matters: with it, the extension arrives from the Admin console already
force-installed, and there is nothing else to configure on the box.

So step 7 now asks for an enrolment token instead. The Windows script elevates
itself for it - the token is machine-scoped, and that is the only UAC prompt in
the whole install.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
2026-08-31 16:14:14 -05:00
co-authored by Claude Opus 5
parent 95c073d4c2
commit 35dd15d584
4 changed files with 82 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -16
View File
@@ -126,30 +126,29 @@ Automations are declared in `lib/automations.ts` — one entry per firm, with th
steps inside. Adding a button means editing that file; the page and the runner steps inside. Adding a button means editing that file; the page and the runner
pick it up from the server. pick it up from the server.
### 1. Load the extension ### 1. Install the extension
`chrome://extensions` → enable **Developer mode** → **Load unpacked** → The setup scripts do this as their last step: give them the Chrome Enterprise
select the `extension` folder. Core enrolment token from the Admin console (Devices → Chrome → Managed
browsers) and they enrol this machine's Chrome. The extension then arrives from
That is the development install. On a machine that just runs trades, install it the console already set to force install, and Chrome keeps it updated. Run on
from our own update server instead, and Chrome keeps it updated by itself — the its own at any time:
setup scripts offer this as their last step, and it can be run on its own at any
time:
```powershell ```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1 -Token <token>
``` ```
```bash ```bash
sudo scripts/install-extension-policy.sh sudo scripts/enroll-chrome-management.sh <token>
``` ```
**This only works on an enterprise-managed machine** — domain-joined, **Enrolment is not optional.** No Chromium browser will force-install an
Entra-joined, or enrolled in Chrome Enterprise Core. No Chromium browser will off-store extension on an unmanaged machine, whatever the registry says — it
force-install an off-store extension on an ordinary PC, whatever the registry reads the policy and blanks it. Enrolling is what makes Chrome managed without
says; the scripts check and refuse rather than leave a dead policy behind. On an joining a domain; Edge cannot be used this way at all. `install-extension-policy`
unmanaged box, load `extension/` unpacked and let it reload itself. See is still there for a genuinely domain-joined machine, where local policy is
[deploy/README.md](deploy/README.md). Either way the extension notices when honoured. See [deploy/README.md](deploy/README.md). Either way the extension
notices when
the dashboard is running newer code than it is: a policy install asks Chrome to the dashboard is running newer code than it is: a policy install asks Chrome to
fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload
icon on its card still works and is the thing to try when something looks icon on its card still works and is the thing to try when something looks
scripts/enroll-chrome-management.ps1
+24 -2
View File
@@ -30,7 +30,11 @@ param(
[switch]$Mandatory, [switch]$Mandatory,
[Parameter(Mandatory = $true, ParameterSetName = 'Remove')] [Parameter(Mandatory = $true, ParameterSetName = 'Remove')]
[switch]$Remove [switch]$Remove,
# Fail instead of asking for elevation. Also the loop-breaker: the elevated
# copy is launched with this set, so it can never spawn another.
[switch]$NoElevate
) )
$ErrorActionPreference = 'Stop' $ErrorActionPreference = 'Stop'
@@ -38,7 +42,25 @@ $ErrorActionPreference = 'Stop'
$identity = [Security.Principal.WindowsIdentity]::GetCurrent() $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole( if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
[Security.Principal.WindowsBuiltInRole]::Administrator)) { [Security.Principal.WindowsBuiltInRole]::Administrator)) {
throw 'Run this from an elevated PowerShell — the enrolment token is machine-level.' if ($NoElevate) {
throw 'Run this from an elevated PowerShell — the enrolment token is machine-level.'
}
# Relaunch elevated rather than making the caller do it. setup-windows.bat
# runs unelevated on purpose — nothing else it does needs admin — so this is
# the one UAC prompt in the whole install, and it is raised here where the
# arguments are already parsed and can be passed on intact.
Write-Host 'Asking for administrator rights — the enrolment token is machine-level.'
$psArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-NoElevate')
if ($Remove) { $psArgs += '-Remove' }
else {
$psArgs += @('-Token', $Token)
if ($Mandatory) { $psArgs += '-Mandatory' }
}
$elevated = Start-Process -FilePath (Get-Process -Id $PID).Path -Verb RunAs -Wait -PassThru `
-ArgumentList $psArgs
exit $elevated.ExitCode
} }
$key = 'HKLM:\SOFTWARE\Policies\Google\Chrome' $key = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
setup-linux.sh
+18 -15
View File
@@ -141,22 +141,25 @@ else
fi fi
# ── 7. extension ──────────────────────────────────────────────────────────── # ── 7. extension ────────────────────────────────────────────────────────────
# Chrome refuses to side-load a CRX and will not update an unpacked folder, so # Chrome will not update an unpacked folder, and only force-installs an off-store
# the extension goes in the way a self-hosted one has to: a managed-policy file # extension on a managed browser. Enrolling in Chrome Enterprise Core is what
# naming our update server. That lives under /etc, hence sudo — there is no # makes this machine's Chrome managed; the extension then arrives from the Admin
# per-user equivalent on Linux. # console already set to force install. The token file lives under /etc, hence
# sudo.
echo echo
info "[7/7] Chrome extension" info "[7/7] Chrome extension"
info " Installs it from the update server and lets Chrome keep it current" info " Enrols this machine's Chrome, after which the extension installs"
info " by itself. Needs sudo - the policy file lives under /etc." info " itself from the Admin console and stays updated on its own."
read -r -p " Set this up now? [Y/n] " DOEXT info " The token is in the Admin console under Devices > Chrome >"
info " Managed browsers. Blank to skip."
read -r -p " Enrollment token: " ENROLTOKEN
EXTPOLICY=0 EXTPOLICY=0
if [ "${DOEXT,,}" != "n" ]; then if [ -n "${ENROLTOKEN:-}" ]; then
if sudo bash scripts/install-extension-policy.sh; then EXTPOLICY=1; else if sudo bash scripts/enroll-chrome-management.sh "$ENROLTOKEN"; then EXTPOLICY=1; else
warn "extension policy failed - load $TARGET/extension unpacked for now" warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh <token>"
fi fi
else else
info " Skipped. Run: sudo scripts/install-extension-policy.sh" info " Skipped. Run: sudo scripts/enroll-chrome-management.sh <token>"
fi fi
# ── summary ───────────────────────────────────────────────────────────────── # ── summary ─────────────────────────────────────────────────────────────────
@@ -179,11 +182,11 @@ fi
echo echo
info "Still manual:" info "Still manual:"
if [ "$EXTPOLICY" -eq 1 ]; then if [ "$EXTPOLICY" -eq 1 ]; then
info " - Restart Chrome, and remove any unpacked copy of the extension" info " - Restart Chrome. chrome://management should name your organisation,"
info " (it shares the same id now, and Chrome will not load both)" info " and the extension installs itself within a minute or two."
else else
info " - Load the Chrome extension: chrome://extensions -> Developer mode" info " - Enrol Chrome so it can install the extension:"
info " -> Load unpacked -> $TARGET/extension" info " sudo scripts/enroll-chrome-management.sh <token>"
fi fi
info " - Add your firm credentials on the dashboard's Settings page" info " - Add your firm credentials on the dashboard's Settings page"
if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then
setup-windows.bat
+25 -23
View File
@@ -325,23 +325,27 @@ set "AUTOSTART=0"
:autostart_done :autostart_done
REM ------------------------------------------------------- extension policy REM ------------------------------------------------------------ extension
REM Chrome refuses to side-load a CRX and will not update an unpacked folder, so REM Chrome refuses to side-load a CRX and will not update an unpacked folder, and
REM the extension is installed the way a self-hosted one has to be: a policy REM it only force-installs an off-store extension on a managed browser. Enrolling
REM entry naming our update server. Written to this user's hive, which needs no REM in Chrome Enterprise Core is what makes this machine's Chrome managed; the
REM elevation - install-extension-policy.ps1 -Scope Machine covers every account. REM extension itself then arrives from the Admin console, already set to force
REM install, with nothing further to configure here.
echo. echo.
echo [7/7] Browser extension echo [7/7] Chrome extension
echo Installs it from the update server into whichever of Chrome, Edge echo Enrols this machine's Chrome, after which the extension installs
echo and Brave are present, and lets them keep it current by themselves. echo itself from the Admin console and stays updated on its own.
echo No administrator rights needed. echo The token is in the Admin console under
set "DOEXT=" echo Devices ^> Chrome ^> Managed browsers. Blank to skip.
set /p "DOEXT= Set this up now? [Y/n] " set "ENROLTOKEN="
if /i "%DOEXT%"=="n" goto :ext_skipped set /p "ENROLTOKEN= Enrollment token: "
powershell -NoProfile -ExecutionPolicy Bypass -File "%TARGET%\scripts\install-extension-policy.ps1" if not defined ENROLTOKEN goto :ext_skipped
REM The token is machine-scoped, so this raises a UAC prompt and only this. The
REM script asks for elevation itself; nothing else in this installer needs it.
powershell -NoProfile -ExecutionPolicy Bypass -File "%TARGET%\scripts\enroll-chrome-management.ps1" -Token "%ENROLTOKEN%"
if errorlevel 1 ( if errorlevel 1 (
echo [!] Extension policy failed. Load %TARGET%\extension unpacked for now, echo [!] Enrolment failed. Re-run scripts\enroll-chrome-management.ps1 with
echo and re-run scripts\install-extension-policy.ps1 to try again. echo a fresh token from the Admin console to try again.
set "EXTPOLICY=0" set "EXTPOLICY=0"
) else ( ) else (
set "EXTPOLICY=1" set "EXTPOLICY=1"
@@ -349,8 +353,8 @@ if errorlevel 1 (
goto :ext_done goto :ext_done
:ext_skipped :ext_skipped
echo Skipped. Run scripts\install-extension-policy.ps1 later, or load echo Skipped. Run scripts\enroll-chrome-management.ps1 -Token ^<token^>
echo %TARGET%\extension unpacked and reload it by hand after updates. echo later; until then this machine gets no extension.
set "EXTPOLICY=0" set "EXTPOLICY=0"
:ext_done :ext_done
@@ -392,13 +396,11 @@ echo Handy : pm2 list ^| pm2 logs autofirmer ^| pm2 logs clicker
echo. echo.
echo Still manual: echo Still manual:
if "%EXTPOLICY%"=="1" ( if "%EXTPOLICY%"=="1" (
echo - Restart Chrome, and remove any unpacked copy of the extension echo - Restart Chrome. chrome://management should name your organisation,
echo ^(it shares the same id now, and Chrome will not load both^) echo and the extension installs itself within a minute or two.
) else ( ) else (
echo - Load the Chrome extension: chrome://extensions, enable Developer echo - Enrol Chrome so it can install the extension:
echo mode, "Load unpacked", select %TARGET%\extension echo scripts\enroll-chrome-management.ps1 -Token ^<token^>
echo ^(loaded that way it reloads itself from disk after a pull;
echo the policy install lets Chrome update it properly^)
) )
echo - Add your firm credentials on the dashboard's Settings page echo - Add your firm credentials on the dashboard's Settings page
echo. echo.