From 458d667ca658a02321721c2b64fc0bc553559f20 Mon Sep 17 00:00:00 2001 From: Brandon Li Date: Mon, 31 Aug 2026 17:31:18 -0500 Subject: [PATCH] Linux needs no enrolment - it never did The managed-device requirement is documented for Windows and macOS only, and a Pi proved it: aarch64 Chromium fetched updates.xml with installedby=policy and installed the CRX from a plain /etc policy file, with no enrolment, no Google account and no Chrome. So setup-linux.sh writes the policy directly for whichever browsers are present, and enrolment is a Windows concern again. That also retires the ARM special case. Chromium could not be enrolled, which I read as Chromium not being able to install this at all; the two are unrelated. Co-Authored-By: Claude Opus 5 --- README.md | 30 +++++++++++++++--------------- setup-linux.sh | 50 ++++++++++++++++++-------------------------------- 2 files changed, 33 insertions(+), 47 deletions(-) diff --git a/README.md b/README.md index c26a247..8e5c37e 100644 --- a/README.md +++ b/README.md @@ -139,7 +139,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-manage ``` ```bash -sudo scripts/enroll-chrome-management.sh +sudo scripts/install-extension-policy.sh ``` The enrolment token is built into both scripts — a token is reusable across any @@ -149,21 +149,21 @@ from Google's own enterprise MSI on Windows and the official .deb on Linux; Chromium is not accepted as a substitute, because it has no cloud-management support and can never be enrolled. -**On a Raspberry Pi, none of that applies.** Google publishes Chrome for x86_64 -only, so an ARM box has Chromium and nothing else, and Chromium cannot be -enrolled. There the extension is loaded unpacked — `chrome://extensions` → -Developer mode → Load unpacked → `extension/` — and updates still arrive, -because an unpacked copy reloads itself from disk when the dashboard reports a -newer version. `setup-linux.sh` detects the architecture and says so rather than -offering an enrolment that cannot work. +**A Raspberry Pi needs none of it.** Chrome is not published for ARM, but +Chromium is, and on Linux Chromium honours the same forcelist policy — the CRX +is pure JavaScript, so the architecture is irrelevant. `setup-linux.sh` writes +the policy and Chromium installs the extension from the update server on its +next start. Loading `extension/` unpacked still works and still self-reloads, +but it is no longer the only option there. -**Enrolment is not optional.** No Chromium browser will force-install an -off-store extension on an unmanaged machine, whatever the registry says — it -reads the policy and blanks it. Enrolling is what makes Chrome managed without -joining a domain; Edge cannot be used this way at all. `install-extension-policy` -is still there for a genuinely domain-joined machine, where local policy is -honoured. See [deploy/README.md](deploy/README.md). Either way the extension -notices when +**Enrolment is a Windows problem only.** Windows refuses to force-install an +off-store extension unless the machine is domain-joined, Entra-joined or +enrolled in Chrome Enterprise Core — it reads the policy and blanks it — and +macOS wants MDM. Linux has no such requirement: a policy file under `/etc` is +enough, which is why a Raspberry Pi running Chromium installs this with no +Google account involved at all. On Linux, run `install-extension-policy.sh` and +skip enrolment entirely. See [deploy/README.md](deploy/README.md). Either way the +extension notices when the dashboard is running newer code than it is: a policy install asks Chrome to fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload icon on its card still works and is the thing to try when something looks diff --git a/setup-linux.sh b/setup-linux.sh index 4b2fbf5..ed71eda 100755 --- a/setup-linux.sh +++ b/setup-linux.sh @@ -147,32 +147,23 @@ fi # console already set to force install. The token file lives under /etc, hence # sudo. echo +# A policy file and nothing else. The managed-device requirement that makes this +# hard on Windows - domain join, Entra, Chrome Enterprise Core - is documented +# for Windows and macOS only; Linux has no equivalent. So a plain Pi running +# Chromium force-installs the extension from our update server with no +# enrolment, no Google account, and no Chrome. Verified on aarch64 Chromium. +info "[7/7] Browser extension" +info " Installs it from the update server into whichever of Chrome," +info " Chromium, Edge and Brave are here, and lets them keep it updated." +info " Needs sudo - browser policy lives under /etc." +read -r -p " Set this up now? [Y/n] " DOEXT EXTPOLICY=0 -if [ "$(uname -m)" != "x86_64" ]; then - # A Pi, or anything else ARM. Google publishes Chrome for x86_64 only, and - # Chromium - the browser that is available here - has no cloud management, - # so it cannot be enrolled and can never force-install an off-store - # extension. Unpacked is not a downgrade to be apologised for on this - # machine; it is the only thing that works, and it still updates itself. - info "[7/7] Chrome extension" - info " Chrome is not published for $(uname -m), and Chromium cannot be" - info " enrolled - so on this machine the extension is loaded unpacked." - info " It still reloads itself from disk when the dashboard reports a" - info " newer version, so updates arrive without clicking anything." - EXTPOLICY=2 -else - info "[7/7] Chrome extension" - info " Enrols this machine's Chrome, after which the extension installs" - info " itself from the Admin console and stays updated on its own." - info " Installs Chrome first if it is not here yet. Needs sudo." - read -r -p " Set this up now? [Y/n] " DOEXT - if [ "${DOEXT,,}" != "n" ]; then - if sudo bash scripts/enroll-chrome-management.sh; then EXTPOLICY=1; else - warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh" - fi - else - info " Skipped. Run: sudo scripts/enroll-chrome-management.sh" +if [ "${DOEXT,,}" != "n" ]; then + if sudo bash scripts/install-extension-policy.sh; then EXTPOLICY=1; else + warn "extension policy failed - re-run: sudo scripts/install-extension-policy.sh" fi +else + info " Skipped. Run: sudo scripts/install-extension-policy.sh" fi # ── summary ───────────────────────────────────────────────────────────────── @@ -195,15 +186,10 @@ fi echo info "Still manual:" if [ "$EXTPOLICY" -eq 1 ]; then - info " - Restart Chrome. chrome://management should name your organisation," - info " and the extension installs itself within a minute or two." -elif [ "$EXTPOLICY" -eq 2 ]; then - info " - Load the extension in Chromium: chrome://extensions ->" - info " Developer mode -> Load unpacked -> $TARGET/extension" - info " (after that it reloads itself when an update lands)" + info " - Restart the browser. The extension installs itself from" + info " https://ext.juicerroom.com within a minute or two." else - info " - Enrol Chrome so it can install the extension:" - info " sudo scripts/enroll-chrome-management.sh" + info " - Install the extension: sudo scripts/install-extension-policy.sh" fi info " - Add your firm credentials on the dashboard's Settings page" if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then