senofy/autofirmer-expanded
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Linux needs no enrolment - it never did

Browse Source 
The managed-device requirement is documented for Windows and macOS only, and a
Pi proved it: aarch64 Chromium fetched updates.xml with installedby=policy and
installed the CRX from a plain /etc policy file, with no enrolment, no Google
account and no Chrome. So setup-linux.sh writes the policy directly for
whichever browsers are present, and enrolment is a Windows concern again.

That also retires the ARM special case. Chromium could not be enrolled, which I
read as Chromium not being able to install this at all; the two are unrelated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
2026-08-31 17:31:18 -05:00
co-authored by Claude Opus 5
parent d14bcdeed3
commit 458d667ca6
2 changed files with 33 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup-linux.sh
+18 -32
View File
@@ -147,32 +147,23 @@ fi
# console already set to force install. The token file lives under /etc, hence
# sudo.
echo
# A policy file and nothing else. The managed-device requirement that makes this
# hard on Windows - domain join, Entra, Chrome Enterprise Core - is documented
# for Windows and macOS only; Linux has no equivalent. So a plain Pi running
# Chromium force-installs the extension from our update server with no
# enrolment, no Google account, and no Chrome. Verified on aarch64 Chromium.
info "[7/7] Browser extension"
info " Installs it from the update server into whichever of Chrome,"
info " Chromium, Edge and Brave are here, and lets them keep it updated."
info " Needs sudo - browser policy lives under /etc."
read -r -p " Set this up now? [Y/n] " DOEXT
EXTPOLICY=0
if [ "$(uname -m)" != "x86_64" ]; then
# A Pi, or anything else ARM. Google publishes Chrome for x86_64 only, and
# Chromium - the browser that is available here - has no cloud management,
# so it cannot be enrolled and can never force-install an off-store
# extension. Unpacked is not a downgrade to be apologised for on this
# machine; it is the only thing that works, and it still updates itself.
info "[7/7] Chrome extension"
info " Chrome is not published for $(uname -m), and Chromium cannot be"
info " enrolled - so on this machine the extension is loaded unpacked."
info " It still reloads itself from disk when the dashboard reports a"
info " newer version, so updates arrive without clicking anything."
EXTPOLICY=2
else
info "[7/7] Chrome extension"
info " Enrols this machine's Chrome, after which the extension installs"
info " itself from the Admin console and stays updated on its own."
info " Installs Chrome first if it is not here yet. Needs sudo."
read -r -p " Set this up now? [Y/n] " DOEXT
if [ "${DOEXT,,}" != "n" ]; then
if sudo bash scripts/enroll-chrome-management.sh; then EXTPOLICY=1; else
warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh"
fi
else
info " Skipped. Run: sudo scripts/enroll-chrome-management.sh"
if [ "${DOEXT,,}" != "n" ]; then
if sudo bash scripts/install-extension-policy.sh; then EXTPOLICY=1; else
warn "extension policy failed - re-run: sudo scripts/install-extension-policy.sh"
fi
else
info " Skipped. Run: sudo scripts/install-extension-policy.sh"
fi
# ── summary ─────────────────────────────────────────────────────────────────
@@ -195,15 +186,10 @@ fi
echo
info "Still manual:"
if [ "$EXTPOLICY" -eq 1 ]; then
info " - Restart Chrome. chrome://management should name your organisation,"
info " and the extension installs itself within a minute or two."
elif [ "$EXTPOLICY" -eq 2 ]; then
info " - Load the extension in Chromium: chrome://extensions ->"
info " Developer mode -> Load unpacked -> $TARGET/extension"
info " (after that it reloads itself when an update lands)"
info " - Restart the browser. The extension installs itself from"
info " https://ext.juicerroom.com within a minute or two."
else
info " - Enrol Chrome so it can install the extension:"
info " sudo scripts/enroll-chrome-management.sh"
info " - Install the extension: sudo scripts/install-extension-policy.sh"
fi
info " - Add your firm credentials on the dashboard's Settings page"
if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then