senofy/autofirmer-expanded
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Linux needs no enrolment - it never did

Browse Source 
The managed-device requirement is documented for Windows and macOS only, and a
Pi proved it: aarch64 Chromium fetched updates.xml with installedby=policy and
installed the CRX from a plain /etc policy file, with no enrolment, no Google
account and no Chrome. So setup-linux.sh writes the policy directly for
whichever browsers are present, and enrolment is a Windows concern again.

That also retires the ARM special case. Chromium could not be enrolled, which I
read as Chromium not being able to install this at all; the two are unrelated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
2026-08-31 17:31:18 -05:00
co-authored by Claude Opus 5
parent d14bcdeed3
commit 458d667ca6
2 changed files with 33 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -15
View File
@@ -139,7 +139,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-manage
``` ```
```bash ```bash
sudo scripts/enroll-chrome-management.sh sudo scripts/install-extension-policy.sh
``` ```
The enrolment token is built into both scripts — a token is reusable across any The enrolment token is built into both scripts — a token is reusable across any
@@ -149,21 +149,21 @@ from Google's own enterprise MSI on Windows and the official .deb on Linux;
Chromium is not accepted as a substitute, because it has no cloud-management Chromium is not accepted as a substitute, because it has no cloud-management
support and can never be enrolled. support and can never be enrolled.
**On a Raspberry Pi, none of that applies.** Google publishes Chrome for x86_64 **A Raspberry Pi needs none of it.** Chrome is not published for ARM, but
only, so an ARM box has Chromium and nothing else, and Chromium cannot be Chromium is, and on Linux Chromium honours the same forcelist policy — the CRX
enrolled. There the extension is loaded unpacked — `chrome://extensions` → is pure JavaScript, so the architecture is irrelevant. `setup-linux.sh` writes
Developer mode → Load unpacked → `extension/` — and updates still arrive, the policy and Chromium installs the extension from the update server on its
because an unpacked copy reloads itself from disk when the dashboard reports a next start. Loading `extension/` unpacked still works and still self-reloads,
newer version. `setup-linux.sh` detects the architecture and says so rather than but it is no longer the only option there.
offering an enrolment that cannot work.
**Enrolment is not optional.** No Chromium browser will force-install an **Enrolment is a Windows problem only.** Windows refuses to force-install an
off-store extension on an unmanaged machine, whatever the registry says — it off-store extension unless the machine is domain-joined, Entra-joined or
reads the policy and blanks it. Enrolling is what makes Chrome managed without enrolled in Chrome Enterprise Core — it reads the policy and blanks it — and
joining a domain; Edge cannot be used this way at all. `install-extension-policy` macOS wants MDM. Linux has no such requirement: a policy file under `/etc` is
is still there for a genuinely domain-joined machine, where local policy is enough, which is why a Raspberry Pi running Chromium installs this with no
honoured. See [deploy/README.md](deploy/README.md). Either way the extension Google account involved at all. On Linux, run `install-extension-policy.sh` and
notices when skip enrolment entirely. See [deploy/README.md](deploy/README.md). Either way the
extension notices when
the dashboard is running newer code than it is: a policy install asks Chrome to the dashboard is running newer code than it is: a policy install asks Chrome to
fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload
icon on its card still works and is the thing to try when something looks icon on its card still works and is the thing to try when something looks
setup-linux.sh
+16 -30
View File
@@ -147,32 +147,23 @@ fi
# console already set to force install. The token file lives under /etc, hence # console already set to force install. The token file lives under /etc, hence
# sudo. # sudo.
echo echo
EXTPOLICY=0 # A policy file and nothing else. The managed-device requirement that makes this
if [ "$(uname -m)" != "x86_64" ]; then # hard on Windows - domain join, Entra, Chrome Enterprise Core - is documented
# A Pi, or anything else ARM. Google publishes Chrome for x86_64 only, and # for Windows and macOS only; Linux has no equivalent. So a plain Pi running
# Chromium - the browser that is available here - has no cloud management, # Chromium force-installs the extension from our update server with no
# so it cannot be enrolled and can never force-install an off-store # enrolment, no Google account, and no Chrome. Verified on aarch64 Chromium.
# extension. Unpacked is not a downgrade to be apologised for on this info "[7/7] Browser extension"
# machine; it is the only thing that works, and it still updates itself. info " Installs it from the update server into whichever of Chrome,"
info "[7/7] Chrome extension" info " Chromium, Edge and Brave are here, and lets them keep it updated."
info " Chrome is not published for $(uname -m), and Chromium cannot be" info " Needs sudo - browser policy lives under /etc."
info " enrolled - so on this machine the extension is loaded unpacked."
info " It still reloads itself from disk when the dashboard reports a"
info " newer version, so updates arrive without clicking anything."
EXTPOLICY=2
else
info "[7/7] Chrome extension"
info " Enrols this machine's Chrome, after which the extension installs"
info " itself from the Admin console and stays updated on its own."
info " Installs Chrome first if it is not here yet. Needs sudo."
read -r -p " Set this up now? [Y/n] " DOEXT read -r -p " Set this up now? [Y/n] " DOEXT
EXTPOLICY=0
if [ "${DOEXT,,}" != "n" ]; then if [ "${DOEXT,,}" != "n" ]; then
if sudo bash scripts/enroll-chrome-management.sh; then EXTPOLICY=1; else if sudo bash scripts/install-extension-policy.sh; then EXTPOLICY=1; else
warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh" warn "extension policy failed - re-run: sudo scripts/install-extension-policy.sh"
fi fi
else else
info " Skipped. Run: sudo scripts/enroll-chrome-management.sh" info " Skipped. Run: sudo scripts/install-extension-policy.sh"
fi
fi fi
# ── summary ───────────────────────────────────────────────────────────────── # ── summary ─────────────────────────────────────────────────────────────────
@@ -195,15 +186,10 @@ fi
echo echo
info "Still manual:" info "Still manual:"
if [ "$EXTPOLICY" -eq 1 ]; then if [ "$EXTPOLICY" -eq 1 ]; then
info " - Restart Chrome. chrome://management should name your organisation," info " - Restart the browser. The extension installs itself from"
info " and the extension installs itself within a minute or two." info " https://ext.juicerroom.com within a minute or two."
elif [ "$EXTPOLICY" -eq 2 ]; then
info " - Load the extension in Chromium: chrome://extensions ->"
info " Developer mode -> Load unpacked -> $TARGET/extension"
info " (after that it reloads itself when an update lands)"
else else
info " - Enrol Chrome so it can install the extension:" info " - Install the extension: sudo scripts/install-extension-policy.sh"
info " sudo scripts/enroll-chrome-management.sh"
fi fi
info " - Add your firm credentials on the dashboard's Settings page" info " - Add your firm credentials on the dashboard's Settings page"
if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then