Linux needs no enrolment - it never did
The managed-device requirement is documented for Windows and macOS only, and a Pi proved it: aarch64 Chromium fetched updates.xml with installedby=policy and installed the CRX from a plain /etc policy file, with no enrolment, no Google account and no Chrome. So setup-linux.sh writes the policy directly for whichever browsers are present, and enrolment is a Windows concern again. That also retires the ARM special case. Chromium could not be enrolled, which I read as Chromium not being able to install this at all; the two are unrelated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Brandon Li
co-authored by
Claude Opus 5
Claude Opus 5
parent
d14bcdeed3
commit
458d667ca6
@@ -139,7 +139,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-manage
|
||||
```
|
||||
|
||||
```bash
|
||||
sudo scripts/enroll-chrome-management.sh
|
||||
sudo scripts/install-extension-policy.sh
|
||||
```
|
||||
|
||||
The enrolment token is built into both scripts — a token is reusable across any
|
||||
@@ -149,21 +149,21 @@ from Google's own enterprise MSI on Windows and the official .deb on Linux;
|
||||
Chromium is not accepted as a substitute, because it has no cloud-management
|
||||
support and can never be enrolled.
|
||||
|
||||
**On a Raspberry Pi, none of that applies.** Google publishes Chrome for x86_64
|
||||
only, so an ARM box has Chromium and nothing else, and Chromium cannot be
|
||||
enrolled. There the extension is loaded unpacked — `chrome://extensions` →
|
||||
Developer mode → Load unpacked → `extension/` — and updates still arrive,
|
||||
because an unpacked copy reloads itself from disk when the dashboard reports a
|
||||
newer version. `setup-linux.sh` detects the architecture and says so rather than
|
||||
offering an enrolment that cannot work.
|
||||
**A Raspberry Pi needs none of it.** Chrome is not published for ARM, but
|
||||
Chromium is, and on Linux Chromium honours the same forcelist policy — the CRX
|
||||
is pure JavaScript, so the architecture is irrelevant. `setup-linux.sh` writes
|
||||
the policy and Chromium installs the extension from the update server on its
|
||||
next start. Loading `extension/` unpacked still works and still self-reloads,
|
||||
but it is no longer the only option there.
|
||||
|
||||
**Enrolment is not optional.** No Chromium browser will force-install an
|
||||
off-store extension on an unmanaged machine, whatever the registry says — it
|
||||
reads the policy and blanks it. Enrolling is what makes Chrome managed without
|
||||
joining a domain; Edge cannot be used this way at all. `install-extension-policy`
|
||||
is still there for a genuinely domain-joined machine, where local policy is
|
||||
honoured. See [deploy/README.md](deploy/README.md). Either way the extension
|
||||
notices when
|
||||
**Enrolment is a Windows problem only.** Windows refuses to force-install an
|
||||
off-store extension unless the machine is domain-joined, Entra-joined or
|
||||
enrolled in Chrome Enterprise Core — it reads the policy and blanks it — and
|
||||
macOS wants MDM. Linux has no such requirement: a policy file under `/etc` is
|
||||
enough, which is why a Raspberry Pi running Chromium installs this with no
|
||||
Google account involved at all. On Linux, run `install-extension-policy.sh` and
|
||||
skip enrolment entirely. See [deploy/README.md](deploy/README.md). Either way the
|
||||
extension notices when
|
||||
the dashboard is running newer code than it is: a policy install asks Chrome to
|
||||
fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload
|
||||
icon on its card still works and is the thing to try when something looks
|
||||
|
||||
+16
-30
@@ -147,32 +147,23 @@ fi
|
||||
# console already set to force install. The token file lives under /etc, hence
|
||||
# sudo.
|
||||
echo
|
||||
EXTPOLICY=0
|
||||
if [ "$(uname -m)" != "x86_64" ]; then
|
||||
# A Pi, or anything else ARM. Google publishes Chrome for x86_64 only, and
|
||||
# Chromium - the browser that is available here - has no cloud management,
|
||||
# so it cannot be enrolled and can never force-install an off-store
|
||||
# extension. Unpacked is not a downgrade to be apologised for on this
|
||||
# machine; it is the only thing that works, and it still updates itself.
|
||||
info "[7/7] Chrome extension"
|
||||
info " Chrome is not published for $(uname -m), and Chromium cannot be"
|
||||
info " enrolled - so on this machine the extension is loaded unpacked."
|
||||
info " It still reloads itself from disk when the dashboard reports a"
|
||||
info " newer version, so updates arrive without clicking anything."
|
||||
EXTPOLICY=2
|
||||
else
|
||||
info "[7/7] Chrome extension"
|
||||
info " Enrols this machine's Chrome, after which the extension installs"
|
||||
info " itself from the Admin console and stays updated on its own."
|
||||
info " Installs Chrome first if it is not here yet. Needs sudo."
|
||||
# A policy file and nothing else. The managed-device requirement that makes this
|
||||
# hard on Windows - domain join, Entra, Chrome Enterprise Core - is documented
|
||||
# for Windows and macOS only; Linux has no equivalent. So a plain Pi running
|
||||
# Chromium force-installs the extension from our update server with no
|
||||
# enrolment, no Google account, and no Chrome. Verified on aarch64 Chromium.
|
||||
info "[7/7] Browser extension"
|
||||
info " Installs it from the update server into whichever of Chrome,"
|
||||
info " Chromium, Edge and Brave are here, and lets them keep it updated."
|
||||
info " Needs sudo - browser policy lives under /etc."
|
||||
read -r -p " Set this up now? [Y/n] " DOEXT
|
||||
EXTPOLICY=0
|
||||
if [ "${DOEXT,,}" != "n" ]; then
|
||||
if sudo bash scripts/enroll-chrome-management.sh; then EXTPOLICY=1; else
|
||||
warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh"
|
||||
if sudo bash scripts/install-extension-policy.sh; then EXTPOLICY=1; else
|
||||
warn "extension policy failed - re-run: sudo scripts/install-extension-policy.sh"
|
||||
fi
|
||||
else
|
||||
info " Skipped. Run: sudo scripts/enroll-chrome-management.sh"
|
||||
fi
|
||||
info " Skipped. Run: sudo scripts/install-extension-policy.sh"
|
||||
fi
|
||||
|
||||
# ── summary ─────────────────────────────────────────────────────────────────
|
||||
@@ -195,15 +186,10 @@ fi
|
||||
echo
|
||||
info "Still manual:"
|
||||
if [ "$EXTPOLICY" -eq 1 ]; then
|
||||
info " - Restart Chrome. chrome://management should name your organisation,"
|
||||
info " and the extension installs itself within a minute or two."
|
||||
elif [ "$EXTPOLICY" -eq 2 ]; then
|
||||
info " - Load the extension in Chromium: chrome://extensions ->"
|
||||
info " Developer mode -> Load unpacked -> $TARGET/extension"
|
||||
info " (after that it reloads itself when an update lands)"
|
||||
info " - Restart the browser. The extension installs itself from"
|
||||
info " https://ext.juicerroom.com within a minute or two."
|
||||
else
|
||||
info " - Enrol Chrome so it can install the extension:"
|
||||
info " sudo scripts/enroll-chrome-management.sh"
|
||||
info " - Install the extension: sudo scripts/install-extension-policy.sh"
|
||||
fi
|
||||
info " - Add your firm credentials on the dashboard's Settings page"
|
||||
if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then
|
||||
|
||||
Reference in New Issue
Block a user