From d14bcdeed30dd3b628654d33a1e8508e33f51c09 Mon Sep 17 00:00:00 2001 From: Brandon Li Date: Mon, 31 Aug 2026 17:18:14 -0500 Subject: [PATCH] A Pi gets the unpacked path, not a dead end Chrome is x86_64 only on Linux and Chromium cannot be enrolled, so on ARM the enrolment step can never succeed. Removing load-unpacked from the installer left those machines being told to run a script that would refuse - setup now detects the architecture, explains why, and the summary points at the unpacked install, which on that hardware is not a fallback but the only thing that works. It still self-updates. Co-Authored-By: Claude Opus 5 --- README.md | 8 ++++++++ setup-linux.sh | 38 ++++++++++++++++++++++++++++---------- 2 files changed, 36 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 45a49de..c26a247 100644 --- a/README.md +++ b/README.md @@ -149,6 +149,14 @@ from Google's own enterprise MSI on Windows and the official .deb on Linux; Chromium is not accepted as a substitute, because it has no cloud-management support and can never be enrolled. +**On a Raspberry Pi, none of that applies.** Google publishes Chrome for x86_64 +only, so an ARM box has Chromium and nothing else, and Chromium cannot be +enrolled. There the extension is loaded unpacked — `chrome://extensions` → +Developer mode → Load unpacked → `extension/` — and updates still arrive, +because an unpacked copy reloads itself from disk when the dashboard reports a +newer version. `setup-linux.sh` detects the architecture and says so rather than +offering an enrolment that cannot work. + **Enrolment is not optional.** No Chromium browser will force-install an off-store extension on an unmanaged machine, whatever the registry says — it reads the policy and blanks it. Enrolling is what makes Chrome managed without diff --git a/setup-linux.sh b/setup-linux.sh index 186c0ab..4b2fbf5 100755 --- a/setup-linux.sh +++ b/setup-linux.sh @@ -147,18 +147,32 @@ fi # console already set to force install. The token file lives under /etc, hence # sudo. echo -info "[7/7] Chrome extension" -info " Enrols this machine's Chrome, after which the extension installs" -info " itself from the Admin console and stays updated on its own." -info " Installs Chrome first if it is not here yet. Needs sudo." -read -r -p " Set this up now? [Y/n] " DOEXT EXTPOLICY=0 -if [ "${DOEXT,,}" != "n" ]; then - if sudo bash scripts/enroll-chrome-management.sh; then EXTPOLICY=1; else - warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh" - fi +if [ "$(uname -m)" != "x86_64" ]; then + # A Pi, or anything else ARM. Google publishes Chrome for x86_64 only, and + # Chromium - the browser that is available here - has no cloud management, + # so it cannot be enrolled and can never force-install an off-store + # extension. Unpacked is not a downgrade to be apologised for on this + # machine; it is the only thing that works, and it still updates itself. + info "[7/7] Chrome extension" + info " Chrome is not published for $(uname -m), and Chromium cannot be" + info " enrolled - so on this machine the extension is loaded unpacked." + info " It still reloads itself from disk when the dashboard reports a" + info " newer version, so updates arrive without clicking anything." + EXTPOLICY=2 else - info " Skipped. Run: sudo scripts/enroll-chrome-management.sh" + info "[7/7] Chrome extension" + info " Enrols this machine's Chrome, after which the extension installs" + info " itself from the Admin console and stays updated on its own." + info " Installs Chrome first if it is not here yet. Needs sudo." + read -r -p " Set this up now? [Y/n] " DOEXT + if [ "${DOEXT,,}" != "n" ]; then + if sudo bash scripts/enroll-chrome-management.sh; then EXTPOLICY=1; else + warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh" + fi + else + info " Skipped. Run: sudo scripts/enroll-chrome-management.sh" + fi fi # ── summary ───────────────────────────────────────────────────────────────── @@ -183,6 +197,10 @@ info "Still manual:" if [ "$EXTPOLICY" -eq 1 ]; then info " - Restart Chrome. chrome://management should name your organisation," info " and the extension installs itself within a minute or two." +elif [ "$EXTPOLICY" -eq 2 ]; then + info " - Load the extension in Chromium: chrome://extensions ->" + info " Developer mode -> Load unpacked -> $TARGET/extension" + info " (after that it reloads itself when an update lands)" else info " - Enrol Chrome so it can install the extension:" info " sudo scripts/enroll-chrome-management.sh"