A Pi gets the unpacked path, not a dead end

Chrome is x86_64 only on Linux and Chromium cannot be enrolled, so on ARM the
enrolment step can never succeed. Removing load-unpacked from the installer
left those machines being told to run a script that would refuse - setup now
detects the architecture, explains why, and the summary points at the unpacked
install, which on that hardware is not a fallback but the only thing that
works. It still self-updates.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -149,6 +149,14 @@ from Google's own enterprise MSI on Windows and the official .deb on Linux;
 Chromium is not accepted as a substitute, because it has no cloud-management
 support and can never be enrolled.
 
+**On a Raspberry Pi, none of that applies.** Google publishes Chrome for x86_64
+only, so an ARM box has Chromium and nothing else, and Chromium cannot be
+enrolled. There the extension is loaded unpacked — `chrome://extensions` →
+Developer mode → Load unpacked → `extension/` — and updates still arrive,
+because an unpacked copy reloads itself from disk when the dashboard reports a
+newer version. `setup-linux.sh` detects the architecture and says so rather than
+offering an enrolment that cannot work.
+
 **Enrolment is not optional.** No Chromium browser will force-install an
 off-store extension on an unmanaged machine, whatever the registry says — it
 reads the policy and blanks it. Enrolling is what makes Chrome managed without

setup-linux.sh

@@ -147,12 +147,25 @@ fi
 # console already set to force install. The token file lives under /etc, hence
 # sudo.
 echo
+EXTPOLICY=0
+if [ "$(uname -m)" != "x86_64" ]; then
+    # A Pi, or anything else ARM. Google publishes Chrome for x86_64 only, and
+    # Chromium - the browser that is available here - has no cloud management,
+    # so it cannot be enrolled and can never force-install an off-store
+    # extension. Unpacked is not a downgrade to be apologised for on this
+    # machine; it is the only thing that works, and it still updates itself.
+    info "[7/7] Chrome extension"
+    info "      Chrome is not published for $(uname -m), and Chromium cannot be"
+    info "      enrolled - so on this machine the extension is loaded unpacked."
+    info "      It still reloads itself from disk when the dashboard reports a"
+    info "      newer version, so updates arrive without clicking anything."
+    EXTPOLICY=2
+else
     info "[7/7] Chrome extension"
     info "      Enrols this machine's Chrome, after which the extension installs"
     info "      itself from the Admin console and stays updated on its own."
     info "      Installs Chrome first if it is not here yet. Needs sudo."
     read -r -p "      Set this up now? [Y/n] " DOEXT
-EXTPOLICY=0
     if [ "${DOEXT,,}" != "n" ]; then
         if sudo bash scripts/enroll-chrome-management.sh; then EXTPOLICY=1; else
             warn "enrolment failed - re-run: sudo scripts/enroll-chrome-management.sh"
@@ -160,6 +173,7 @@ if [ "${DOEXT,,}" != "n" ]; then
     else
         info "      Skipped. Run: sudo scripts/enroll-chrome-management.sh"
     fi
+fi
 
 # ── summary ─────────────────────────────────────────────────────────────────
 echo
@@ -183,6 +197,10 @@ info "Still manual:"
 if [ "$EXTPOLICY" -eq 1 ]; then
     info "  - Restart Chrome. chrome://management should name your organisation,"
     info "    and the extension installs itself within a minute or two."
+elif [ "$EXTPOLICY" -eq 2 ]; then
+    info "  - Load the extension in Chromium: chrome://extensions ->"
+    info "    Developer mode -> Load unpacked -> $TARGET/extension"
+    info "    (after that it reloads itself when an update lands)"
 else
     info "  - Enrol Chrome so it can install the extension:"
     info "    sudo scripts/enroll-chrome-management.sh"