Minimal attestation-based enrollment flow.

chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc

Index: chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
index 051e6573e66dccd66e099d2f0e0a6b59f7a01f00..5a2907b63856057abe93ae771a69f7735452f8d3 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
@@ -25,7 +25,6 @@
 #include "chrome/common/chrome_content_client.h"
 #include "chrome/common/pref_names.h"
 #include "chromeos/chromeos_switches.h"
-#include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/system/statistics_provider.h"
 #include "components/policy/core/common/cloud/cloud_policy_core.h"
 #include "components/policy/core/common/cloud/device_management_service.h"
@@ -124,7 +123,9 @@ EnrollmentConfig DeviceCloudPolicyInitializer::GetPrescribedEnrollmentConfig()
   // Authentication through the attestation mechanism is controlled by a
   // command line switch that either enables it or forces it (meaning that
   // interactive authentication is disabled).
-  switch (DeviceCloudPolicyManagerChromeOS::GetZeroTouchEnrollmentMode()) {
+  ZeroTouchEnrollmentMode zte_mode =
+      DeviceCloudPolicyManagerChromeOS::GetZeroTouchEnrollmentMode();
+  switch (zte_mode) {

[pastarmovj, 2016/08/19 10:29:18]

Seems like this change can be undone you don't use the zte_mode var anymore.

[The one and only Dr. Crash, 2016/08/19 17:49:30]

Yes.

     case ZeroTouchEnrollmentMode::DISABLED:
       // Only use interactive authentication.
       config.auth_mechanism = EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE;