add script for on-device provisioning