Using the Jamf Pro API to retrieve FileVault personal recovery keys

As part of Jamf Pro 10.43’s release, Jamf has added the ability to access and retrieve FileVault personal recovery keys via the Jamf Pro API:

• Return FileVault information for a specific computer: https://developer.jamf.com/jamf-pro/reference/get_v1-computers-inventory-id-filevault
• Return paginated FileVault information for all computers: https://developer.jamf.com/jamf-pro/reference/get_v1-computers-inventory-filevault

For those who want to use this new capability, I’ve written a script which uses the Jamf Pro Classic API and Jamf Pro API to take a list of Jamf Pro computer IDs from a plaintext file, retrieve the associated Macs’ FileVault personal recovery keys and generate a report in .tsv format.

For more details, please see below the jump.

Verifying installer package signing and notarization using pkgutil

Recently I needed a way to verify whether an installer package was signed and notarized. I’ve been using Apple’s stapler tool as my usual go-to for verifying notarization. However, the stapler tool needs for Xcode to to be installed and I needed a solution that worked regardless of Xcode or the Xcode Command Line Tools being installed on the Mac in question.

After some digging, I found that pkgutil‘s check-signature function on macOS Monterey and later works great for this and doesn’t have any dependencies on Xcode or the Xcode Command Line Tools. The pkgutil tool is installed as part of macOS and the check-signature function displays the following on Monterey and later:

If a package is not signed:

If a package is signed with a certificate:

If a package is signed with a certificate and trusted by Apple’s notarization service:

To use the check-signature function, you should be able to use the command shown below (substituting /path/to/installer.pkg with the actual directory path of the installer package you want to check.):

/usr/sbin/pkgutil –check-signature /path/to/installer.pkg

view raw

gistfile1.txt

hosted with ❤ by GitHub

Finding the version number of the Xcode command line tools using the softwareupdate command

As part of making sure your development environment is up to date, it’s often helpful to know what version of Xcode or the Xcode Command Line Tools that you’re using. For Xcode, this is relatively straightforward as you can check Xcode.app‘s version number or you can use the command shown below:

xcodebuild -version

view raw

gistfile1.txt

hosted with ❤ by GitHub

On a Mac running Xcode, running that command should provide output similar to what’s shown below:

	username@computername ~ % xcodebuild -version
	Xcode 14.2
	Build version 14C18
	username@computername ~ %

view raw

gistfile1.txt

hosted with ❤ by GitHub

However, for the Xcode Command Line Tools, this process isn’t as straightforward. There isn’t a specific app to check for version information and running the command above results in the following output:

	username@computername ~ % xcodebuild -version
	xcode-select: error: tool 'xcodebuild' requires Xcode, but active developer directory '/Library/Developer/CommandLineTools' is a command line tools instance
	username@computername ~ %

view raw

gistfile1.txt

hosted with ❤ by GitHub

So how can you determine the latest installed version of the Xcode Command Line Tools? One way is to use the softwareupdate command’s history function, which should show all of the versions of the Xcode Command Line Tools which have been installed. You can use the following command to display all the installations of the Xcode Command Line Tools:

softwareupdate –history | grep "Command Line Tools for Xcode"

view raw

gistfile1.txt

hosted with ❤ by GitHub

For example, since both Xcode Command Line Tools 12 and Xcode Command Line Tools 13 are available for macOS Big Sur 11.7.x, you may see output similar to what’s shown below on a Mac running Big Sur:

	username@computername ~ % softwareupdate –history | grep "Command Line Tools for Xcode"
	Command Line Tools for Xcode 12.5 09/21/2022, 15:04:54
	Command Line Tools for Xcode 13.2 01/17/2023, 11:18:19
	username@computername ~ %

view raw

gistfile1.txt

hosted with ❤ by GitHub

Since the latest installed version of the Xcode Command Line Tools should be listed at the bottom of the output from the softwareupdate command’s history function, you should be able to use the following command to get the version number of the latest installed version of the Xcode Command Line Tools:

softwareupdate –history | awk '/Command Line Tools for Xcode/ {print $6}' | tail -1

view raw

gistfile1.txt

hosted with ❤ by GitHub

As of the date of this post, the latest version of the Xcode Command Line Tools on macOS Ventura 13.1 is version 14.2, so you should see output similar to what’s shown below on a fully updated macOS 13.1 Mac running the latest version of the Xcode command line tools:

	username@computername ~ % softwareupdate –history | awk '/Command Line Tools for Xcode/ {print $6}' | tail -1
	14.2
	username@computername ~ %

view raw

gistfile1.txt

hosted with ❤ by GitHub

Apple Device Management Second Edition book available for pre-order from Amazon

As mentioned previously, Charles Edge and I are releasing a new Second Edition of our Apple Device Management book. I’m delighted to announce it’s available for pre-ordering on Amazon via the link below:

https://a.co/d/bnCAr5W

This quality publication, just like First Edition, is stuffed with useful information, sure to be a collectors’ item and suitable for any gift-giving occasion. Please order yours today!