Archive for the ‘AutoPkg’ Category

Adding installer package code-signing to AutoPkg workflows

November 10, 2017 1 comment

As part of building an AutoPkg workflow to create installer packages, one of the requirements I was given was that any packages that weren’t already signed by the vendor needed to be signed using a Developer ID Installer signing certificate.

Screen Shot 2017 11 09 at 9 58 53 PM

Signing installer package is not usually an outcome of most AutoPkg workflows, since code signature verification can be used at the download end to make sure that the application is what it is supposed to be. However, there were several good reasons for adding a package signing step to the workflow, including:

  1. It is now necessary to sign packages before you’ll be able to use them as part of NetInstall sets
  2. The InstallApplication MDM command requires that macOS installer packages be signed with an appropriate certificate

After some research and testing, I was able to incorporate installer package signing into my AutoPkg workflow and am now able to automatically sign installer package as they’re generated by my package creation workflows. For more details, see below the jump.

Read more…

AutoPkg recipes for Apple Enterprise Connect

June 12, 2017 4 comments

To help keep on top of software updates, I’ve been using AutoPkg in combination with AutoPkgr and JSSImporter for a while now to upload new software updates to Jamf Pro. However, I recently ran into a challenge when I wanted to build an AutoPkg recipe for Apple’s Enterprise Connect.

AutoPkg recipes usually rely on the vendor having a publicly accessible way to get downloads via HTTP or HTTPS. Apple does not have a publicly accessible download URL for Enterprise Connect and in fact discourages customers from sharing the download link. The fact that there was a download link meant that I could write AutoPkg recipes but at the same time I couldn’t include the URL needed to download the latest update as part of the recipe .

After some thinking and research into AutoPkg’s functionality, I found a way to create AutoPkg recipes for Enterprise Connect while at the same time not sharing Apple’s download URL. For more details, see below the jump.

Read more…

Deploying and licensing EndNote X8

November 23, 2016 6 comments

As previously discussed, a number of folks in my shop use Clarivate Analytics’s EndNote bibliography software. Clarivate Analytics provides EndNote X8 with an installer application, but I need an installer package in order to easily deploy it to my customers. EndNote X8 was initially problematic in that regard, but I was able to write AutoPkg recipes for EndNote X8 to handle converting Clarivate Analytics’s installer application into a deployable installer package, including a recipe that would automate uploading the latest EndNote installers to my Casper server.

Screen Shot 2016 11 22 at 9 56 17 PM


Once AutoPkg was able to provide an EndNote X8 installer package for deployment, the remaining hurdle was that the EndNote X8 installer from AutoPkg installs an unlicensed copy of EndNote and I needed to have installed copies of EndNote automatically use my shop’s EndNote site license.

Screen Shot 2016 11 22 at 9 41 57 PM


Fortunately, EndNote X8’s volume license can be deployed just like EndNote X7’s volume license. The volume license is stored in as an invisible file named .license.dat in /Applications/EndNote X8  and it has a format that looks like this:

Company Name

Note: The Company Name part may show up twice in your .license.dat file.

With some additional testing, I found that I could remove an existing .license.dat file (if one was present) and replace it with my shop’s site license’s .license.dat file. That allowed me to use the EndNote X8 installer produced by AutoPkg by having Casper install it, then apply our site license file as a post-installation action. For more details, see below the jump.

Read more…

Preparing EndNote X8 for deployment using AutoPkg

November 15, 2016 3 comments

As previously discussed here, one of the software packages used in my shop is Clarivate Analytics’ EndNote bibliography software.

Recently, EndNote X8 was released. When the new version’s installer was downloaded, it was discovered to be an installer application, which can pose problems for deployment.

Screen Shot 2016 11 14 at 9 09 31 PM

Screen Shot 2016 11 14 at 9 09 27 PM

Screen Shot 2016 11 14 at 9 24 58 PM

By itself, the change to an installer application may not have been a huge problem as long as it had options for running the installation process from the command line. However, when I checked with EndNote support about the new installer, I was told that there was no option for installing EndNote X8 on a Mac using the command line.

Since the EndNote X8 installer does not have the option of command line installation, the only real option I thought I had was to install EndNote X8, then re-package it as either a drag-and-drop install or an installer package. However, when I dug deeper into the installer, I discovered a .zip file buried inside the installer.

Screen Shot 2016 11 14 at 9 10 04 PM

When expanded, this .zip file proved to be a complete install of EndNote X8.

Screen Shot 2016 11 14 at 9 11 41 PM

When I ran the EndNote X8 installer, it appeared to be performing the following functions:

1. Checking for Endnote updates
2. Extracting the .zip file into a new EndNote X8 folder

Screen Shot 2016 11 14 at 9 26 38 PM

3. Moving the new EndNote X8 folder into /Applications

Screen Shot 2016 11 14 at 9 26 40 PM

4. Launching the EndNote X8 application, which automatically loads the EndNote X8 Customizer screen if EndNote hasn’t been configured.

Screen Shot 2016 11 14 at 9 26 01 PM

For more details, see below the jump.

Read more…

Diagnosing and fixing code signing issues for applications installed by installer packages

June 6, 2016 Leave a comment

As part of making sure my customers have the latest version of their applications available, I use AutoPkg, JSSImporter, and AutoPkgr to ensure that as new software updates are released, they are automatically uploaded to my shop’s Casper server.

As part of this process, some applications need to be converted by AutoPkg from using the drag-and-drop installation method provided by the vendor to now being installed using an installer package.

In the case of certain applications, the process of packaging can change an application which is fine when installed via a drag-and-drop installation method to one which is broken when installed via an installer package. This is due to Apple’s pkgbuild tool erroneously stripping certain metadata used by the application’s code signing. If an application is set to check for that metadata as part of its code signature verification process, this can result in the application reporting that it’s been damaged and not launching.

An example of this which I’ve run across is Labtiva’s, a reference library application designed to collect, organize and enable citation of scientific journal articles and other reference materials. The installation method provided by Labtiva is a drag-and-drop install, where the customer is supposed to copy the application from a disk image and into a convenient location (like /Applications.)

Screen Shot 2016 06 05 at 6 16 42 PM


When the application is installed by copying it into place, there are no problems with the application and it launches normally.

Screen Shot 2016 06 05 at 1 55 34 PM

When is packaged, then installed via an installer package, an error message will appear at first launch to report that the application is damaged.

Screen Shot 2016 06 05 at 4 58 14 PM


Why the difference? In the case of, the verification of the application’s code signing appears to include verification of certain metadata which pkgbuild appears to remove as part of the packaging process. For more details, see below the jump.

Read more…

Using AutoPkg to build installer packages from installer applications

May 24, 2016 Leave a comment

One of the challenges Mac admins have to deal with are Mac application installers which don’t follow one of the following models:

In many cases, these alternate installers take the form of applications which may or may not have options for installing via command line. For those that do not have the option of command line installation, the only real option is to install the application in question, then re-package it as either a drag-and-drop install or an installer package.

However, for those installer applications that do support command line installation, this opens up the option of embedding the installer application inside an installer package and using a postinstall script to run the necessary commands for the installer application to install its files onto the Mac. I’ve used this workflow several times in the past, with some examples linked below:

These examples have been manually built by me on an as-needed basis as new versions are released, but wherever possible, I want to automate this process using AutoPkg. Thanks to being able to study a recently-built .pkg recipe for AccuBarcodePro created by @foigus, I was able to build recipes for AutoPkg which handle downloading and packaging the following installer applications:

For more details, see below the jump.

Read more…

Using AutoPkg recipes with alternate software downloads

March 15, 2016 Leave a comment

An issue that crops up occasionally for AutoPkg is that a vendor will release a new version of their software but be slow to update the download location which an AutoPkg recipe is looking at. Alternatively, there may be instances where a software vendor releases two versions of their software and AutoPkg only picks up one of them. A good example of this is Oracle’s Java 8, where the past few releases of Java 8 have actually had two versions of Java 8 released simultaneously.

Fortunately, if you can manually download the needed software, there is a way to leverage AutoPkg to generate the needed installer without needing to change your AutoPkg recipe. See below the jump for details.

Read more…

%d bloggers like this: