bp88 / jss-scripts Goto Github PK

Doing some test with Monterey Self Service upgrade on M1 Macs and noticed upgrade failing, possibly due to mac password contains "$" in it. FV2 is enabled on all our machines.
Partial jamf policy logs below:

can't read "after": no such variable
while executing
"send -- "before$after\n""
(file "/dev/fd/50" line 11)

/Library/Application Support/JAMF/tmp/OS_Upgrade.sh: line 897: unset: `before$after': not a valid identifier
startosinstall did not succeed. See log at: /var/log/installmacos_211115064221.log and /var/log/install.log and /var/log/system.log

Upgraded successfully after replacing "$" character in mac password

Hello,
thank you so much for this amazing script, you have saved me and my team hours.

If the machine is fully up to date in Catalina 10.15.5, we run the script triggered by an event, the management notification won't stop re-appearing after you close it.

See screenshots.

osupdatenotifier.sh line 975
set wrong key name (ForceUpdateStartEpochTime need change to ForceUpdateStartTimeInEpoch)
old:

        # Record the start time for forced update via GUI the plist 
        setPlistValue "$BundleID" "ForceUpdateStartEpochTime" "integer" "$ForceUpdateStartEpochTime" "$DeprecationPlist"

fix:

        # Record the start time for forced update via GUI the plist 
        setPlistValue "$BundleID" "ForceUpdateStartTimeInEpoch" "integer" "$ForceUpdateStartTimeInEpoch" "$DeprecationPlist"

While clicking the More info button getting opened the web browser and shows some info about the OS or instruction happy for that.

but I have scheduled per day once-while clicking the more info button its got lapsed/closed the window.

and once day its vested after popup will be scheduled next days only.

can you have a look should not close the popup while clicking the more info button?

Hi AppleSoftwareUpdate not working most of the time.

issue 1 :
If the mac battery low not connected to power then auto disappeared in the schedule it should wait till connect to power or can give the option to update later or connect the adapter recommended

issue 2 : In big-sur not running the update just rebooting scheduled 3 deferrals and 4 times forced update right but not forced update doing just rebooted and came back to the login window.

issue 3 : big-sur first time just run the script and it says no update but the machine has pending update not yet checked proper rebooted and came back without an update by click update button.
tested in bigsur , Catalina

issue 4 : before the reboot, you have to unlock the FileVault or disks because FileVault needs to unlock the during the update to avoid asking the user name and password during the update process. T2 chip machines will ask for a login password.
if granting local admin pls specify the parameter so can help to mention the admin user name and password for that.

looking forward to new features.

Do not want to define a date range its always need to change again and again and limited can use the numbers to define the values.

if like defining dates 1 to 4 I can run only the update in between dates after few days I need to add one of the users then again I need to schedule the date in this case and on second days I need to add then again I need to change its again.

can define the value 3 days or 4 days without defining the date limitation. this case auto started initial value and as per the defined date value end date defined auto,
so if I'm adding a user machine any time and any date the end-user machine will consider 3 days having limited and auto start date and end date taken and in 3 days machine will be updated.

pls give the attempts limitation valie and timer and what update is pending in dashboard.

Any plans updating the AppleSoftwareUpdate.sh script for Big Sur?

Most of the script's OS version check logic breaks in Big Sur.

e.g. OSMajorVersion="$(/usr/bin/sw_vers -productVersion | /usr/bin/cut -d '.' -f 2)" outputs "0" in Big Sur.

Looks like 10.13's install ESD is structured differently than before. The BaseSystem.dmg doesn't seem to exist in the installesd

I think the problem is lines 185 - 240.
It seems Apple moved the basesystem.dmg file to /Contents/ShareSupport instead of InstallESD.dmg

but then it errors out on unable to minimum OS version (exit code 3).

Hi @bp88,

I'm looking to use this script to update clients from 10.10.5 to 10.12.6. My machines are encrypted with FV2. Will this setup work to prompt if i upgrade to 10.12.6 or only to 10.12.4?

Thanks!

In case machine are updating, when script running and require refreshSUL, original function will kickstart the softwareupdated service it also will stop all current update process, we need add another function to check if there no update going on before kickstart the service

# pngo 1/5/22 include check UpdateBrainService process, to avoid restart softwareupdated when user are updating
function checkingUpdateProcess(){
    if ps aux | grep -e com.apple.MobileSoftwareUpdate.UpdateBrainService$ >/dev/null; then
        debug "com.apple.MobileSoftwareUpdate.UpdateBrainService is running, potental Update in process, exit"
        exit 0
    fi
}

include the function on on top of current refreshSoftwareUpdateList()

refreshSoftwareUpdateList(){
    debug "Refresh Software Update list"
    # check update process, make sure there not update running
    checkingUpdateProcess
    
........
}

Is there a way to edit the script for it to only have the postpone option without the reboot?

Because the open command is running as the user running the script (root), the preference pane will request admin credentials when opened by this script in 10.15. This can be resolved by using launchctl to launch the Software Update preference pane under the correct user context.

I run sudo jamf policy and it launches the policy with OSUpdateNotifier.sh but nothing happens...

`Executing Policy MacOS Updates
Running script OSUpdateNotifier.sh...
Script exit code: 0
Script result: Current time is Tue Jul 27 13:41:30 PDT 2021. User will be reminded after Tue Jul 27 14:20:07 PDT 2021.

Submitting log to https://quizlet.jamfcloud.com/`

Any thoughts?

Hello,

Since updating the script a few hours ago, I have the following issues during an upgrade to Mojave:

• Error 23. Expired certificates while the installer was recently downloaded from the App Store and moreover, it works by executing the update manually.

• Error 16: "FV2 Status is not Encrypted" while Filevault is not enabled on the computers.

• Error 2: "Minimum required OS value is provided and the client's OS version is lower." When I update from a MacOS 10.13.6 to Mojave.

Thank you for your help

I have found that on T2 machines, the update does not actually finish installing after the reboot. I believe this is because the way the script is rebooting the system. I have had success by using the --restart flag with softwareupdate, which knows how to handle shutdown vs restart depending on the update.

I'm working on creating a PR for this now.

Can I get an example of how to use this via terminal?

Errors I am getting no matter what combination of app paths, service names or allow I type in
Invalid application path
TCC Services not provided
csreq.bin: No such file or directory

macos 11.4

One of my users that I tested this one said that when they hit postpone button it restarted their computer anyways but did not install updates. What might be causing this?

Fruits of System Preferences > System Settings revamp. Software Update icon is non-existent in Ventura.

Pre-Ventura path: /System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/Resources/SoftwareUpdate.icns

There's Rosetta 2 Updater icon in Ventura but it's only 256 x 256 px.

Path: /System/Library/CoreServices/Rosetta 2 Updater.app/Contents/Resources/AppIcon.icns

With number of postponements = 0, when running the AppleSoftwareUpdate.sh script via Jamf Policy, and allowing the timer to expire, the script returns the error runUpdates:12: bad math expression: operator expected at enough fre...'` occurs. This is on MacOS 10.15.1.

I believe this is caused by insufficient disk space (as reported by the OS when I run Software Updates manually).

Power Check is the GUI alert,

1. I have tested via manually got an echo notified not yet connected the power but not in the GUI popup

2. can you change that to the GUI method to wait for 10 min to connect the adapter to continue the process?

or can give the adapter plugin waiting for timing in parameter method.

I am checking the code but cannot understand why we are facing an issue on BigSur. After the user click on continue, we got the softwareupdate panel from system preferences, but when the user click on install, ask for user password (only the currentuser, I am assuming that it is the variable LoggedInUser grapped from console) but the password does not get allowed.
I checked so many times, the user is not mismatching the password.

$> sudo ./Tccutil.sh
Error: attempt to write a readonly database

tested number of application its says all in one word

firefox ,chrome tested app in accessablity

in some case the jamfhelper killed by terminal or Activity Monitor it will not return 239 error code and return empty intend

old code

checkAttemptToQuit(){
    Value="${1}"
    
    # Jamf Helper was exited without making a choice
    if [[ "$Value" == "239" ]]; then
        echo "Jamf Helper was exited without making a choice."
        "$jamf" policy -event "$CustomTriggerNameDeprecationPolicy" &
        exit 0
    fi
}

fix

checkAttemptToQuit(){
    Value="${1}"
    
    # Jamf Helper was exited without making a choice
    # pngo 12/31/21: include empty return code
    # The 239 return value is defaults when user quit the jamfhelper (Command+Q) if user kill it using kill [pid] command it will return empty
    if [[ "$Value" == "239" ]] || [[ -z "$Value" ]]; then
        echo "Jamf Helper was exited without making a choice."
        "$jamf" policy -event "$CustomTriggerNameDeprecationPolicy" &
        exit 0
    fi
}

Looks like the OS_Upgrade script is having trouble going from macOS 11.6.1 > 12.0.1. It returns an unsupported OS.

Haven't had a chance to check older versions yet.

Line 977:

issue: fix the data type from integer to string
setPlistValue "$BundleID" "ForceUpdateStartTimeString" "integer" "$ForceUpdateStartTimeString" "$DeprecationPlist"

fix:
setPlistValue "$BundleID" "ForceUpdateStartTimeString" "string" "$ForceUpdateStartTimeString" "$DeprecationPlist"

When trying to block catalina this application stops working.

sudo softwareupdate --ignore "macOS Catalina"

code in line 970 need correct syntax
current:

# Determine the current start time in epoch seconds for forced update via GUI
ForceUpdateStartTimeInEpoch="$(/bin/date -jf "%a %b %d %T %Z %Y" "$(/bin/date)" +"%s")

Fix:

# Determine the current start time in epoch seconds for forced update via GUI
ForceUpdateStartTimeInEpoch="$(/bin/date +"%s")
```"

Came across this issue with the Safari 14 update. macOS 10.15.6 uses a different software update readout than 10.14.6 (not sure if it's new but this is when I noticed it). When reading softwareupdate -l into ListOfSoftwareUpdates the following is the output:

10.14.6:

Software Update Tool

Finding available software
Software Update found the following new or updated software:

• Safari14.0MojaveAuto-14.0
  Safari (14.0), 67309K [recommended]
  Software Update Tool

10.15.6:

Software Update Tool

Finding available software
Software Update found the following new or updated software:

• Label: Safari14.0CatalinaAuto-14.0
  Title: Safari, Version: 14.0, Size: 65417K, Recommended: YES,

The issue is, the 2 lines that set UpdatesNoRestart and RestartRequired use grep:

UpdatesNoRestart=$(/bin/cat "$ListOfSoftwareUpdates" | /usr/bin/grep recommended | /usr/bin/grep -v restart | /usr/bin/cut -d , -f 1 | /usr/bin/sed -e 's/^[[:space:]]*//' | /usr/bin/sed -e 's/^Title:\ *//')
RestartRequired=$(/bin/cat "$ListOfSoftwareUpdates" | /usr/bin/grep restart | /usr/bin/grep -v '\*' | /usr/bin/cut -d , -f 1 | /usr/bin/sed -e 's/^[[:space:]]*//' | /usr/bin/sed -e 's/^Title:\ *//')

This will work on 10.14 but not 10.15 because of casing. Adding -i to the grep commands for finding "restart" and "recommended" resolves this:

UpdatesNoRestart=$(/bin/cat "$ListOfSoftwareUpdates" | /usr/bin/grep -i recommended | /usr/bin/grep -v -i restart | /usr/bin/cut -d , -f 1 | /usr/bin/sed -e 's/^[[:space:]]*//' | /usr/bin/sed -e 's/^Title:\ *//')
RestartRequired=$(/bin/cat "$ListOfSoftwareUpdates" | /usr/bin/grep -i restart | /usr/bin/grep -v '\*' | /usr/bin/cut -d , -f 1 | /usr/bin/sed -e 's/^[[:space:]]*//' | /usr/bin/sed -e 's/^Title:\ *//')

It would be great if we could customize the icon that is used by the AppleSoftwareUpdates script with a custom parameter.

Currently it seems it runs once a day. Is it possible to increase that?

Current Run Time: Thu Aug 12 10:59:05 PDT 2021
User will be reminded after: Fri Aug 13 10:59:05 PDT 2021

Hi!

First of all, your script is great.

I have the same issue like mani2care with the AppleSoftwareUpdate.sh script had (issue 2):

When 3 deferrals on macOS 11.3 are reached, all notifications work, the OS reboots, but no software updates will be installed. I attached a part of the install.log. Perhaps you can see something.

How is your experience updating macOS 11 systems?

Kind Regards!
macOS-11.3.1_update_install.log

I've been getting a number of reports from people stating the Catalina OS Upgrade is failing. It looks like it's failing with Error #23 (expired Cert). I've re-downloaded the package a few times (10.15.7 19h15), but it's sill saying expired.

Executable=/Applications/Install macOS Catalina.app/Contents/MacOS/InstallAssistant_springboard Identifier=com.apple.InstallAssistant.Catalina Format=app bundle with Mach-O thin (x86_64) CodeDirectory v=20100 size=276 flags=0x2000(library-validation) hashes=3+3 location=embedded Platform identifier=10 VersionPlatform=1 VersionMin=657664 VersionSDK=659206 Hash type=sha256 size=32 CandidateCDHash sha1=00b6cdf369e66031b6238072eb763ed1167da405 CandidateCDHash sha256=8425c770138507463827666ac7c04277d031714a Hash choices=sha1,sha256 Page size=4096 CDHash=8425c770138507463827666ac7c04277d031714a Signature size=4628 Authority=Software Signing Authority=Apple Code Signing Certification Authority Authority=Apple Root CA Info.plist entries=33 TeamIdentifier=not set Sealed Resources version=2 rules=13 files=234 Internal requirements count=1 size=84 A certificate for the installer application /Applications/Install macOS Catalina.app has expired. Please download a new macOS installer app with a valid certificate.

A prompt to install updates come up in situations where an update is available that does not require restart. In situations where only updates that do not require restart are available, softwareupdate -ia should be running silently and no prompt should appear.

osinstallersetupd prompts for admin credentials to continue the install when user is a standard user.

Thanks for this greats script! I noticed one issue: the variable name in line 139 needs to be corrected to display the correct prompts on macOS 10.13 and below.

Currently it's:
SUIGuide="by navigating to:

Should be:
SUGuide="by navigating to:

InstallESD.dmg renamed to SharedSupport.dmg for lines 39, 324,325, 333.

Tested and working on 11.0.1 for upgrade process.