jamf / jamjar

jamJAR: Jamf, AutoPKG & Munki combined by dataJAR

I have a Jamf, I have a Munki... uh... jamJAR!

Introduction

jamJAR is a solution that applies out of the box thinking & lean methodologies to macOS "patch management".

This holistic approach synergises jamf, autopkg & munki into an aggregated convergence that cherry-picks functionality from each products core competency to create an innovative, scalable & modular update framework.

For more information, please visit the wiki.

Videos

University of Utah, MacAdmins Meeting. April 2017 - https://stream.lib.utah.edu/index.php?c=details&id=12885

macad.uk. Feb 2017 - https://www.youtube.com/watch?v=SiDWCqwUSIM&feature=youtu.be

jamJAR: Three years on - Oct 2020 - https://www.youtube.com/watch?v=JGU48-S-unE

jamjar's Issues

Remove CFPreferencesSynchronize

From: https://developer.apple.com/documentation/corefoundation/1515504-cfpreferencessynchronize

Do not use this function directly unless you have a specific need. All arguments must be non- NULL. Do not use arbitrary user and host names, instead pass the pre-defined constants.

UnicodeEncodeError

postflight stderr: Traceback (most recent call last):
  File "/usr/local/munki/postflight", line 365, in <module>
    main()
  File "/usr/local/munki/postflight", line 83, in main
    process_pending(pending_items)
  File "/usr/local/munki/postflight", line 147, in process_pending
    send_pending_notification(NOTIFIER_MSG_PENDING)
  File "/usr/local/munki/postflight", line 208, in send_pending_notification
    the_msg, NOTIFIER_MSG_TITLE,)]
UnicodeEncodeError: 'ascii' codec can't encode character u'\xdf' in position 36: ordinal not in range(128)

From jamJAR.plist:

	<key>notifier_msg_pending</key>
	<string>Bitte ausloggen um Update abzuschließen</string>

Document Munki for Jamf Admins

Re-write (and complete) documentation around Munki for Jamf Admins.

Remove superfluous warning

2018-10-18 08:50:50 WARNING preflight: LocalOnlyManifest (auto-update.plist) declared, but is missing

Rotate log at 10MB instead of nightly, keep no backups

Resolve unused-variable

https://github.com/dataJAR/jamJAR/blob/master/postflight/postflight#L173

Add option to name log

currently defaults to "jamJAR.log"

Munki Manual Apple Updates support

https://github.com/munki/munki/wiki/manual-apple-updates-in-Munki-5

Amend input parameters to arrays in policy script

Munki 5.1 Python support

Migrate to Python 3 and Munki's 5.1 python at: /usr/local/munki/munki-python

Add timeout to subprocess

So we don't indefinitely hang managedsoftwareupdate

Warn if munki not found, do not error out

This would allow for manifest to be written too if we're awaiting munch to be installed but have ran policy script before.

Add version of postflight to postflight

FR: Add Support for arrays and/or delaying Jamf inventory update for bootstrap workflows

Trying to work out a bootstrap software install workflow that would utilize jamJAR, so we avoid having to configure any manifests in munki (outside those which simply define the catalog for the machine via the ClientIdentifier in the ManagedInstalls.plist) and similarly which avoid having to create many policies in jamf.

Complicating the workflow at the moment is the fact that software titles can only be added one at a time to the managed_installs or managed_uninstalls in the Local Manifest, and that as part of the jamJAR postflight an inventory update is completed after each install or uninstall.

I have two thoughts in this regard:

1. Add support for arrays so jamJAR.py can be added to a Jamf policy once so multiple pieces of software could be added to the managed installs and/or uninstalls.

OR

2. Add support to forcibly prevent an inventory update via the postflight following a single software install. This way the jamJAR.py script could be added multiple times to a single policy, installing software one at a time, but then only update inventory at the end.
   • In this regard, I know jamf has some logic so that if multiple policies are triggered that have inventory updates configured this only happens once all policies have finished running.

jamJAR & munki manifest double-install niche condition

This is more for me to hopefully address in a future PR, but wanted to get it here. It's a pretty niche issue, and I'm not 100% sure how to address it.

We're using munki manifests, rather than policies, to ensure all of our machines have the base software they need and then use jamJAR for Self Service and certain automated policies.

We have a scenario where a user who has our org VPN configured and forcibly applied when off LAN (which is the default) is traveling abroad and therefore needs to be able to manually choose when to turn on and off VPN, as some planes and trains restrict VPN traffic or force you to poney up more $$.

To accommodate this, we have two VPN app items, which reference the same PKG installer. However, one has the forced config item as an update_for and the other does not.

In this scenario, the VPN w/ config item is part of the included_manifest chain while the VPN w/o the config is not. I ran an uninstall from Self Service to remove the existing VPN app and config file and then ran a second Self Service policy to reinstall the VPN app w/o the config. Because these are two different items, the VPN installer is run twice - once from the default manifest and once from the LocalOnly manifest - and then installs the config.

Again, very niche ...

Up to date message shown outside of self service triggered policies

From https://macadmins.slack.com/messages/jamjar:

brianhanson 16:46 - I’m seeing behavior where jamJAR postflight is posting a macOS notification (via Notifier) on munki runs where software was up to date and nothing was installed. Policy is not being run from Self Service. Happens with policy -id, policy -event, and just plain policy. About to jump into the code to trace it but thought I’d ask if I’m missing something obvious

Recon if an item is uninstalled

Script exit code: 0
Script result: Adding AdobeProjectFelixCC2017 to uninstalls
Preflight: Contains 0 installs [], 1 uninstalls ['AdobeProjectFelixCC2017'], 0 pending, 0 warnings
WARNING: YOLO mode engaged
Postflight: Contains 0 installs [], 0 uninstalls [], 0 pending, 0 warnings

Remove spurious warning

LocalOnlyManifest (auto-update.plist) declared, but is missing

process_warnings should not be run when managedinstallreport is missing

Script result: LocalOnlyManifest (auto-update.plist) declared, but is missing
Adding Slack to installs
ManagedInstallReport is missing
Traceback (most recent call last):
File "/Library/Application Support/JAMF/tmp/jamJAR.py", line 354, in 
main()
File "/Library/Application Support/JAMF/tmp/jamJAR.py", line 76, in main
warning_count = process_warnings(warning_count)
File "/Library/Application Support/JAMF/tmp/jamJAR.py", line 250, in process_warnings
for warnings in managed_install_report.get('Warnings'):
UnboundLocalError: local variable 'managed_install_report' referenced before assignment

Notifier full support

Alerts for some workflows.. banner for others

Add option for different notification types

Alert types for “oh we installed something”

Banner types for “oh hey, log out”

Maybe using Yo for the latter.

Add timestamp to pre & post installs

Add option to delete the AdditionalHttpHeaders key in /private/var/root/Library/Preferences/ManagedInstalls.plist

Duplicate notifications from jamJAR

Hello,

I've noticed an issue with how jamJAR interacts with the Jamf Management Action in showing duplicate notifications for the installation or updating of software as shown below:

This was discussed on the #jamjar channel on the MacAdmins Slack and others mentioned this shows up using Notifier as well. https://macadmins.slack.com/archives/C3P30M36F/p1665029649572419

Just wanted to let you know in hopes it could be addressed.

Many thanks for the project and all you do!

Add ability to use GitHubReleasesInfoProvider for autopkg recipe

Tried to create an autopkg recipe to download the latest release so I could feed the latest postflight script into munki, but for whatever reason despite jamJAR having a version listed and downloadable assets the GitHubReleasesInfoProvider returns the following error:

Error in com.github.apizz.download.jamJAR: Processor: GitHubReleasesInfoProvider: Error: No release assets were found that satisfy the criteria.

As a result, my current working recipe pulls the version tag from the ./releases/latest url redirect to complete a direct download.

Remove munki_mode

With Munki3 comes native notification centre support, so munki_mode not needed.

Add option to not alert for a particular category

Such as for admin tool installs

Remove FoundationPlist bare excepts

        try:
            return FoundationPlist.readPlist(SelfServeManifest)
        except FoundationPlist.NSPropertyListSerializationException:
            return {}

Comma Separated "Add to Installs"

When adding multiple items to "Add to Installs" with comma separated values multiple notifications pop up for each app that is being installed, I have attached a screenshot for reference.

If I can assist with more info let me know

Thanks

Louis