uoe-macos / jss Goto Github PK

I've re-written in in python, borrowing liberally from the AutoPkg Flash recipe.

This is wasteful, slow, and increases the likelihood of the whole thing timing out. We should download updates once and check for their presence on each run.

We need to either have a working default_realm or be explicit when calling kinit

Sorry, I'm new to this, any documentation/youtube etc. you can point me to in order to learn how to salt the username and password? Never used Salt before. I think I understand how it works, and how to generate for a password, but not how to use it with your variables and generate it to pair a username with a password or encrypt both?

When using coreconfig-softwareupdate-run.py in Jamf, what would you set the execution frequent to if using recurring check-in as the trigger? I assume from examining the script that the /var/db/UoESoftwareUpdateDeferral file is what will prompt the users each day during the deferral period?

Thanks!
Scott

Hi, I've come across two problems with coreconfig-softwareupdate-run.py:

1. On a 10.13.6 machine, the script appears to continue when the user presses "Restart Now", and logs the user out, but nothing else happens:

Downloading updates
OK to defer until 2018-11-10 10:27:08
User permitted immediate update
Setting up the updates index file
Setting up 041-18191 to install at logout
Setting up 041-01598 to install at logout
Setting updates to run on logout

/Library/Updates/index.plist does appear to have been updated, but no software updates run at logout or on subsequent manual logouts. It seems like it's missing some trigger to kick off the updates. I note that neither /var/db/.AppleLaunchSoftwareUpdate nor /var/db/.SoftwareUpdateOptions have been written (or, at least, they don't exist after a reboot), so that might be something to do with it.

2. On a 10.14.1 machine, the script crashes when the user presses "Restart Now". It looks like /Library/Updates is now SIP-protected in Mojave, so the index.plist file cannot be updated.

When calling tools from scripts, we should be explicit about paths. /usr/bin/python and python have quite different meanings sometimes! I've noticed his in software-update-2019 but it'll be in other places, too.

In theory $PATH will be set consistently so there's some protection there, but especially when testing we should ensure that we're using the expected versions of things wherever possible.

It would be helpful to include a list the available updates in the jamfHelper dialog box.

I updated the script to the April 15th version and ran it on a machine that has a pending update for a recommended, non-restart update and the popup displays that the machine requires a restart and only provides Apply now as an option.

At least not in the same place. Need to find a different icon to use for coreconfig-softwareupdate-run on 10.13.

If the user doesn't interact with the script when a dialog is on the screen, the default applescript timeout kicks in - resulting in the box being displayed again, and again, and again...

When a user elects to 'Restart later' we should install any pending updates on the next logout. This is closer to the behaviour of our supported Windows machines and increases the likelihood of updates being installed in a timely fashion

I ran this on a 10.14.3 machine to update to 10.14.4. The script found and prompted for the update, but then just kind of hung there after it cached the download. A force restart caused it to reboot to recovery partition saying the startup disk needed to update and awaited a prompt to continue. After selecting continue it booted up again but wasn't on 10.14.4. I ran the script again and this time it started the install...
Attached are the first run Jamf recorded log, the terminal output (I kicked off the policy manually), and the install.log output from the update. The first run.txt file, @ 8:17 where the error is, was from when I finally gave up and hit ctrl-c to break out of the Jamf function. The 2nd time running through terminal (after reboot) didn't upload any record to Jamf, so no log available to provide, but it did complete successfully.

softwareupdate deferral.log

cmd.log
first run.txt

Do you have a guide on how to add this to JAMF?

Can this script be easily updated for more folders to scan through? I want it to go through Desktop, Documents, Downloads, Movies, Music, and Pictures?

We're only using JAMFHelper to produce standard utility dialogs: we could probably do the same with osascript and remove the dependency.

Currently, if there is a pending update which requires a reboot, we don't install any updates at all.

Ideally, we'd install updates that don't require a reboot and only hold off on the reboot-requiring update(s).

If the password fails to be set we don't catch the error