April 2009 - Installer-dev - lists.apple.com

Admin Authorization?
by Rick Mann 07 Apr '09

07 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Looking at this document: http://developer.apple.com/tools/installerpolicy.html And why is this doc so out of date? TIA, Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… I see that what we would like to have used to be available. That is, if the user is already an admin, we don't want them to have to authenticate. Is this no longer available, why? This email sent to site_archiver(a)lists.apple.com

1 0

"Could not update existing receipt" error
by Rick Mann 07 Apr '09

07 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Is there a way? -- Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… We're trying alternatives to our ridiculous install requirements. I'm trying to see if an admin user can install a sys prefs pane without being prompted for a password. When I unchecked the "Require admin authentication", and tried to install our prefs pane, but since I've installed before, I get this: 4/6/09 17:11:22 installdb[43006] Error: Could not update existing receipt using uid=501 as the prior owner is uid=0 Now, I can't find a receipt anywhere, so I don't know how to remove this. This email sent to site_archiver(a)lists.apple.com

1 0

Securely updating silently
by Rick Mann 07 Apr '09

07 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Seven silly swans? TIA! -- Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… We have a product (call it "KC", currently a prefs pane/agent) that gets installed the first time by the user downloading a .dmg, running the installer, authenticating, and everything is fine. This product communicates with a server product we sell. When the server updates, there is the potential for there to be a new KC to be available, and the old version installed no longer works. We have a strong desire for the installed version to automatically, and silently, update to the newer version. We've found a way to do this, using helper tool and setuid, etc. But, I believe it becomes a huge security hole. The helper tool must be passed a path to something, either the new installer package, or another app to run (in case we move away from Apple's installer in the future). In all cases, this poses a security risk, because someone can pass arbitrary paths to this same app. It seems that it should be possible to sign the various elements in order to make this process secure (the helper could validate the signatures), but I'm not sure of the best way. Recommendations? And please refrain from recommending against the silent update. I'm fighting that battle internally, but have to find solutions to the desired behavior in the meantime. This email sent to site_archiver(a)lists.apple.com

1 0

Re: language/country
by Iceberg-Dev 06 Apr '09

06 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:mime-version:in-reply-to :references:content-type:message-id:content-transfer-encoding:from :subject:date:to:x-mailer; bh=e8l6s0YjyraIJUl1RVYogUCnlgEpu7+jo1wpNJFgElE=; b=c8vpiU4TJ3D2penZ4DVghWlORCCruQZAJ0OBIue2x5Rv2iQMytYOZos8WPoG25IE6Q w3nv1ZWv8LQt4GY1wm9KV3ZKA9VjAcjnvcFhnOxkoHXTB5tKJI8QKu28vVTroivHG8F0 jBDCoXvQwO18QguRIhI19UM03IoijAxou5p6A= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:content-type:message-id :content-transfer-encoding:from:subject:date:to:x-mailer; b=m7QDYLFO6KbH72MsR6P/zPdtKVX728XrI+Wb1DQ18t6aIa0Pc1zVU8r5FNJ/xsLMj6 O6wQbSZADh+UEXU0wZ5xukV3LWCrTaOZJn2xPVIGI9z1iuk/jmarKX8sL3gd3+Do9sPk of+S5YiyGHzxbsdahXpRiYAY5k5y2aS3Jg+Ug= On Apr 6, 2009, at 7:59 AM, andy knasinski wrote: _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… I don't see any way via PackageMaker to check the OS language or country. I'd like to build an installer for US only. Any pointers would be most appreciated. Then just provide an English localization of your welcome, readme, license or conclusion documents. This email sent to site_archiver(a)lists.apple.com

1 0

language/country
by andy knasinski 06 Apr '09

06 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Any pointers would be most appreciated. thanks! andy _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… I don't see any way via PackageMaker to check the OS language or country. I'd like to build an installer for US only. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Pre/Post-installation action documentation?
by Iceberg-Dev 05 Apr '09

05 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:in-reply-to:references :mime-version:content-type:message-id:cc:content-transfer-encoding :from:subject:date:to:x-mailer; bh=ROGLIGDPcz4iX3yV8svmbSuRG3TvMJzARHYMthdA6l8=; b=VQ+DqNXWEX2hexf+Mcdu0DNCzaMbkBkhH7/8X+Ve6V9vkFbIMOzF/cU3k3he3fs1v8 7THr97JUX3Hej1zXIJUddI6c2W7bncvH4dSJG/VAWooTwp54rl20bLZ1Q1dBn7goYdsC NiSJVZ/dr+PfKxCIno3gL7i1Rie8qEVOgszQ8= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=in-reply-to:references:mime-version:content-type:message-id:cc :content-transfer-encoding:from:subject:date:to:x-mailer; b=mFJLGVd+sa072y33spw+VhwVA6O2UbxEZNVBH3fRH7jOwJ8OFoI7ZuOR85YgP1f6Ns BaiWya+no1B+mBrvrNyv5zmy82Fmay8sZg4W2+lBUqOToWVY/LqjPf27unZaCY1k4aFK Z20q5W9zFDDpW1Gc27Xv2+259wM0Od28R68eo= On Apr 4, 2009, at 2:46 AM, Rick Mann wrote: Don't expect documentation on this. _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… Where is the documentation pertaining to Preinstall and Postinstall actions for a Distribution bundle? What you can do is to build a metapackage for 10.4 and check out the shell script or AppleScript used to quit an application from the buikt package. This email sent to site_archiver(a)lists.apple.com

1 0

postflight script not running
by John Nairn 05 Apr '09

05 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com I cannot get my app installation to run a postflight script. #!/bin/bash ------------ John Nairn http://www.geditcom.com Genealogy Software for the Mac _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… 1. The script runs fine in terminal app and exits with 0 2. I put it in my install package (at path Scripts/postflight) and choose that file in the Scripts panel in the postflight field 3. The script is in the built package (when I show its contents it is in the Resources folder) 4. The install proceeds without warning or error (and even displays a brief message on running installer script) 5. The script does not run (as judged by its function not getting done and by none of the "echo" lines appearing in console or installer.log) 6. I am using PackageMaker 3.0.3 For reference, the script is short and given below. It is just removing some preferences I want to change when people upgrade. The echo line never outputs anyplace and the defaults command never deletes anything. echo "GEDitCOM II - reset to default index column settings" defaults delete com.geditcom.GEDitCOMII "Index Column Settings" echo "GEDitCOM II - reset to default browser window toolbar" defaults delete com.geditcom.GEDitCOMII "NSToolbar Configuration browserToolBar" exit 0 This email sent to site_archiver(a)lists.apple.com

1 0

installation script stdout?
by Rick Mann 04 Apr '09

04 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com TIA, Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… If my installation scripts write to stdout, where does that output go? I don't see it in the Console… This email sent to site_archiver(a)lists.apple.com

1 0

Pre/Post-installation action documentation?
by Rick Mann 04 Apr '09

04 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com TIA, Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… Where is the documentation pertaining to Preinstall and Postinstall actions for a Distribution bundle? I can't figure out how to use the "Quit Application" action, for example. This email sent to site_archiver(a)lists.apple.com

1 0

Re: setuid installer?
by Karl Kuehn 03 Apr '09

03 Apr '09

site_archiver(a)lists.apple.com Delivered-To: installer-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:cc:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:mime-version :subject:date:references:x-mailer; bh=UVtbNJa9TkMxN4jHfPztAHYiHiPv8l9RUPhXkWZ10yQ=; b=BLVXKXwd0D4ghuqZEkw84u6W42v9vHmF/o8joAhpJSMPQuEqmmnngHkltIqwWGdgV0 DfSsU2mj94jma6rF7IQs3e1zFXMvFvL9mamFx76PlDuzJZuAe6Rl4D92Htfjb31Iafil pEBSNgiWG56LgCwL0TA287R2GU4LzAq3SXtq0= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=cc:message-id:from:to:in-reply-to:content-type :content-transfer-encoding:mime-version:subject:date:references :x-mailer; b=TMZFSXgKGhkHcHvOwYg8ki2smB1IHvULR7sp2LWvhTkm2MiepiZw+RMmxud8UXzKNN BXeev/UbryZ5oAxY70fs3REaDVPtGLEzBsgO/Dh7ZkNB/Pf27U63jxTC95vNFyvBssgg 4o7ERGckGGbF6ZptX+HXlFaj5L+YVzM/rawCg= On Apr 3, 2009, at 4:05 PM, Rick Mann wrote: installer -pkg PATH/TO/your_package.pkg -target /tmp/TEMPFOLDER/ -- Karl Kuehn larkost(a)softhome.net _______________________________________________ Do not post admin requests to the list. They will be ignored. Installer-dev mailing list (Installer-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/installer-dev/site_archiver%40lists.… I am combining your two questions into one response, because I tried to answer one of your questions in the post you quoted in the other question. But if you are going to need root permissions to update things, then don't you need it during the install? And if so, then if you put in a postflight script it should run as root already (script or program), solving your problem. It occurs to me...how do pre- and post-flight scripts get to do privileged operations during installation? Or can they not? That was the whole point of my comment: if your installer has the run- as-admin/root flag checked it will call the postflight script with root permissions, so you don't have to use setuid at all. However, I am going to urge you to think this through, there are two cases you should make sure that your installer (and by extension now your updater) takes into consideration: 1) The installer could be run via something like Apple Remote Desktop and be running either underneath a totally unaware user, or it could be running behind the loginwindow. Both of these circumstances mean that you should not have any GUI component that is not part of the normal installer system (ie: installer bundles). 2) Your installer could be run on a filesystem other than the booted one, even if you have set the "only on booted volume" flag. This is used internally by Apple in packaging computers (for special runs), and projects like InstaDMG also do this. I'm not sure of the impact you're cautioning me about in these two instances. It should never run behind the login window, because we don't launch the agent unless the user is logged in. But you might be launching your updating routine behind the login window (or in other silly circumstances) if you call it in a postflight script. My point is to break installer writers of the assumption that they are always writing for the same environment that they are developing in. Don't get #2 at all. With InstaDMG it creates a whole OS install on a DMG from a series of .pkg's. The command line version of the installer is used something like this: Where TEMPFOLDER is the mount point for the .dmg that is being installed to. My point here is that even if you set the flag to only allow your package to be installed to "root" that my script walks right through that and your software will be installed at the root of the dmg mounted at /tmp/TEMPFOLDER/. This works great except that when an installer post-flight script comes along and writes things to "/", where there might be no version of that software installed at all. So my point is to use the target root that the installer passes to the postflight at $3 as your target. In most cases this will wind up evaluating to "/", but in some cases it will not. This email sent to site_archiver(a)lists.apple.com

1 0