TweetFollow Us on Twitter

MacEnterprise: Packaging for Enterprise Deployment

Volume Number: 25
Issue Number: 10
Column Tag: MacEnterprise

MacEnterprise: Packaging for Enterprise Deployment

Building Installer packages for mass unattended distribution

by Greg Neagle, MacEnterprise.org

Introduction

In past MacTech articles, we discussed reasons Mac OS X systems administrators might need to package or repackage software for deployment in their organization. Some common reasons are:

Packaging internally-developed software or tools

Capturing organization-specific changes or additions (licensing, configuration) into a package

Packaging third-party software that is distributed without an Installer package

Repackaging into a format compatible with your distribution mechanism

Repackaging software that won't install "silently" (i.e., prompts the user for info, or launches GUI applications)

In an ideal world, only the first two reasons would require a systems administrator to create an installation package (and if you can train your internal developers on packaging, maybe you can cross the first one off, too!). For the other scenarios, it would be more desirable to just take the installation package provided by your third-party software vendor and use it without having to repackage the software. This month, we'll talk about some of the reasons third-party installers don't work in enterprise environments and provide suggestions on how third-party software vendors could make their installers more enterprise-friendly.

Previous MacEnterprise columns have been targeted towards systems administrators in enterprise-scale organizations. This month's column should also be of interest to systems administrators, but I hope MacTech readers who are software developers find it relevant as well.

If you are a software developer, why should you bother making your installer friendly to enterprise environments? The number one reason is that if you do, you'll sell more of your product into an enterprise environment. Make it too hard to deploy in an enterprise, and systems administrators will look elsewhere and recommend your competitor's solutions.

Reason two: if your installer is not enterprise-friendly, systems administrators will almost certainly have to repackage your software in order to deploy it to their users. This introduces an opportunity for errors to creep into the install process. It's much easier to support your own software when you know it was installed with your own installer - if organizations have to repackage your software for installation, you've just introduced a new variable to support, or many, many new variables, as each organization that repackages your software may do it slightly differently.

Definitions

What does it mean when we refer to an installer as being enterprise-friendly? It's actually quite simple. An installer is enterprise-friendly when a system administrator can use standard mass-deployment tools to install your software on many machines automatically, and when, once installed this way, the software works as expected for all users of a given machine with no additional post-install configuration that cannot be done as a non-privileged user (i.e., a user without administrator rights).

Now you're wondering: "what does this author mean by 'standard mass-deployment tools'?" Again, a simple answer: on OS X, a standard mass-deployment tool is one that uses the Apple package format. This includes Apple Remote Desktop, LANrev, the Casper Suite, the KBOX, and many other commercial tools. All of these tools can use the Apple package format to install software remotely to a large number of managed machines.

Simple advice

The first, cheapest, simplest, and most important thing you can do as a software developer to ensure your software's installer is enterprise-friendly is to use an ssh session and the command-line installer tool (/usr/sbin/installer) to install your software on a remote machine. Test the install with no-one logged in as a GUI user, and for extra points, test the install with a GUI user logged in.

Some more details:

Copy the installer to the target machine in any way that is convenient - use scp to copy a disk image or tar or zip archive; or log on directly to the target machine and copy the installer from the web or a file server. Put it someplace readily accessible like /Users/Shared.

If a GUI user is logged into the target machine, log that user out.

Use ssh to login to the target machine as root or as an administrative user that has sudo rights.

> ssh gneagle@aquaman
Password:
Last login: Thu Feb  5 15:16:59 2009
(aquaman) gneagle [201] %

If you've logged in as an administrative user, use sudo to become root, and try to install your software:

(aquaman) gneagle [201] % sudo -s
Password:
[aquaman:/] root# cd /Users/Shared/
[aquaman:/Users/Shared] root# 
[aquaman:~] root# installer -target / -pkg MyApp.pkg

If you support Tiger, test with a target machine running Tiger as well as Leopard. Watch what happens on the target machine while the install is happening. No windows or dialogs should appear; no applications should launch. You should see no visible indication that anything is happening.

Assuming the installation was successful and silent, now, using the GUI on the target machine, log in as a non-admin user and verify your software works as expected. Do the same as an administrative user.

Repeat the experiment, this time with a GUI user login on the target machine.

If your software can be installed silently with this method, there is no visual indication that anything is happening when the install is occurring, and your software functions as expected when installed this way: congratulations! There's a very good chance your installer is enterprise-friendly!

Common pitfalls

As it turns out, it's not hard at all to make an Installer package that is enterprise friendly. The simpler the installer package, the more likely it is enterprise-friendly. But here are some common pitfalls that can make third-party software unnecessarily difficult to deploy in an enterprise environment.

Pitfall #1: using alternate packaging formats

To make your installer enterprise-friendly, use the Apple Installer package format. This does not mean you have to use Apple's PackageMaker tool to create your packages, but whatever tool you use must have as its final output an installation package compatible with Apple's Installer. If you use any other format for your installer, enterprise administrators will almost certainly have to repackage your software to deliver it to their users.

This pitfall extends to the so-called "drag-and-drop" disk images: with this type of install, the user is given a disk or disk image, that when opened, presents the software and typically, instructions to drag it into the Applications folder. While this installation method is acceptable for simple interactive installs, it does not work with mass-deployment tools, once again forcing the administrator to repackage your software.

If you (or your customers) prefer drag-and-drop installs and don't want to give them up, at least consider making an Installer package available as an option for system administrator use. Such an optional package could even be included on the disk image that contains the drag-and-drop application, perhaps in a subfolder and mentioned in a READ ME file.

Pitfall #2: asking for administrator credentials on first launch

Some software asks for administrator credentials on first launch so that it can install additional items. Some examples are TextWrangler, and TextMate, each of which ask the user if they can install command-line tools, which requires administrator rights. If the user declines, the software won't ask again. Worse examples include some of the Adobe Acrobat family of products, which ask every time the product is launched until its demands are met.

This is problematic in an enterprise environment because best practices dictate that most users do not have administrative rights, and so cannot provide the requested credentials. The assumption that a user of your software has or can obtain administrator rights after your software has been installed is simply a bad assumption in an enterprise environment, or any other large-scale environment (like education).

To avoid the issue, administrators have to repackage the software; either including the optional installations or packaging a modified version of the software that doesn't ask the user to install the additional items.

From an administrator's viewpoint, it would be better if the installer simply installed everything it wanted installed up front. In the case of TextWrangler and TextMate, there are no installers - these are distributed as drag-and-drop disk images - so again, the option of an Installer package would make administrators lives easier. In the case of software like Acrobat or Reader, vendors should provide a way for administrators to turn this behavior off without having to modify or repackage the software.

Pitfall #3: pre- and post-install scripts

If your installer makes use of pre- and/or post-install scripts, test them during your remote install tests to make sure they don't do anything visible. The Microsoft Office 2008 installer has a post-install script that attempts to add things to the dock. When run remotely when no one was logged in on a Tiger machine, this script caused the Finder and Dock to open behind the login window. Not only was that annoying, it was a security risk since the Finder was running as root! The Office 2008 installer is not the first installer to do something like this, and unfortunately, probably won't be the last.

Even if a user is logged in, if the administrator was installing Office 2008 remotely, is it really good form to kill and relaunch a user's Dock out from under them?

Other things to watch out for are scripts that attempt to quit open applications, and anything that makes use of AppleScript, which may not behave as expected when no-one is logged in.

Fortunately, a pre- or post- script can easily tell if it's being run in the context of a non-GUI install: the installer command sets the COMMAND_LINE_INSTALL environment variable. Just test for it and exit or skip over a task if it's set - here's a Perl example from a postflight script in the iTunes install package that updates the Dock:

# exit if command-line install
exit(0) if ($ENV{'COMMAND_LINE_INSTALL'});

Pitfall #4: Licensing and registration

It's a fact of life that many commercial applications need some sort of license code or registration code to run as an effort to combat piracy. If your installer requires entering a license code as part of the install process, it will not be able to be installed via mass-deployment tools. Site licensing can help the problem somewhat, but still doesn't solve it completely if the installer asks for the site license code. Consider these alternatives:

If the software is being installed via command line (i.e. the COMMAND_LINE_INSTALL environment variable is set), allow the installation to occur without entering a registration code. Your app could then ask for the registration code at first launch. (But that can cause its own problems...)

An ever better option, but one that I've seen very few vendors embrace, is to provide administrators with a method to include the registration code or codes with the installer. This could take the form of a separate package install that simply installs the registration code(s), or a properly named and formatted text file that a script included with the installer looks for and uses, or some other method for an admin to provide registration codes without having to visit each machine or do a full repackaging of your software.

There are certainly other failure modes and issues that can make an installer less than enterprise-friendly, but these are among the most common pitfalls.

More information

Apple has some documentation on software delivery, managed installs and remote installs. A PDF is available here:

http://developer.apple.com/documentation/developertools/conceptual/SoftwareDistribution/SoftwareDeliveryGuide.pdf

and an HTML version is here:

http://developer.apple.com/documentation/developertools/conceptual/SoftwareDistribution

Call to action

Software vendors: if you follow the suggestions in this article, your installer will be enterprise-friendly and you may even see increased sales and fewer enterprise support issues.

System administrators: if your software vendors aren't providing enterprise-friendly installers, let them know! File bug reports, pester your account representatives, or, worse case, investigate alternatives from vendors who "get it." Good luck!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Duet 1.7.0.2 - Use your iPad as an exter...
Duet is the first app that allows you to use your iDevice as an extra display for your Mac using the Lightning or 30-pin cable. Note: This app requires a $9.99 iOS companion app. Version 1.7.0.2:... Read more
BusyCal 3.2.8 - Powerful calendar app wi...
BusyCal is an award-winning desktop calendar that combines personal productivity features for individuals with powerful calendar sharing capabilities for families and workgroups. Its unique features... Read more
Vivaldi 1.13.1008.44 - An advanced brows...
Vivaldi is a browser for our friends. In 1994, two programmers started working on a web browser. Our idea was to make a really fast browser, capable of running on limited hardware, keeping in mind... Read more
rekordbox 5.1.1.0001 - Professional DJ m...
rekordbox is the best way of preparing and managing your tracks, be it at home, in the studio, or even on the plane! It allows you to import music from other music-management software using the... Read more
Opera 50.0.2762.67 - High-performance We...
Opera is a fast and secure browser trusted by millions of users. With the intuitive interface, Speed Dial and visual bookmarks for organizing favorite sites, news feature with fresh, relevant content... Read more
Luminar 2018 1.1.0 - Powerful, adaptive,...
Luminar 2018 is the new full-featured image editor that adapts to the way you edit photos. Over 300 essential tools to fix, edit, and enhance your photos with comfort. The future of photo editing is... Read more
Mactracker 7.7.1 - Database of all Mac m...
Mactracker provides detailed information on every Mac computer ever made, including items such as processor speed, memory, optical drives, graphic cards, supported OS X versions, and expansion... Read more
Spotify 1.0.69.336. - Stream music, crea...
Spotify is a streaming music service that gives you on-demand access to millions of songs. Whether you like driving rock, silky R&B, or grandiose classical music, Spotify's massive catalogue puts... Read more
BetterTouchTool 2.332 - Customize multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom... Read more
BetterTouchTool 2.332 - Customize multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom... Read more

Latest Forum Discussions

See All

Jydge hints, tips, and tricks - Everythi...
Just released on iOS, Jydge is a prequel to Neon Chrome and is set in the same universe. Not just that, but the games play in pretty similar ways with them both being twin stick shooters full of surprises. As you might expect from a 10tons game,... | Read more »
World of Warships Blitz: A guide to tact...
Ahoy mates! It's time to set out on the high seas for some PvP battles, and ... sorry, actually, World of Warships Blitz has nothing to do with pirates. Let's start over. [Read more] | Read more »
Around the Empire: What have you missed...
Around this time every week we're going to have a look at the comings and goings on the other sites in Steel Media's pocket-gaming empire. We'll round up the very best content you might have missed, so you're always going to be up to date with the... | Read more »
Everything about Hero Academy 2: Part 4...
In this part of our Hero Academy 2 guide, we're going to have a look at some of the tactics you're going to need to learn if you want to rise up the ranks. We're going to start off slow, then get more advanced in the next section. [Read more] | Read more »
All the best games on sale for iPhone an...
Another week has flown by. Sometimes it feels like the only truly unstoppable thing is time. Time will make dust of us all. But before it does, we should probably play as many awesome mobile videogames as we can. Am I right, or am I right? [Read... | Read more »
The 7 best games that came out for iPhon...
Well, it's that time of the week. You know what I mean. You know exactly what I mean. It's the time of the week when we take a look at the best games that have landed on the App Store over the past seven days. And there are some real doozies here... | Read more »
Popular MMO Strategy game Lords Mobile i...
Delve into the crowded halls of the Play Store and you’ll find mobile fantasy strategy MMOs-a-plenty. One that’s kicking off the new year in style however is IGG’s Lords Mobile, which has beaten out the fierce competition to receive Google Play’s... | Read more »
Blocky Racing is a funky and fresh new k...
Blocky Racing has zoomed onto the App Store and Google Play this week, bringing with it plenty of classic kart racing shenanigans that will take you straight back to your childhood. If you’ve found yourself hooked on games like Mario Kart or Crash... | Read more »
Cytus II (Games)
Cytus II 1.0.1 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0.1 (iTunes) Description: "Cytus II" is a music rhythm game created by Rayark Games. It's our fourth rhythm game title, following the footsteps of three... | Read more »
JYDGE (Games)
JYDGE 1.0.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0.0 (iTunes) Description: Build your JYDGE. Enter Edenbyrg. Get out alive. JYDGE is a lawful but awful roguehate top-down shooter where you get to build your... | Read more »

Price Scanner via MacPrices.net

Clearance Apple refurbished iMacs available s...
Apple has previous-generation Certified Refurbished 2015 21″ & 27″ iMacs available starting at $849. Apple’s one-year warranty is standard, and shipping is free. The following models are... Read more
How to save $150-$420 on the purchase of a 20...
B&H Photo has 15″ MacBook Pros on sale for up to $200 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 15″ 2.8GHz Touch Bar MacBook Pro Space Gray (... Read more
How to save $100-$180 on the purchase of a 20...
B&H Photo has 13″ MacBook Airs on sale for $50-$120 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 13″ 1.8GHz/128GB MacBook Air (MQD32LL/A): $899, $... Read more
Save on Beats: $30-$80 off headphones, earpho...
Walmart has Beats by Dr. Dre on sale on their online store for $30-$80 off MSRP, depending on the item: – Powerbeats3 Wireless Earphones: $134, save $65 – BeatsX Earphones: $109, save $40 – Beats... Read more
Deals on clearance 15″ Apple MacBook Pros wit...
B&H Photo has clearance 2016 15″ MacBook Pros available for up to $800 off original MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: – 15″ 2.7GHz Touch Bar MacBook Pro... Read more
Apple restocked Certified Refurbished 13″ Mac...
Apple has restocked a full line of Certified Refurbished 2017 13″ MacBook Airs starting at $849. An Apple one-year warranty is included with each MacBook, and shipping is free: – 13″ 1.8GHz/8GB/128GB... Read more
How to find the lowest prices on 2017 Apple M...
Apple has Certified Refurbished 13″ and 15″ 2017 MacBook Pros available for $200 to $420 off the cost of new models. Apple’s refurbished prices are the lowest available for each model from any... Read more
The lowest prices anywhere on Apple 12″ MacBo...
Apple has Certified Refurbished 2017 12″ Retina MacBooks available for $200-$240 off the cost of new models. Apple will include a standard one-year warranty with each MacBook, and shipping is free.... Read more
Apple now offering a full line of Certified R...
Apple is now offering Certified Refurbished 2017 10″ and 12″ iPad Pros for $100-$190 off MSRP, depending on the model. An Apple one-year warranty is included with each model, and shipping is free: –... Read more
27″ iMacs on sale for $100-$130 off MSRP, pay...
B&H Photo has 27″ iMacs on sale for $100-$130 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 27″ 3.8GHz iMac (MNED2LL/A): $2199 $100 off MSRP – 27″ 3.... Read more

Jobs Board

AppleCare Support Engineer for *Apple* Medi...
# AppleCare Support Engineer for Apple Media Products Job Number: 113222855 Santa Clara Valley, California, United States Posted: 14-Nov-2017 Weekly Hours: 40.00 Read more
QA Automation Engineer, *Apple* Pay - Apple...
# QA Automation Engineer, Apple Pay Job Number: 113202642 Santa Clara Valley, California, United States Posted: 11-Dec-2017 Weekly Hours: 40.00 **Job Summary** At Read more
*Apple* Video Partnerships - Apple (United S...
# Apple Video Partnerships Job Number: 113059126 Santa Clara Valley, California, United States Posted: 15-Nov-2017 Weekly Hours: 40.00 **Job Summary** Partnerships Read more
Sr. Engineering Manager- *Apple* Media Produ...
# Sr. Engineering Manager- Apple Media Products Job Number: 113335268 Santa Clara Valley, California, United States Posted: 17-Jan-2018 Weekly Hours: 40.00 **Job Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.