TweetFollow Us on Twitter

MacEnterprise: Managing Software Installs with Munki - Part 2

Volume Number: 26
Issue Number: 11
Column Tag: MacEnterprise

MacEnterprise: Managing Software Installs with Munki - Part 2

Setting up a demonstration Munki Server

By Greg Neagle, MacEnterprise.org

Previously in MacEnterprise...

Last month, we started looking at munki, a set of open-source tools that can manage software installs and removals on Mac OS X machines. Munki consists largely of client-side tools written in Python, and can use virtually any modern web server as its source of packages and data. Munki's source code, as well as installer packages for the tools, are available at http://code.google.com/p/munki. Munki supports Mac OS X 10.5 (Leopard) and 10.6 (Snow Leopard).

Munki can install software packaged in Apple's Installer package format, software delivered for "drag-and-drop" installs on disk images, and Adobe CS3, CS4 and CS5 products and updates using Adobe's supported enterprise deployment tools.

As part of last month's introduction, we looked at the data munki uses to determine what to install or remove. Aside from the actual software to be installed (which for the rest of this column we'll refer to as "packages," even for items that aren't strictly Apple packages), munki stores its data in the form of Apple plist files. Munki uses manifest files to keep track of which software is to be installed on which machines, and catalog files to keep track of which packages are available.

Manifests are easy to understand. A bare-bones manifest must contain a list of one or more catalogs to be searched for packages, and a list of packages to install. Here's an example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>catalogs</key>
   <array>
      <string>production</string>
   </array>
   <key>managed_installs</key>
   <array>
      <string>Firefox</string>
      <string>Thunderbird</string>
   </array>
</dict>
</plist>

In this example, munki is told to search the production catalog for Firefox and Thunderbird, and ensure the latest versions of these items are installed. The concept of "catalogs" is an important one. It is possible to have different versions of software available in different catalogs. A very common and powerful configuration is to maintain a "testing" catalog and a "production" catalog. New versions of software are first added to the "testing" catalog. Only a subset of managed machines is configured to use the "testing" catalog, and this subset gets the newer versions of software first. Once you are satisfied there are no major issues with a new version of a piece of software, you can add the new version to the "production" catalog, where the rest of your managed machines will find it and install it.

Munki catalogs are lists of items that describe available packages. Munki provides some tools that help you create the catalog information for each package and combine this information into catalogs. In the most common configuration, the information for each package is stored in a corresponding "pkginfo" file. These pkginfo files are combined together to make the catalogs.

We looked at a sample pkginfo file last month, and there's a lot of information crammed into each one. Fortunately, you don't have to create these from scratch - tools provided with munki can create pkginfo files from pkgs. Rather than reviewing the contents and format of pkginfo files, we're going to create some to use with our own munki server.

Setting up a Demonstration Munki Server

Since Munki can use virtually any web server as its server, and since Mac OS X ships with Apache2, accessible as "Web Sharing" in the Sharing System Preferences pane, it's very easy to set up a demonstration munki server on any available Mac. You can even set up a munki server on a single machine that is also a munki client, and that is exactly what we are about to do.

To set up a munki server, we're going to create a directory structure in /Users/Shared, and then configure Apache2 to serve it via HTTP. You can do the next few steps via the Finder or via the Terminal, but it's easier to write them out as Terminal commands:

cd /Users/Shared/
mkdir munki_repo
mkdir munki_repo/catalogs
mkdir munki_repo/manifests
mkdir munki_repo/pkgs
mkdir munki_repo/pkgsinfo

You might be wondering what that last directory is. The pkgsinfo directory holds data that is not used directly by munki clients, but is used by other munki tools to create the catalogs. One more thing: let's make sure the Apache2 can read and traverse all of these directories:

chmod -R a+rX munki_repo

Next, we need to tell Apache2 to serve the munki_repo directory via HTTP. You could edit the /etc/apache2/http.conf file, or one of the other .conf files used by Apache2, but there's a much easier method for this demonstration.

sudo ln -s /Users/Shared/munki_repo /Library/WebServer/Documents/

This creates a symlink inside /Library/WebServer/Documents/ that points to our new munki_repo directory. By default on Mac OS X, /Library/WebServer/Documents/ is Apache2 's DocumentRoot, so it will serve anything in that directory via HTTP.

If you haven't already, turn on Web Sharing in the Sharing preferences pane. Now you can test your work so far. Using your favorite web browser, navigate to http://localhost/munki_repo. If you've done things correctly to this point, it should look like Figure 1.


Figure 1 - Our munki repo via HTTP

We now have a working munki repository ("repo") - but it's completely empty and not useful at all. So let's start to populate the repo.

We're going to use some tools distributed with munki to import packages into our new Muni repo. Download the current munki installation package at http://code.google.com/p/munki/downloads/list. For this column, I'll be using a preview of the 0.7.0 release of the munki tools; by the time this reaches print, 0.7.0 (or later) should be in final release. In any case, it's important that you use a 0.7.0 release or later - some of the tools we'll use aren't available in earlier releases, or work differently.

Install the munki tools by mounting the disk image and double-clicking the Installer package and installing like any other package. A restart is required after installation.

The tools you'll use as an administrator are available from the command-line, and are installed in /usr/local/munki. This location is not in the standard search path, so you'll need to either add this directory to your search paths, or be sure to type the full path when invoking these tools.

The tool we will use to import packages into the munki repo is called munkiimport. We need to configure it before we can use it - telling it where to find our repo, among other things.

bash-3.2$ /usr/local/munki/munkiimport —configure
Path to munki repo [None]: /Users/Shared/munki_repo   
Repo fileshare URL [None]: 
pkginfo extension [None]: 
pkginfo editor [None]: TextMate.app

We are first asked for the path to the munki repo, and since we set one up at /Users/Shared/munki_repo, that's what we enter. Next, we are asked for a repo fileshare URL. This is used when the repo is hosted on a remote file server, and this would typically be an afp:// or smb:// URL specifying the share. Since we're hosting the repo on the local machine, we'll leave this blank. We are then asked to specify an extension to append to the name of pkginfo files. Some admins prefer ".plist", some prefer ".pkginfo". Personally, I just leave it blank - munki doesn't care. Finally, you are asked for an editor to use for the pkginfo files. If you like command-line editors, you can specify /usr/bin/vi or /usr/bin/emacs for example. If you, like me, prefer GUI text editors, you can specify GUI apps by name (but be sure to include the ".app" extension). I picked TextMate.app, but you could choose TextWrangler.app, BBEdit.app, or even TextEdit.app.

Next, let's get a package to import. Firefox is a good example package, and you can download it from http://www.mozilla.com/. As of this writing, the current version is 3.6.12, and when I download it using Safari, a disk image named "Firefox 3.6.12.dmg" is downloaded to my Downloads folder and opened in the Finder. We want to work with the disk image file itself, so eject the mounted "Firefox" volume in the Finder.

We'll return to the command line to import the Firefox package.

/usr/local/munki/munkiimport ~/Downloads/Firefox\ 3.6.12.dmg Item name [Firefox]: Display name []: Mozilla Firefox Description []: Web browser from Mozilla Version [3.6.12.0.0]: Catalogs [testing]: Item name: Firefox Display name: Mozilla Firefox Description: Web browser from Mozilla Version: 3.6.12.0.0 Catalogs: testing Import this item? [y/n] y Upload item to subdirectory path []: apps/mozilla Path /Users/Shared/munki_repo/pkgs/apps/mozilla doesn't exist. Create it? [y/n] y Copying Firefox 3.6.12.dmg to /Users/Shared/munki_repo/pkgs/apps/mozilla/Firefox 3.6.12.dmg... Saving pkginfo to /Users/Shared/munki_repo/pkgsinfo/apps/mozilla/Firefox-3.6.12.0.0...

Let's walk through this. We run the munkiimport tool and provide it a path to our downloaded disk image. munkiimport then asks us to confirm or override some basic information about the package. We accept the item name by simply hitting return, but provide a new "Display name" and "Description". We accept the version and the catalogs.

munkiimport then prints back our choices and asks if we want to import the item. (If we made any mistakes, this would be a good time to say "no"!) We agree, and munkiimport asks us if we'd like to upload the package to a subdirectory path. We could just skip this, and upload everything to the top level of the pkgs directory in the munki repo, but as our number of packages grows, that might get hard to navigate. So we're going to upload this into a directory named "Mozilla" inside a directory named "apps". As a sanity check, munkiimport warns us that the subdirectory path we've chosen doesn't yet exist. Since this is a brand new repo, we knew in advance that the directory didn't exist, so we want munkiimport to create it for us. Finally, munkiimport copies the Firefox package to /Users/Shared/munki_repo/pkgs/apps/mozilla/ and saves the pkginfo to /Users/Shared/munki_repo/pkgsinfo/apps/mozilla/Firefox-3.6.12.0.0.

Since I chose TextMate.app as my editor when I configured munkiimport earlier, munkiimport next opens the newly created pkginfo file in TextMate. See Figure 2.


Figure 2 - Munki pkginfo for Firefox 3.6.12

This gives you another opportunity to edit the pkginfo using your favorite text editor. We don't need to make any changes, though, so we can just close it. If we return our attention to the terminal window we used to run munkiimport, we'll see it's prompting us for one more bit of information:

Rebuild catalogs? [y/n] 

Remember that munki clients don't use the individual pkginfo files; instead they download and consult munki catalogs to find available software. So to actually make use of the pkginfo we just generated, we need to build new versions of all the defined catalogs. Answering "y" to this prompt causes munkiimport to rebuild the munki catalogs.

Rebuild catalogs? [y/n] y
Adding apps/mozilla/Firefox-3.6.12.0.0 to testing...

Since we only have one package (and its corresponding pkginfo) in our munki repo, we see a single item has been added to the testing catalog.

Again we can check our work so far. In your web browser, navigate to http://localhost/munki_repo/catalogs/testing. You should see something similar to Figure 3.


Figure 3 - Munki "testing" catalog

We now have one package in our munki repo. Our next step is to create a manifest so that munki knows what to install on a machine. Create a new text file in your favorite text editor with these contents:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>catalogs</key>
        <array>
                <string>testing</string>
        </array>
        <key>managed_installs</key>
        <array>
                <string>Firefox</string>
        </array>
</dict>
</plist>

Save the file as /Users/Shared/munki_repo/

manifests/test_munki_client. Be sure your editor doesn't add a file extension to the file name (many will try to add ".txt" for you). Again, check your work in your web browser by navigating to http://localhost/munki_repo/

manifests/test_munki_client. You should see the file you just created displayed in your web browser.

Munki Client Configuration

We're done (for now) with the server. Next, we need to configure the munki client so it knows about our server. The munki client stores its configuration in /Library/Preferences/ManagedInstalls.plist. Unless you've run the munki client before, this file won't yet exist. We'll use the defaults command to create it with the data we need. (Watch the line breaks - these are two commands, each on a single line.)

sudo defaults write /Library/Preferences/ManagedInstalls SoftwareRepoURL "http://localhost/munki_repo"
sudo defaults write /Library/Preferences/ManagedInstalls ClientIdentifier "test_munki_client"

We've told the client tools the top-level URL for the munki repo, and the name of the client manifest we'd like to use. That's it for the client configuration. Now the moment of truth: let's run the munki client from the command line.

sudo /usr/local/munki/managedsoftwareupdate 
Managed Software Update Tool
Copyright 2010 The Munki Project
http://code.google.com/p/munki
Downloading Firefox 3.6.12.dmg...
   0..20..40..60..80..100
Verifying package integrity...
The following items will be installed or upgraded:
    + Firefox-3.6.12.0.0
        Web browser from Mozilla
Run managedsoftwareupdate —installonly to install the downloaded updates.

Success! munki saw that we needed Firefox 3.6.12 and downloaded it. (It did not yet install it - we'll get to that in a bit.) But what if instead when you run managedsoftwareupdate you see this:

sudo /usr/local/munki/managedsoftwareupdate 
Managed Software Update Tool
Copyright 2010 The Munki Project
http://code.google.com/p/munki
No changes to managed software are available.

The most likely reason you see this is because you already have Firefox 3.6.12 (or later) installed. If you really want to test munki, delete your copy of Firefox:

sudo rm -r /Applications/Firefox.app

Then try running managedsoftwareupdate again - you should see it being downloaded as in the example above.

Managed Software Update.app

We ran managedsoftwareupdate from the command line and verified that the munki tools could talk to our munki server and download the Firefox package. But, as we've noted, managedsoftwareupdate did not actually install Firefox. We could call managedsoftwareupdate again, this time passing it the -installonly flag to make it install what it just downloaded. But instead, we're going to introduce another tool - the one "regular" users would interact with - Managed Software Update.app. You'll find it in the /Applications/Utilities folder. Double-click it to launch it. You should see a window similar to Figure 4.


Figure 4 - Managed Software Update.app

If you click on Update now, you'll be asked if you want to install without logging out, or to log out and install. Choose one and Firefox will be installed, and it will look something like Figure 5.


Figure 5 - Installing Firefox

Wrap up ...for now

Huzzah! We've accomplished a lot. We've set up a munki server, imported a third-party software package, built a catalog, and created a client manifest. We've also configured a munki client and successfully installed software using the munki tools.

There's a lot more we can do with our demo munki server, but we've run out of space for this month, so we'll need to continue next month. Next time, we'll look at updating software and removing software. We'll also examine pkginfo files in more depth to get a sense of the additional capabilities munki can offer a Mac OS X administrator.

Appendix: Cleaning up

Perhaps you have decided you don't want to do anything more with munki. Maybe you intend to explore more, but don't want to leave the munki tools and munki server in place until next month's installment. In any case, if you want to remove the munki tools and server, here's what you need to remove. Watch the line breaks.

Removing the client tools:

sudo launchctl unload /Library/LaunchDaemons/com.googlecode.munki.*
sudo rm -rf "/Applications/Utilities/Managed Software Update.app"
sudo rm -f /Library/LaunchDaemons/com.googlecode.munki.*
sudo rm -f /Library/LaunchAgents/com.googlecode.munki.*
sudo rm -rf "/Library/Managed Installs"
sudo rm -rf /usr/local/munki
sudo pkgutil —forget com.googlecode.munki

Removing the server:

sudo rm /Library/WebServer/Documents/munki_repo
rm -r /Users/Shared/munki_repo

If you aren't using Web Sharing for anything else, remember to turn it off using the Sharing preferences pane.


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

iExplorer 4.1.9 - View and transfer file...
iExplorer is an iPhone browser for Mac lets you view the files on your iOS device. By using a drag and drop interface, you can quickly copy files and folders between your Mac and your iPhone or... Read more
PCalc 4.5.3 - Full-featured scientific c...
PCalc is a full-featured, scriptable scientific calculator with support for hexadecimal, octal, and binary calculations, as well as an RPN mode, programmable functions, and an extensive set of unit... Read more
Slack 2.9.0 - Collaborative communicatio...
Slack is a collaborative communication app that simplifies real-time messaging, archiving, and search for modern working teams. Version 2.9.0: Slack now officially, and fully, supports Japanese.... Read more
Microsoft Office 2016 15.40 - Popular pr...
Microsoft Office 2016 - Unmistakably Office, designed for Mac. The new versions of Word, Excel, PowerPoint, Outlook and OneNote provide the best of both worlds for Mac users - the familiar Office... Read more
Apple iOS 11.1.2 - The latest version of...
iOS 11 sets a new standard for what is already the world’s most advanced mobile operating system. It makes iPhone better than before. It makes iPad more capable than ever. And now it opens up both to... Read more
Adobe InCopy CC 2018 13.0.1.207 - Create...
InCopy CC 2018 is available as part of Adobe Creative Cloud for as little as $19.99/month (or $9.99/month if you're a previous InCopy customer). Adobe InCopy CC 2018, ideal for large team projects... Read more
Adobe InDesign CC 2018 13.0.1.207 - Prof...
InDesign CC 2018 is available as part of Adobe Creative Cloud for as little as $19.99/month (or $9.99/month if you're a previous InDesign customer). Adobe InDesign CC 2018 is part of Creative Cloud.... Read more
Tor Browser Bundle 7.0.10 - Anonymize We...
The Tor Browser Bundle is an easy-to-use portable package of Tor, Vidalia, Torbutton, and a Firefox fork preconfigured to work together out of the box. It contains a modified copy of Firefox that... Read more
OmniOutliner Pro 5.2 - Pro version of th...
OmniOutliner Pro is a flexible program for creating, collecting, and organizing information. Give your creativity a kick start by using an application that's actually designed to help you think. It's... Read more
iShowU Instant 1.2.3 - Full-featured scr...
iShowU Instant gives you real-time screen recording like you've never seen before! It is the fastest, most feature-filled real-time screen capture tool from shinywhitebox yet. All of the features you... Read more

Latest Forum Discussions

See All

Lineage II: Revolution guide - tips and...
At long last, Lineage II: Revolution has now come to western shores, bring Netmarble's sweeping MMORPG to mobile devices. It's an addictive, epic experience, but some of the systems in the game can be a bit overwhelming. Here are a few tips to help... | Read more »
A Boy and His Blob (Games)
A Boy and His Blob 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: | Read more »
Fight terrible monsters and collect epic...
Released on Western markets early last month, Dragon Project, created by Japanese developer COLOPL, brings epic monster hunting action to mobile for the very first time. Collect a huge array of weapons and armor, and join up with friends to fight... | Read more »
I Am The Hero (Games)
I Am The Hero 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: I Am The Hero is a pixel art, beat 'em up, fighting game that tells the story of a "Hero" with a glorious but mysterious past.... | Read more »
Kauldron (Music)
Kauldron 1.0 Device: iOS Universal Category: Music Price: $3.99, Version: 1.0 (iTunes) Description: Kauldron is our warmest sounding, punchiest synth yet! A completely new modeling technology, combined with carefully designed... | Read more »
Lineage II: Revolution is mobile’s bigge...
NCSoft’s hit fantasy MMORPG series has just made the leap to mobile with the help of Netmarble in Lineage II: Revolution. With over 1.5 million players having already pre-registered ahead of the game’s launch, Revolution hit the app stores... | Read more »
Swing skilfully in new physics-based pla...
Sometimes it’s the most difficult of obstacles that can be the most rewarding. One game hoping to prove this is OCMO, the new tough but fair platformer from developers Team Ocmo. Primed to set every speedrunner’s pulse racing, as an otherworldly... | Read more »
RPGolf (Games)
RPGolf 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: Once upon a time, the kingdom was a land of peace, harmony, and an all-consuming passion for the greatest sport - GOLF. Everyone in the... | Read more »
Everything you need to know about Fire E...
Fire Emblem Heroes is getting its biggest update yet as Nintendo unveiled Book II last night, featuring a whole new set of story missions and yes, collectible heroes. The update's not out just yet, but here's what you can expect when the new... | Read more »
The biggest updates out this week - Nove...
A big game update is always a treat. Multiply that by four and you're having a really good week. Those weeks don't come around very often, but you're in luck. This chilly mid-November is chock full updates for some of your favorite titles, and they... | Read more »

Price Scanner via MacPrices.net

Early Black Friday sale: Apple iMacs for up t...
B&H Photo has 27-inch iMacs in stock and on sale for up $130-$150 off MSRP including free shipping. B&H charges sales tax in NY & NJ only: – 27″ 3.8GHz iMac (MNED2LL/A): $2149 $150 off... Read more
Apple restocks refurbished Mac minis starting...
Apple has restocked Certified Refurbished Mac minis starting at $419. Apple’s one-year warranty is included with each mini, and shipping is free: – 1.4GHz Mac mini: $419 $80 off MSRP – 2.6GHz Mac... Read more
Save on 12″ MacBooks, Apple refurbished model...
Apple has Certified Refurbished 2017 12″ Retina MacBooks available for $200-$240 off the cost of new models. Apple will include a standard one-year warranty with each MacBook, and shipping is free.... Read more
Early Holiday sale: 12″ iPad Pros for up to $...
B&H Photo has 12″ iPad Pros on sale today for up to $130 off MSRP. Shipping is free, and B&H collects no sales tax outside NY & NJ: – 12″ 64GB WiFi iPad Pro: $749, save $50 – 12″ 256GB... Read more
Holiday sale prices on Apple 13″ MacBook Pros...
B&H Photo has 2017 13″ MacBook Pros in stock today and on sale for $100-$150 off MSRP, each including free shipping plus NY & NJ sales tax only: – 13-inch 2.3GHz/128GB Space Gray MacBook Pro... Read more
Sale: 13″ MacBook Airs starting at $899, $100...
B&H Photo has 2017 13″ MacBook Airs on sale today for $100 off MSRP including free shipping. B&H charges NY & NJ sales tax only: – 13″ 1.8GHz/128GB MacBook Air (MQD32LL/A): $899, $100 off... Read more
Week’s Best Deal on 13″ MacBook Pros: Apple r...
Apple has a full line of Apple Certified Refurbished 2017 13″ MacBook Pros available for $200-$300 off MSRP. A standard Apple one-year warranty is included with each MacBook, and shipping is free.... Read more
Deal: 15″ 2.6GHz MacBook Pro for $1799 w/free...
B&H Photo has clearance 2016 15″ 2.6GHz Touch Bar MacBook Pros in stock today and available for $600 off original MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: – 15″ 2.... Read more
Black Friday pricing on the 1.4GHz Mac mini....
MacMall has the 1.4GHz Mac mini on sale for $399 including free shipping. Their price is $100 off MSRP (20% off), and it’s the lowest price for available for this model from any reseller. MacMall’s... Read more
Early Black Friday deal: 15″ Apple MacBook Pr...
B&H Photo has 15″ MacBook Pros on sale for up to $200 off MSRP. Shipping is free, and B&H charges sales tax in NY & NJ only: – 15″ 2.8GHz MacBook Pro Space Gray (MPTR2LL/A): $2199, $200... Read more

Jobs Board

*Apple* Solution Consultant - Apple (United...
# Apple Solution Consultant - Rochester, MN Job Number: 113037950 Rochester, MN, Minnesota, United States Posted: 19-Sep-2017 Weekly Hours: 40.00 **Job Summary** Are Read more
Sr. Experience Producer, Today at *Apple* -...
# Sr. Experience Producer, Today at Apple Job Number: 56495251 Santa Clara Valley, California, United States Posted: 23-Jun-2017 Weekly Hours: 40.00 **Job Summary** Read more
AppleCare Support Engineer for *Apple* Medi...
…Summary AppleCare Engineering, Software & Services, is a group that works to represent Apple 's World Wide contact centers and Apple 's customers to groups within Read more
Site Reliability Engineer, *Apple* Pay - Ap...
Job Summary The Apple Pay Site Reliability Engineering Team is hiring for multiple roles focused on the front line customer experience and the back end integration Read more
*Apple* Solutions Consultant - Apple (United...
# Apple Solutions Consultant Job Number: 86078534 Fairless Hills, Pennsylvania, United States Posted: 07-Jul-2017 Weekly Hours: 40.00 **Job Summary** As an Apple Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.