Macjutsu Super Versions Save

2023-12-14

Highlights

• New option to save the user's password for future automatic macOS updates and upgrades. Literally, "Save Password" but for automatic macOS updates and upgrades.
• New display customization options including unmovable dialogs and hide background mode courtesy of IBM Notifier 3.x.
• New macOS installer workflows are now handled by mist-cli integration, thus removing all python dependencies.
• New LaunchDaemon architecture significantly improves automatic launch and deferment reliability for all super workflows.
• New default "always on" behavior automatically checks for Apple software updates on a regular basis.
• Support for Jamf Pro 10.48+ (Beta) Managed Software Updates.
• Support for Jamf Pro 10.49+ API Roles and Clients.
• Please check out the updated super Wiki for more details!

Compatibility Notes

• super 4.x requires macOS 11 or newer (all code supporting macOS 10.x has been removed).
• All super 4.x code has been refactored for style, clarity, and uniformity. As such nearly every single option name has been changed.
• Most super 3.0 command line options and managed preferences are not compatible with super 4.x
• Previously saved super 3.0 Apple silicon authentication credentials are automatically migrated the first time super 4.x runs.
• It is safe to mix super version 3.0 and 4.x managed preferences (except for the DisplaySilently key) in a single configuration profile. However each version only recognizes the managed preference keys that are compatible for that version.
• Refer to this spreadsheet (tab separated values) for migrating super 3.0 command line options to version 4.x.
• Refer to this spreadsheet (tab separated values) for migrating super 3.0 managed preferences to version 4.x.
• Updated Jamf Pro Extension Attribute scripts now supports both super versions 3.0 and 4.x.
• Updated example MDM configuration profiles for super v4.x.
• super 4.0.3 SHA-256: 2c7411a4bfa84a63e20955d18d6c6ba19933b2cf35b04f91bbcac98c666e335c

Known Issues

• The Jamf Pro (Beta) Managed Software Updates workflow is not compatible with the --install-macos-major-version-target option. Until this issue is resolved you can revert your Jamf Pro service back to the current macOS software update workflow.

Please refer to the Change log for full details.

2023-11-15

Highlights

• New option to save the user's password for future automatic macOS updates and upgrades. Literally, "Save Password" but for automatic macOS updates and upgrades.
• New display customization options including unmovable dialogs and hide background mode courtesy of IBM Notifier 3.0.3.
• New macOS installer workflows are now handled by mist-cli integration, thus removing all python dependencies.
• New LaunchDaemon architecture significantly improves automatic launch and deferment reliability for all super workflows.
• New default "always on" behavior automatically checks for Apple software updates on a regular basis.
• Support for Jamf Pro 10.48+ (Beta) Managed Software Updates.
• Support for Jamf Pro 10.49+ API Roles and Clients.
• Please check out the updated super Wiki for more details!

Compatibility Notes

• super 4.x requires macOS 11 or newer (all code supporting macOS 10.x has been removed).
• All super 4.x code has been refactored for style, clarity, and uniformity. As such nearly every single option name has been changed.
• Most super 3.0 command line options and managed preferences are not compatible with super 4.x
• Previously saved super 3.0 Apple silicon authentication credentials are automatically migrated the first time super 4.x runs.
• It is safe to mix super version 3.0 and 4.x managed preferences (except for the DisplaySilently key) in a single configuration profile. However each version only recognizes the managed preference keys that are compatible for that version.
• Refer to this spreadsheet (tab separated values) for migrating super 3.0 command line options to version 4.x.
• Refer to this spreadsheet (tab separated values) for migrating super 3.0 managed preferences to version 4.x.
• Updated Jamf Pro Extension Attribute scripts now supports both super versions 3.0 and 4.x.
• Updated example MDM configuration profiles for super v4.x.
• super 4.0.2 SHA-256: a3568c093bd220a642c1bd9f51f8bf98d474b9e57a6f827fb7733d3dde2dbf6b

Known Issues

• IBM Notifier is currently exhibiting an issue where line wrapped text is clipped when the display icon is set for sizes larger than 60 pixels. Until this issue is resolved you can use the --display-icon-size=60 option to prevent text clipping.
• The Jamf Pro (Beta) Managed Software Updates workflow is not compatible with the --install-macos-major-version-target option. Until this issue is resolved you can revert your Jamf Pro service back to the current macOS software update workflow.

Please refer to the Change log for full details.

• Support for both macOS updates and upgrades.
• Support for macOS Rapid Security Response updates.
• New dialog customization options including; new help and warning buttons, embedded text, embedded images, and even embedded video.
• New user self-servicing workflows with progressive status notifications.
• New Apple silicon user authenticated workflows feature all customizable dialogs (built-in software update interfaces can be entirely avoided).
• New required free storage space and battery charge level detections with customizable notifications.
• Significantly improved error detections automatically try failed workflows again later.
• Vastly improved logging to help you identify specific workflow issues.
• An array of new helper items in the Super-Friends folder to further improve your workflows.
• Even more features and options are documented in the S.U.P.E.R.M.A.N. Wiki.
• Detailed super version progress can be found in the Change Log.
• You can also join the conversation at the Mac Admins Foundation Slack in channel #super.
• super 3.0 SHA-256: ac297dd3f5496a20648e35b73313ccddd8843a75cc95c9dadb9d900a60b8edd8

• UPGRADE NOTICE: Any version of super prior to 3.0b4 may unintentionally upgrade computers with macOS 12.6.2 to macOS 13.1+. You should avoid using any version of super prior to version 3.0b4 on macOS 12 or newer.
• New --display-accessory-type=TYPE and --display-accessory-content=/local/path or URL options allow you to specify a custom display accessory view for IBM Notifier interactive dialogs (jamfHelper dialogs do not support this option). Both options must be specified at the same time, and the supported display accessory types are...
  • --display-accessory-type=TEXTBOX display plain text or Markdown styled text in a white box inside interactive dialogs.
  • --display-accessory-type=HTMLBOX display HTML styled text in a white box inside interactive dialogs.
  • --display-accessory-type=HTML display HTML styled text with a "blank" background as if part of the interactive dialogs.
  • --display-accessory-type=IMAGE display an image inside the interactive dialogs.
  • --display-accessory-type=VIDEO display a paused video inside the interactive dialogs.
  • --display-accessory-type=VIDEOAUTO display a video that will auto-play inside the interactive dialogs.
  • The --display-accessory-content=/local/path or URL option can accept a local path or a web URL. If the specified local path or URL can not be found then the custom display accessory will not be shown.
  • The Super-Friends folder now contains several display accessory examples.
• New --help-button=plain text or URL option allows you to specify a help button for IBM Notifier interactive dialogs (jamfHelper dialogs do not support this option).
• New --warning-button=plain text or URL option allows you to specify a warning button for IBM Notifier interactive dialogs (jamfHelper dialogs do not support this option).
  • If you specify a plain text string for either help or warning buttons, a pop-up will appear when the user selects the button.
  • If you specify a URL for either help or warning buttons, the URL will open in another application. Supported URL types are; http://, https://, mailto:, and jamfselfservice://. If a specified web URL cannot be found then the button will not be shown.
• New --display-silently option will open all IBM Notifier dialogs and notifications without playing the system warning sound (jamfHelper dialogs and notifications do not support this option).
• New Defer button will show the deferral time for IBM Notifier interactive dialogs and notifications (jamfHelper dialogs and notifications do not support this option). However, if the --menu-defer= option is also specified, then the default button will not show the deferral time as it's already displayed in the deferral pop-up menu.
• When using the --test-mode option with the self-update workflow the failure dialog is now also displayed (for testing validation).
• Improved Apple Silicon self-update/upgrade workflow notification dialogs describe required actions more accurately.
• Resolved an issue where the Apple Silicon self-update/upgrade workflow was not opening the correct application for macOS 12.3 or newer.
• Resolved an issue where the macOS via MDM workflow timeout was not properly trigger the failure notification. (Thanks to @marcelpogorzelski for spotting this one!)
• Bootstrap token validation now happens earlier in the credential management workflow and generates less logging on subsequent runs.
• Updates to the setDisplayLanguage() function to allow for new IBM Notifier display options and improved self-update/upgrade workflow text.
• As always, countless logging refinements and correction of typos.
• Updated example MDM profiles for super 3.0b8.
• super 3.0b8 SHA-256: a38c66833811b2de2839a3c2f2c47523879cf9ce6eb5be40fc54a3793658d45a

• UPGRADE NOTICE: Any version of super prior to 3.0b4 may unintentionally upgrade computers with macOS 12.6.2 to macOS 13.1+. You should avoid using any version of super prior to version 3.0b4 on macOS 12 or newer.
• New --enforce-all-updates option will install all recommended (non-macOS) updates silently in the background even if there is no macOS update or upgrade required. Without using this option, the default behavior for super is to install recommended updates only after a macOS update/upgrade restart.
• The macOS upgrade via MDM workflow now automatically logs out an active user moments before the system attempts to restart the computer. Thus, now all update and upgrade workflows (Intel, local authenticated, and MDM authenticated) will successfully force a restart.
• Improved notifications for the macOS upgrade via MDM workflow now show restart estimates more often and also warn the user before they are forcibly logged out before restarting.
• If needed, erase-install.sh is automatically updated to version 27.3. For compatibility with older systems, super will remain using versions of erase-install.sh prior to version 28.
• Resolved issues that caused download workflows to fail when only a single recommended (non-macOS) update was available.
• Resolved an issue that prevented super from downlading the latest macOS upgrade installer. Now the latest version is calculated via the macOS installer build number.
• Resolved an issue that prevented super from completing the gatekeeper validation for the macOS upgrade installer. This was making macOS upgrades take longer than they should.
• Improved --test-mode behavior.
• As always, countless logging refinements.
• Updated Jamf Pro extension attribute script now collects older versions of super as well. (Thanks to @wakco for this one!)
• Updated example MDM profiles for super 3.0b7.
• super 3.0b7 SHA-256: 23c6402379154f249d8ff6e1182bf500960fb118bdf16b4ccb01d6df26a91e85

• UPGRADE NOTICE: Any version of super prior to 3.0b4 may unintentionally upgrade computers with macOS 12.6.2 to macOS 13.1+. You should avoid using any version of super prior to version 3.0b4 on macOS 12 or newer.
• New support for macOS updates/upgrades when a system is enrolled in a beta seed program, as such super now properly detects and installs available macOS betas.
• All logs now show the version of super that is running.
• New Jamf Pro extension attribute script collects the currently installed super version.
• macOS upgrade installers are now always downloaded and validated via specific build number (as opposed to version number).
• Resolved an issue that prevented software updates from downloading on macOS 12.0 - 12.2.
• Resolved an issue that prevented update/upgrade version numbers from displaying for MDM workflow dialogs on macOS 12.3 or nerwer.
• Improved failure detection, some logging refinements, and fixed a few typos for good measure.
• Updated super removal script now removes erase-install items and any update credentials previously saved by super.
• super 3.0b6 SHA-256: b7bae8e206e6af5b3368a032853926830914a1ee9f6b66cc5e46b60b26d19cd3

• UPGRADE NOTICE: Any version of super prior to 3.0b4 may unintentionally upgrade computers with macOS 12.6.2 to macOS 13.1+. You should avoid using any version of super prior to version 3.0b4 on macOS 12 or newer.
• Dialog and Notification title bars now show the macOS update/upgrade version. For example, "macOS 13.1 Upgrade Requires Restart".
• Re-organized (yet again) the macOS upgrade list workflow to better accommodate macOS 12.3 or newer systems, as such...
• All macOS 12.3 or newer Intel computers and Apple Silicon computers using a local authentication workflow now always upgrade macOS via the much faster softwareupdate workflow. However...
• All Apple Silicon computers using Jamf Pro API authentication now always upgrade macOS via the traditional installer workflow. (This is due to a limitation in the macOS MDM upgrade workflow, not in Jamf Pro or super.)
• All Intel computers now ignore the MDM update/upgrade workflow as it provides no benefit over standard local system (root) authentication.
• Resolved software update list cache validation issues on macOS 13.x.
• Resolved software update download issue on macOS 13.x. (Huge thanks to @PicoMitchell for helping with this one!)
• A variety of logging and timeout improvements including live macOS installer download progress status when watching super via command line.
• super 3.0b5 SHA-256: 84023c8ccff2f22e5000fd35588935e5923b236cfc982b4686bc750f7908c2fc

• UPGRADE NOTICE: Versions of super prior to 3.0b4 may unintentionally upgrade computers with macOS 12.6.1 to macOS 13.1. You should avoid using any version of super prior to version 3.0b4 on macOS 12 or newer.
• New --allow-upgrade option can automatically enforce all contemporary macOS upgrade workflows from macOS 10.14 (older macOS versions may work but are not tested) to macOS 13.X. This includes support for Intel, Apple Silicon via local authentication, Apple Silicon via Jamf Pro API authentication, and Apple Silicon user request (similar to Nudge).
• New --target-upgrade=version option allows you to specify a major macOS version (11, 12, or 13) as the maximum allowed macOS upgrade.
• The previously introduced --push-major-upgrade option has been removed as it's no longer necessary because super automatically selects the most appropriate upgrade workflow.
• New support for the "softwareupdate-based" upgrade workflow from macOS 12.3 or later to macOS 13.x. This upgrade workflow is much faster than traditional macOS installation-based upgrades.
• New automatic installation of erase-install.sh to facilitate downloading the full system installer that is required for upgrading older macOS versions.
• To reliably support all macOS upgrade workflows, the minimum supported version of Jamf Pro is now 10.38 or later.
• Completely re-written download workflow always downloads the appropriate macOS update or upgrade locally (no more failed MDM downloads!) before prompting the user to restart.
• Significantly improved download validation and caching mechanisms further enhance download reliability and performance.
• All recommended (non-macOS) software updates now install immediately after the system is restarted. This is to avoid interrupting the user (when updating things like Safari) and to avoid unnecessary installations if performing a macOS upgrade.
• Boolean options (on/off) can now be specified using a more uniform "on" or "off" in the option's name. For example, test mode can now be enabled with the original --test-mode or the new --test-mode-on and toggled off with the original --no-test-mode or the new --test-mode-off.
• For macOS 13 or later, there is now a Managed Login Item Configuration Profile example for use when deploying super to managed systems.
• The logs maintained by super have (once again) been renamed to facilitate the new update/upgrade workflows. As always, the log descriptions and locations can be found in the internal setDefaults() function.
• Significantly improved logging now identifies more failure modes and also includes live macOS update/upgrade download progress status when watching super via command line.
• Countless log text changes, comment text clarification, and internal object renaming to facilitate new update/upgrade workflows.
• It's no longer necessary to specify the --skip-updates-on option with the --policy-triggers option to run Jamf Pro Policies when there are no macOS updates/upgrades available.
• super 3.0b4 SHA-256: 4e62e721266ccb4e93fad48c9e928f3a29eb2ab62e10a83950a7728a59863fb6

• New timeouts for each distinct update phase. These timeouts can be customized in the setDefaults() function of the script; checkTimeoutSECONDS=120, recommendedTimeoutSECONDS=300, mdmTimeoutSECONDS=120, downloadTimeoutSECONDS=120, prepareTimeoutSECONDS=600, applyTimeoutSECONDS=60, and asuTimeoutSECONDS=300.
• Optimizations to the major system upgrade detection that improve reliability and performance.
• Fixed issues that prevented the post-restart validation workflow from running and completing after installing a minor system update via softwareupdate.
• A wide variety of general and --verbose-mode logging improvements.
• super 3.0b3 SHA-256: e845729d8227d5c71e25971464e99ad477aaca7f1b6970fec6aeb05c4beb6948

• Renamed the option to prefer jamfHelper dialogs and notifications to --prefer-jamf-helper. Likewise, the managed preference key has also been renamed to PreferJamfHelper.
• Resolved issue with invalid logging function reference (Thanks to @iDrewbs!).
• The <key>PushMajorUpgrade</key> is now in the All Options config profile examples.
• super 3.0b2 SHA-256: a840e6dfeca4ece84b79969e41f2c077fc671f5c71893a23d65030a5c1c77f9c