macadmins / outset Goto Github PK

Calculating the checksums for all of the scripts to be deployed also includes any logs that were generated by outset on the machine.

The swift code includes all files in /usr/local/outset, but it should exclude /usr/local/outset/logs. I'm not a swift developer, otherwise I'd just make a PR.

Thanks!

Describe the bug
Installed the new version of outset. Ran outset --login to test our login scripts.

Most scripts ran fine, but we have a script that has a specific set of optional arguments that is now failing due to being passed what looks like additional arguments.

To Reproduce
Deploy script to login-privilaged* directories (either works).

Expected behavior
Script runs as expected.

Screenshots

2023-05-10 14:07:34.638000-0700 0xca1f40   Debug       0x0                  97660  0    Outset: [io.macadmins.Outset:main] Completed task /usr/local/outset/login-privileged-every/upgradeWatcher.py with status 2
2023-05-10 14:07:34.638075-0700 0xca1f40   Debug       0x0                  97660  0    Outset: [io.macadmins.Outset:main] Task output:
2023-05-10 14:07:34.638103-0700 0xca1f40   Error       0x0                  97660  0    Outset: [io.macadmins.Outset:main] usage: upgradeWatcher.py [-h] [--testfile TESTFILE]
                         [--testosversion TESTOSVERSION]
upgradeWatcher.py: error: unrecognized arguments: mczack

System Details:

• OS: macOS 12.6.5 and macOS 13.4 RC
• arm64
• Version 4.0.0-b2 (this looks to not have gotten updated with latest package release)

Additional context
N/A

As per https://github.com/macadmins/outset/wiki/OnDemand, if I create a script in the on-demand folder that fires a --login-once trigger as per below: -

"Include your script(s) in the respective /usr/local/outset/login-once/ or /usr/local/outset/login-every/ directory, and place a script in /usr/local/outset/on-demand/ that calls one or both of the above commands, it will loop through and process the scripts in the expected context."

The login-once items are processed successfully. However, the processing does not log this run to the preference file as is stated below: -

"This means, if your script was added to /usr/local/outset/login-once/ and you run the --login-once argument in your on demand script, then Outset will treat it like any other login-once item by processing it and logging it in the preference file so that subsequent logins won't run this script again."

This means that the new login-once script gets processed again at the next login so it ends up running again.

Running through the above scenario should add a run_once key for the script the was successfully triggered by the on-demand action.

When adding an override the path is not getting recorded correctly into the preference file. I am following the instruction from https://github.com/macadmins/outset/wiki/ScriptOverrides. I am attempting to add two overrides. If the script is located in the "login-once" folder it gets added correctly. If the script is located in the "login-privileged-once" it does not get added correctly. The commands used are as follows:

sudo /usr/local/outset/outset --add-override /usr/local/outset/login-once/Remove_MS_Office_VL_User.sh
sudo /usr/local/outset/outset --add-override /usr/local/outset/login-privileged-once/Remove_MS_Office_VL_System.sh

When I look at the /Library/Preferences/io.macadmins.Outset.plist file the results are as follows:

<key>override_login_once</key>
<dict>
	<key>/usr/local/outset/login-once//usr/local/outset/login-privileged-once/Remove_MS_Office_VL_System.sh</key>
	<date>2023-11-16T19:25:46Z</date>
	<key>/usr/local/outset/login-once/Remove_MS_Office_VL_User.sh</key>
	<date>2023-11-16T19:26:01Z</date>
</dict>

Would it be worth adding logout functionality ala https://github.com/aysiu/offset ?

Describe the bug
running /usr/local/outset/outset --add-override doesn't add the override as expected

however

running /usr/local/outset/outset --add-overide returns
DEBUG: Adding / to overide list

To Reproduce
/usr/local/outset/outset --add-override returns nothing

Expected behavior
/usr/local/outset/outset --add-override should return
DEBUG: Adding / to ove(r?)ride list

Describe the bug
MARKETING_VERSION was not updated when release build was built.

❯ /usr/local/outset/outset --version
4.0.0-b2

Says Compute the SHA1 hash of the given file which is not correct. SHA256 is used

I have many systems running legacy outset. There's no documentation indicating if I need to do anything (uninstall, disable, etc...) before installing Outset 4.0. It would be nice to have this in the FAQ or something.

Problem: At the moment an On-Demand package that is created with outset-pkg has no on-demand trigger included.

Describe the solution you'd like
If the build process of outset-pkg --target on-demand would include a post install-script that triggers the on-demand process the packe would be more self-contained.

Describe alternatives you've considered
an option to outset-pkg to include a individual script would also help.

Additional context
I think the original Outset included this feature.
https://github.com/chilcote/outset/blob/master/custom-ondemand/scripts/postinstall

Unless I'm missing it in the current documentation available in the Wiki, there is no mention of how to do a clean uninstall of Outset.

This is a reminder to work on documentation for a full/clean uninstall of Outset.

When running the pkg installer, the postinstall will re-load launchd items. This will re-trigger any boot or login scripts.

To handle upgrades, we should move any scripts out of the way first before any re-launch and then move them back once the agents have been (re)loaded.

Alternate ideas welcome (e.g. creating an "upgrade in progress" token that prevents anything from running)

I've cloned https://github.com/chilcote/outset.wiki.git before it disappears.

Need to update as required and populate the wiki here.

observing the log with
log stream --predicate 'subsystem == "io.macadmins.Outset"' --info --debug

% log stream --predicate 'subsystem == "io.macadmins.Outset"' --info --debug
Filtering the log data using "subsystem == "io.macadmins.Outset""
Timestamp                       Thread     Type        Activity             PID    TTL  
2023-03-03 07:58:27.388541+1100 0xbb410c   Debug       0x0                  59267  0    Outset: [io.macadmins.Outset:main] Processing scheduled runs for privileged login
2023-03-03 07:58:27.390506+1100 0xbb410c   Debug       0x0                  59267  0    Outset: [io.macadmins.Outset:main] Cleaning up /private/tmp/.io.macadmins.outset.login-privileged.launchd
2023-03-03 07:58:37.741513+1100 0xbb4250   Debug       0x0                  59289  0    Outset: [io.macadmins.Outset:main] Processing scheduled runs for privileged login
2023-03-03 07:58:37.742257+1100 0xbb4250   Debug       0x0                  59289  0    Outset: [io.macadmins.Outset:main] Cleaning up /private/tmp/.io.macadmins.outset.login-privileged.launchd
2023-03-03 07:58:48.098441+1100 0xbb42e3   Debug       0x0                  59306  0    Outset: [io.macadmins.Outset:main] Processing scheduled runs for privileged login
2023-03-03 07:58:48.099162+1100 0xbb42e3   Debug       0x0                  59306  0    Outset: [io.macadmins.Outset:main] Cleaning up /private/tmp/.io.macadmins.outset.login-privileged.launchd
2023-03-03 07:58:58.448373+1100 0xbb4382   Debug       0x0                  59322  0    Outset: [io.macadmins.Outset:main] Processing scheduled runs for privileged login
2023-03-03 07:58:58.449105+1100 0xbb4382   Debug       0x0                  59322  0    Outset: [io.macadmins.Outset:main] Cleaning up /private/tmp/.io.macadmins.outset.login-privileged.launchd
2023-03-03 07:59:08.830059+1100 0xbb4434   Debug       0x0                  59339  0    Outset: [io.macadmins.Outset:main] Processing scheduled runs for privileged login
2023-03-03 07:59:08.830783+1100 0xbb4434   Debug       0x0                  59339  0    Outset: [io.macadmins.Outset:main] Cleaning up /private/tmp/.io.macadmins.outset.login-privileged.launchd
2023-03-03 07:59:19.197495+1100 0xbb44fb   Debug       0x0                  59360  0    Outset: [io.macadmins.Outset:main] Processing scheduled runs for privileged login
2023-03-03 07:59:19.198243+1100 0xbb44fb   Debug       0x0                  59360  0    Outset: [io.macadmins.Outset:main] Cleaning up /private/tmp/.io.macadmins.outset.login-privileged.launchd

The action to remove the trigger file does not appear to take place.

I hear-by offer to transfer the copyright as noted in the readme to whatever entity wishes to take it (macadmins.io or other appropriate entity capable of accepting it)

If you run outset --login to test a script, outset will run an infinite set of scheduled tasks.

log stream --predicate 'subsystem == "com.github.outset"' --debug --info
Filtering the log data using "subsystem == "com.github.outset""
Timestamp                       Thread     Type        Activity             PID    TTL
2023-01-12 13:32:18.415915-0800 0x12b2dd   Debug       0x0                  74262  0    outset: [com.github.outset:main] Processing scheduled runs for privileged login
2023-01-12 13:32:18.744910-0800 0x12b2dd   Debug       0x0                  74262  0    outset: [com.github.outset:main] ownerID for /usr/local/outset/login-privileged-every/upgradeWatcher.py : 0
2023-01-12 13:32:18.744985-0800 0x12b2dd   Debug       0x0                  74262  0    outset: [com.github.outset:main] posixPermissions for /usr/local/outset/login-privileged-every/upgradeWatcher.py : 755
2023-01-12 13:32:18.745072-0800 0x12b2dd   Debug       0x0                  74262  0    outset: [com.github.outset:main] Running task /usr/local/outset/login-privileged-every/upgradeWatcher.py
2023-01-12 13:32:19.285239-0800 0x12b2dd   Debug       0x0                  74262  0    outset: [com.github.outset:main] Completed task /usr/local/outset/login-privileged-every/upgradeWatcher.py with status 0
2023-01-12 13:32:29.309848-0800 0x12b389   Debug       0x0                  74306  0    outset: [com.github.outset:main] Processing scheduled runs for privileged login
2023-01-12 13:32:29.649458-0800 0x12b389   Debug       0x0                  74306  0    outset: [com.github.outset:main] ownerID for /usr/local/outset/login-privileged-every/upgradeWatcher.py : 0
2023-01-12 13:32:29.649522-0800 0x12b389   Debug       0x0                  74306  0    outset: [com.github.outset:main] posixPermissions for /usr/local/outset/login-privileged-every/upgradeWatcher.py : 755
2023-01-12 13:32:29.649583-0800 0x12b389   Debug       0x0                  74306  0    outset: [com.github.outset:main] Running task /usr/local/outset/login-privileged-every/upgradeWatcher.py
2023-01-12 13:32:30.193023-0800 0x12b389   Debug       0x0                  74306  0    outset: [com.github.outset:main] Completed task /usr/local/outset/login-privileged-every/upgradeWatcher.py with status 0
2023-01-12 13:32:40.222375-0800 0x12b404   Debug       0x0                  74316  0    outset: [com.github.outset:main] Processing scheduled runs for privileged login

Should move to using the new hotness.

https://developer.apple.com/documentation/servicemanagement/smappservice

The project needs to be updated to use the macadmins open source team and certificate. Also needs the necessary github actions set up.

There is a build script here https://github.com/macadmins/outset/blob/main/Package/generatePackage.zsh which might be able to be used as a basis for automation. I'm not up to speed with how github actions work so would need advice on how this is set up for ongoing maintenance if that's required.

Describe the bug
Outset attempts to migrate settings from Outset 3 (Python). If overrides are present in /usr/local/outset/share/com.chilcote.outset.plist, they are loaded correctly but are not saved to /Library/Preferences/io.macadmins.Outset.plist. This appears to be because the migration is triggered when Outset is running in a user context and thus does not have permission to write to /Library/Preferences. An error is reported that /usr/local/outset/share/com.chilcote.outset.plist could not be removed.

To Reproduce

1. Install Outset 3 (final Python version).
2. Add a script with executable privileges to the login-once folder.
3. Add an override for that file using the --add-override option.
4. Install Outset 4.
5. Reboot.
6. Login to any account.

Expected behaviour
Overrides are migrated and stored in /Library/Preferences/io.macadmins.Outset.plist. The preferences from Outset 3 are deleted.

Actual behaviour
Overrides are loaded upon login and stored in ~/Library/Preferences/io.macadmins.Outset.plist. Outset attempts to delete the preferences from Outset 3 but fails, reporting ERROR: /usr/local/outset/share/com.chilcote.outset.plist could not be removed. Because the preferences from Outset 3 are not deleted, the migration is attempted again on next login (to any account). This has the positive side effect of enforcing the override, since it gets loaded and saved to user-space settings, but it never goes away.

System Details:

• OS: macOS 13.6.3
• Architecture: only tested on Intel
• Version: 4.1.1.21918

Additional suggestion
It may not be worth the effort to fix this bug, since recreating the overrides in Outset 4 works and the number of Outset 3 holdouts (or even users who know how to use overrides) is not known. Documenting the fact that settings with overrides need to be manually migrated and old preferences manually deleted may be sufficient.

Describe the bug
Login Items Show 2 different entries for outset but I think there should only be one.

To Reproduce
Install Outset and check Login Items

Expected behavior
From the Wiki I was only expecting 1 Login Item entry for Outset

Screenshots

System Details:

• OS: 13.3.1
• Architecture: Intel
• Version: 4.0.21874

Additional context
Not sure if this is an issue but I thought I would ask.

Running an on-demand script with Outset 4.0.21874 after the first login (right after completing Setup Assistant) with the command /usr/local/outset/outset --on-demand results in the following output: INFO: User [currentUser] is not the current console user. Skipping on-demand run. (replace [currentUser] with the actual logged in local username).

Attempting to run the on-demand script by doing /usr/bin/touch /private/tmp/.io.macadmins.outset.ondemand.launchd has no visible effect.

To troubleshoot, I ran who | grep 'console' | awk '{print $1}' and got the following output:

_mbsetupuser
[currentUser]

I suspect the _mbsetupuser account still being active at this point in time is causing confusion.

The following plist paths in the wiki appear to be incorrect.

What happens during login?
It looks like /var/root/Library/Preferences/io.macadmins.Outset.plist should be /Library/Preferences/io.macadmins.Outset.plist

Adding Items to Override
It looks like /var/root/Library/Preferences/io.macadmins.Outset.plist should be /Library/Preferences/io.macadmins.Outset.plist

If Outset is configured to verify checksums and a .DS_Store file happens to exist in out of the Outset directories, an error is printed to the log.

This doesn't seem to cause any problems with processing other scripts, but it would be nice if Outset would simply ignore that file.

For my build process, I wrote a script to copy all of my scripts from a local repo into the Outset folder and then use outset-pkg to make the installer. When I copy those files, sometimes a .DS_Store can be included. Obviously I've improved my own build script to exclude .DS_Store files, but I think it would be nice if Outset ignored them by default.

Thanks for reading!

Right now script outputs and status is only logged with verbose mode on. I think this makes sense when scripts run without issue. However I think if a script writes to stderr or ends with a non-zero exit code it should be logged.

I'm not super well versed in Swift but if I have a moment I'll create a pull request to add this.

Delete all the local profile install related code as local installs of profiles are not supported on macOS anymore.

In versions less than 4 the override options were:
--add-override and --remove-override
See outset.py

In version 4 they are missing an 'r'
--add-overide and --remove-overide

The wiki also documents them as --add-override and --remove-override

To maintain compatibility with earlier versions the options should be changed

Describe the bug
In Outset Python, when an item was run (e.g., a script in login-once), the logs would show a line like:
2024-01-01 00:00:03 AM - INFO: Processing /usr/local/outset/login-every/login_script.sh

In this rewrite of Outset, this has been assigned as a DEBUG entry in the logs:
2024-01-01 00:00:04 DEBUG: Processing script /usr/local/outset/login-every/login_script.sh

Ideally, the behaviour in this implementation of Outset should match the previous behaviour.

To Reproduce

1. Place a script in the login-once or login-every folder within /usr/local/outset/, set to executable by all users.
2. Log in to an account so that Outset runs the item placed in the folder.
3. Examine the logs (/usr/local/outset/logs/outset.log in this version of Outset, /Users//Library/Logs/outset.log in Outset Python).

Expected behaviour
That the output should be the same or similar between this version of Outset and Outset Python.

Actual Behaviour
Outset Python shows a line like:
2024-01-01 00:00:03 AM - INFO: Processing /usr/local/outset/login-every/login_script.sh
This version of Outset only shows this information if verbose_logging is turned on in its preferences.

System Details:

• OS: macOS 13.6.4, 17.4RC
• Architecture: Intel and Apple Silicon M1 respectively
• Version: 4.1.1.21918

If a device has already had login scripts ran, migrating to this newer Swift version will run the same scripts again.

An error in the packaged version:

/usr/local/outset/outset --login
ERROR: plist import failed
INFO:

Looks also like it's also not writing to the same levels as the python preferences:

defaults read ~/Library/Preferences/com.github.outset.once
{
    "/usr/local/outset/login-once/first_time_setup.py" = "2023-01-12 12:58:59 +0000";
    "override_login_once" =     {
        "/usr/local/outset/login-once/first_time_setup.py" = "2023-01-12 20:55:48 +0000";
    };
}

This may already be fixed in newer versions, but logging as issue in case it's not