AutoPkg Failed Local trust verification

[adam cowie]

I am trying to download the new version of keyserver, and this is what I keep running into. 

deploystudio:~ local$ autopkg make-override SassafrasK2Client.munki

Override file saved to /Users/local/Library/AutoPkg/RecipeOverrides/SassafrasK2Client.munki.recipe

deploystudio:~ local$ autopkg update-trust-info SassafrasK2Client.munki

Wrote updated /Users/local/Library/AutoPkg/RecipeOverrides/SassafrasK2Client.munki.recipe

deploystudio:~ local$ autopkg run -v SassafrasK2Client.munki

Processing SassafrasK2Client.munki...

Failed local trust verification.

Receipt written to /tmp/receipts/SassafrasK2Client-receipt-20170822-091827.plist

The following recipes failed:

    SassafrasK2Client.munki

        Parent recipe local.munki.SassafrasK2Client contents differ from expected.

            Path: /Users/local/Library/AutoPkg/RecipeOverrides/SassafrasK2Client.munki.recipe

Nothing downloaded, packaged or imported.

What am I missing?  Any help as always is greatly appreciated.

Thanks,

Adam

[Matt Childress]

See this pull request on GitHub --

https://github.com/autopkg/recipes/pull/216

Usually when I have a problem with a recipe trust info I head to the GitHub repo and look to compare the current and previous versions -- when the lastest update occurred and actually eyeball the code to verify it looks legit.

Then if that hasn't been updated I look for issues and pull requests (fixes by other folks to the maintainer)

M@

Sent from my iThneed

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discu...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[adam cowie]

pardon my ignorance, but do I have to do anything on my end? or is this something that needs to be updated elsewhere? 

[Marnin Goldberg]

 

 

From: <autopkg...@googlegroups.com> on behalf of Matt Childress <chil...@gmail.com>
Reply-To: <autopkg...@googlegroups.com>
Date: Tuesday, August 22, 2017 at 10:24 AM
To: <autopkg...@googlegroups.com>
Subject: Re: [autopkg-discuss] AutoPkg Failed Local trust verification

 

See this pull request on GitHub --

 

https://github.com/autopkg/recipes/pull/216

 

Usually when I have a problem with a recipe trust info I head to the GitHub repo and look to compare the current and previous versions -- when the lastest update occurred and actually eyeball the code to verify it looks legit.

 

You can also run: autopkg verify-trust-info -vv /Path/To/Override to see what changed.

 

Then, when you are ok with what changed, run: autopkg update-trust-info /Path/To/Override to update the trust info.

 

For the general workflow read: https://github.com/autopkg/autopkg/wiki/AutoPkg-and-recipe-parent-trust-info#general-workflow

 

 

Marnin

 

[Matt Childress]

Thanks for that pointer!  Very helpful!

M@

[adam cowie]

[adam cowie]

I am having more issues with AutoPkgr and trust issues.  I went through and ran autopkg verify-trust-info for all of my Recipes and they are all okay.  When I go through and autopkg run and select all my Recipe overrides they run just fine.  However in AutoPkgr when I click Run Recipes Now I get a number of Recipes failing without trust issues.  For example Gimp fails but here is my terminal command deploystudio:~ local$ autopkg verify-trust-info Gimp.munki

Gimp.munki: OK

Here is my email:

New software was downloaded:

NAME	VERSION
Excel2016_update_fr-15.40.17110800	Unknown version
PowerPoint2016_update_fr-15.40.17110800	Unknown version
Dropbox	39.4.49
VLC	2.2.6
Word2016_update_fr-15.40.17110800	Unknown version
OneNote2016_update_fr-15.40.17110800	Unknown version
Outlook2016_update_fr-15.40.17110800	Unknown version

The following failures occurred:

RECIPE	MESSAGE
com.github.n8felton.munki.AppleXeroxPrinterDrivers	Error in com.github.n8felton.munki.AppleXeroxPrinterDrivers: Processor: com.github.n8felton.shared/AppleSupportDownloadInfoProvider: Error: Can't download https://support.apple.com/downloads/DL1861/en_US/: HTTP Error 404: Not Found
com.github.n8felton.munki.AppleHPPrinterDrivers	Error in com.github.n8felton.munki.AppleHPPrinterDrivers: Processor: com.github.n8felton.shared/AppleSupportDownloadInfoProvider: Error: Can't download https://support.apple.com/downloads/DL1888/en_US/: HTTP Error 404: Not Found

The following errors occurred: 

• WARNING: com.github.n8felton.munki.AppleXeroxPrinterDrivers is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... Can&apos;t download https://support.apple.com/downloads/DL1861/en_US/: HTTP Error 404: Not Found WARNING: com.github.n8felton.munki.AppleHPPrinterDrivers is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... Can&apos;t download https://support.apple.com/downloads/DL1888/en_US/: HTTP Error 404: Not Found WARNING: com.github.autopkg.munki.FlashPlayerNoRepackage is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.aysiu.munki.MalwarebytesAntiMalware is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.ygini.munki.MSPowerPoint2016Updates-fr_FR is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.ygini.munki.MSOneNote2016Updates-fr_FR is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.ygini.munki.MSWord2016Updates-fr_FR is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.ygini.munki.MSOutlook2016Updates-fr_FR is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.jps3.munki.WacomIntuosProTabletDriver is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.VLC is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.textwrangler is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.Skype is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.OracleJava8 is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.luisgiraldo.munki.omnidisksweeper is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: io.github.hjuutilainen.munki.LibreOffice is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.google-chrome is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.firefox-rc-en_US is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.ygini.munki.MSExcel2016Updates-fr_FR is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.dropbox is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.AdobeReader is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: com.github.autopkg.munki.sassafras-k2client is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: io.github.hjuutilainen.munki.GIMP is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... WARNING: MakeCatalogs.munki is missing trust info and FAIL_RECIPES_WITHOUT_TRUST_INFO is not set. Proceeding... 

The following new items were downloaded:

• /Users/local/Library/AutoPkg/Cache/com.github.ygini.munki.MSPowerPoint2016Updates-fr_FR/downloads/PowerPoint2016_update_fr-15.40.17110800.pkg
• /Users/local/Library/AutoPkg/Cache/com.github.ygini.munki.MSOneNote2016Updates-fr_FR/downloads/OneNote2016_update_fr-15.40.17110800.pkg
• /Users/local/Library/AutoPkg/Cache/com.github.ygini.munki.MSWord2016Updates-fr_FR/downloads/Word2016_update_fr-15.40.17110800.pkg
• /Users/local/Library/AutoPkg/Cache/com.github.ygini.munki.MSOutlook2016Updates-fr_FR/downloads/Outlook2016_update_fr-15.40.17110800.pkg
• /Users/local/Library/AutoPkg/Cache/com.github.autopkg.munki.VLC/downloads/VLC.dmg
• /Users/local/Library/AutoPkg/Cache/com.github.ygini.munki.MSExcel2016Updates-fr_FR/downloads/Excel2016_update_fr-15.40.17110800.pkg
• /Users/local/Library/AutoPkg/Cache/com.github.autopkg.munki.dropbox/downloads/Dropbox.dmg

The following new items were imported into Munki:

NAME	VERSION	CATALOG	PKGINFO PATH	PKG REPO PATH
PowerPoint2016_update_fr	15.40.17110800	testing	office/2016/updates/PowerPoint2016_update_fr-15.40.17110800.plist	office/2016/updates/PowerPoint2016_update_fr-15.40.17110800.pkg
OneNote2016_update_fr	15.40.17110800	testing	office/2016/updates/OneNote2016_update_fr-15.40.17110800.plist	office/2016/updates/OneNote2016_update_fr-15.40.17110800.pkg
Word2016_update_fr	15.40.17110800	testing	office/2016/updates/Word2016_update_fr-15.40.17110800.plist	office/2016/updates/Word2016_update_fr-15.40.17110800.pkg
Outlook2016_update_fr	15.40.17110800	testing	office/2016/updates/Outlook2016_update_fr-15.40.17110800.plist	office/2016/updates/Outlook2016_update_fr-15.40.17110800.pkg
Excel2016_update_fr	15.40.17110800	testing	office/2016/updates/Excel2016_update_fr-15.40.17110800.plist	office/2016/updates/Excel2016_update_fr-15.40.17110800.pkg
Dropbox	39.4.49	testing	apps/Dropbox/Dropbox-39.4.49.plist	apps/Dropbox/Dropbox-39.4.49.dmg

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsub...@googlegroups.com.

[Nick McSpadden]

None of those failed because of trust. They just warned you that trust info is missing. Only two recipes failed, and that's due to 404 errors on the URLs they tried to download.

In other words, it worked as intended. You just have a bunch of recipes without trust info in your overrides.

Here is my email:

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

--
Nick McSpadden
nmcsp...@gmail.com

[Gregory Neagle]

On Nov 15, 2017, at 6:43 AM, Nick McSpadden <nmcsp...@gmail.com> wrote:

None of those failed because of trust. They just warned you that trust info is missing. Only two recipes failed, and that's due to 404 errors on the URLs they tried to download.

In other words, it worked as intended. You just have a bunch of recipes without trust info in your overrides.

Or AutoPkg_r_ (note this list doesn't actually support AutoPkgr) is actually running the parent recipes and not the overrides.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discu...@googlegroups.com.

[Anthony Reimer]

>
> On Nov 15, 2017, at 6:53 AM, adam cowie <adamm...@gmail.com> wrote:
>
> RECIPE MESSAGE
> com.github.n8felton.munki.AppleXeroxPrinterDrivers Error in com.github.n8felton.munki.AppleXeroxPrinterDrivers: Processor: com.github.n8felton.shared/AppleSupportDownloadInfoProvider: Error: Can&apos;t download https://support.apple.com/downloads/DL1861/en_US/:HTTP Error 404: Not Found
> com.github.n8felton.munki.AppleHPPrinterDrivers Error in com.github.n8felton.munki.AppleHPPrinterDrivers: Processor: com.github.n8felton.shared/AppleSupportDownloadInfoProvider: Error: Can&apos;t download https://support.apple.com/downloads/DL1888/en_US/:HTTP Error 404: Not Found

Just to narrow this down a bit, Nate Felton posted this note in the Mac Admins Slack on Monday:

Heads up that it appears Apple has changed some things on its site and `AppleSupportDownloadInfoProvider` is currently not working,
which also means all of my Apple Printer Driver recipes are currently not working


Anthony Reimer

[adam cowie]

Okay thank you for the info.  I went through and ran autopkg update-trust-info for all of my recipes and AutoPkgr is still saying missing trust info.  I also tried deleting a recipe override and then updating trust info again still the same thing.  What am I missing?

Adam

Here is my email:

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discu...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Erik Gomez]

Adam,

Some may disagree with me on this, but I think you should stop using AutoPkgR and simply use autopkg.

AutoPkgR was never updated for trust info and it's highly doubtful it will ever be updated: https://github.com/lindegroup/autopkgr/wiki/AutoPkgr----past,-present,-and-future

As autopkg features continue to be written, AutoPkgR will continue to have issues like this. If AutoPkgR gives you functionality that is not present in autopkg core, I'm sure someone has an extension/script that could help you get that functionality back.

Thanks,

Erik Gomez

---

From: autopkg...@googlegroups.com <autopkg...@googlegroups.com> on behalf of adam cowie <adamm...@gmail.com>
Sent: Wednesday, November 15, 2017 10:26:14 AM
To: autopkg-discuss

[Mr. Alan Siu]

Cheap plug for an interactive script I wrote that updates all the repos, tries to verify the trust info, presents you with differences, allows you to approve the changes, and then runs all the recipes in the list. It's not perfect (no validation the input file is formatted correctly, no logging), but it works for me.

https://github.com/aysiu/Mac-Scripts-and-Profiles/blob/master/AutoPkgReviewAndRun.py

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

On Wed, Nov 15, 2017 at 8:44 AM, Erik Gomez <eriknico...@gmail.com> wrote:

Adam,

Some may disagree with me on this, but I think you should stop using AutoPkgR and simply use autopkg.

AutoPkgR was never updated for trust info and it's highly doubtful it will ever be updated: https://github.com/lindegroup/autopkgr/wiki/AutoPkgr----past,-present,-and-future

As autopkg features continue to be written, AutoPkgR will continue to have issues like this. If AutoPkgR gives you functionality that is not present in autopkg core, I'm sure someone has an extension/script that could help you get that functionality back.

Thanks,

Erik Gomez

---

From: autopkg-discuss@googlegroups.com <autopkg-discuss@googlegroups.com> on behalf of adam cowie <adamm...@gmail.com>

Adam

Here is my email:

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discu...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

--
Nick McSpadden
nmcsp...@gmail.com

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

[Matt Childress]

Wow!   I didn’t realize AutoPkgR was in software limbo…

It seemed to be replacing a lot of what can be rolled by hand integrating AutoPkg with Jenkins (or another Continuous Integration Server)… email notifications, scheduling, etc.

Good to know, 

M@

[Mr. Alan Siu]

Yeah, latest commit was 8 months ago, I think.

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

On Wed, Nov 15, 2017 at 8:50 AM, Matt Childress <chil...@gmail.com> wrote:

Wow!   I didn’t realize AutoPkgR was in software limbo…

It seemed to be replacing a lot of what can be rolled by hand integrating AutoPkg with Jenkins (or another Continuous Integration Server)… email notifications, scheduling, etc.

Good to know, 

M@

On Nov 15, 2017, at 10:44 AM, Erik Gomez <eriknico...@gmail.com> wrote:

Adam,

Some may disagree with me on this, but I think you should stop using AutoPkgR and simply use autopkg.

AutoPkgR was never updated for trust info and it's highly doubtful it will ever be updated: https://github.com/lindegroup/autopkgr/wiki/AutoPkgr----past,-present,-and-future

As autopkg features continue to be written, AutoPkgR will continue to have issues like this. If AutoPkgR gives you functionality that is not present in autopkg core, I'm sure someone has an extension/script that could help you get that functionality back.

Thanks,

Erik Gomez

---

From: autopkg-discuss@googlegroups.com <autopkg-discuss@googlegroups.com> on behalf of adam cowie <adamm...@gmail.com>

Adam

Here is my email:

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discu...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

--
Nick McSpadden
nmcsp...@gmail.com

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "autopkg-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autopkg-discuss+unsubscribe@googlegroups.com.