Munki not installing updates from Reposado on El Capitan

[sondjata]

Cross posted on Reposado group:

So I'm testing my install image and noticed that iTunes 12.3 kept popping up. Further testing shows a failure to install.

managedsoftwareupdate.log:

 The following Apple Software Updates are available to install:

        + Digital Camera RAW Compatibility Update-6.17

        + iTunes-12.3

Installing available Apple Software Updates...

    softwareupdate: Changed catalog to http://[FQDN of server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog

    RAWCameraUpdate6.17-6.17: No such update...

    iTunesX-12.3: No such update...

    No updates are available.

    softwareupdate: Changed catalog to Apple production

WARNING: Apple update Digital Camera RAW Compatibility Update, 031-41757 failed to install. No record of success or failure.

WARNING: Apple update iTunes, zzzz031-36653 failed to install. No record of success or failure.

Finishing...

    Performing postflight tasks...

    postflight stdout: Postflight report submmitted for Ch140-0DGF8J8(Test-138).

Done.

Tailing the system log shows:

ct 20 13:49:44 Ch140-0DGF8J8 sandboxd[176] ([409]): softwareupdated(409) deny system-fsctl 0x682f

Oct 20 13:49:46 --- last message repeated 3 times ---

Oct 20 13:49:46 Ch140-0DGF8J8 sandboxd[176] ([713]): softwareupdate_d(713) deny system-fsctl 0x682f

Oct 20 13:49:46 Ch140-0DGF8J8 kernel[0]: Sandbox: softwareupdated(409) deny(1) system-fsctl 682f

Oct 20 13:49:46 --- last message repeated 1 time ---

Oct 20 13:49:46 Ch140-0DGF8J8 kernel[0]: Sandbox: softwareupdate_d(713) deny(1) system-fsctl 682f

Oct 20 13:49:46 Ch140-0DGF8J8 kernel[0]: Sandbox: softwareupdated(409) deny(1) system-fsctl 682f

Oct 20 13:49:46 Ch140-0DGF8J8 nsurlstoraged[714]: realpath() returned NULL for /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate

Oct 20 13:49:55 --- last message repeated 966 times ---

Oct 20 13:49:55 Ch140-0DGF8J8 kernel[0]: Sandbox: softwareupdated(409) deny(1) system-fsctl 682f

Oct 20 13:49:57 --- last message repeated 3 times ---

Oct 20 13:49:57 Ch140-0DGF8J8 launchservicesd[73]: SecTaskLoadEntitlements failed error=22

Oct 20 13:49:57 Ch140-0DGF8J8 kernel[0]: Sandbox: softwareupdated(409) deny(1) system-fsctl 682f

Oct 20 13:49:57 Ch140-0DGF8J8 kernel[0]: Sandbox: softwareupdate_d(713) deny(1) system-fsctl 682f

Oct 20 13:49:57 Ch140-0DGF8J8 kernel[0]: Sandbox: softwareupdated(409) deny(1) system-fsctl 682f

Oct 20 13:49:58 Ch140-0DGF8J8 nsurlstoraged[714]: realpath() returned NULL for /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate

Any Ideas?

Reposado is up to date. 10.10.x systems are updating as expected

Munki V 2.3.1.2535

[Erik Gomez]

Do you have a caching server?

Can you post the full install.log?

Sent from my iPhone

--
Find related discussion groups here:
https://github.com/munki/munki/wiki/Discussion-Group
---
You received this message because you are subscribed to the Google Groups "munki-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to munki-dev+...@googlegroups.com.
To post to this group, send email to munk...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[sondjata]

quick update. clean base image.

used terminal to:

softwareupdate --set-catalog to reposado catalog

did software update --list

that showed the updates (in this case iTunes 12.3, etc)

ran

softwareupdate --install -a

success

So that leaves Munki...

Off to try another install via Munki rather than software update command line.

[sondjata]

and re-image. checking apache logs confirms software update and Munki talking to local repo as expected. Still no luck.

[Gregory Neagle]

Here’s a successful install here:

Oct 20 2015 10:27:06 -0700     The following Apple Software Updates are available to install:

Oct 20 2015 10:27:06 -0700         + Digital Camera RAW Compatibility Update-6.17

Oct 20 2015 10:27:06 -0700 Installing available Apple Software Updates...

Oct 20 2015 10:27:06 -0700     softwareupdate: Changed catalog to http://su.redacted.com/index_testing.sucatalog

Oct 20 2015 10:27:07 -0700 Installing Digital Camera RAW Compatibility Update

Oct 20 2015 10:27:39 -0700     Done with Digital Camera RAW Compatibility Update

Oct 20 2015 10:27:39 -0700     Done.

Oct 20 2015 10:27:39 -0700     softwareupdate: Changed catalog to http://su.redacted.com/index_testing.sucatalog

Oct 20 2015 10:27:40 -0700 Finishing...

A difference that jumps out at me is that your failed installs end with 'softwareupdate: Changed catalog to Apple production’

Do you have SoftwareUpdateServerURL set in Munki’s preferences (typically /Library/Preferences/ManagedInstalls.plist) ?

-Greg

[sondjata]

I do not have "SoftwareUpdateServerURL" set in ManagedInstalls.plist.

I do have "SoftwareRepoURL" for the Munki repo and InstallAppleUpdates set to true.

I guess I missed a change to the ManagedInstalls.plist settings?

[sondjata]

Also. If it's the issue, then does that supersede what's written in /usr/local/munki/munkilib/appleupdates.py ?

My understanding was that was what determined where softwareupdate as callled by Munki, looked for Apple updates.

On Tuesday, October 20, 2015 at 2:21:20 PM UTC-4, sondjata wrote:

[Gregory Neagle]

https://github.com/munki/munki/wiki/Apple-Software-Updates-With-Munki#el-capitan-notes

[sondjata]

Well there it is.

Thanks.

[sondjata]

OK. Added the Catalog URL to  /Library/Preferences/com.apple.softwareupdate.plist.  and while running the install I saw the URL re-written and the install fail.

In fact watching Managed Software Center do it's scheduled check it rewrote (and removed) the CatalogURL.

Greg. When you posted your test, did you have a modified Appleupdates.py file with your local sus specified?

[sondjata]

Removing the local URL for our Reposado server from Appleupdates.py results in:

  File "/usr/local/munki/managedsoftwareupdate", line 1038, in <module>

    main()

  File "/usr/local/munki/managedsoftwareupdate", line 833, in main

    mustrestart = doInstallTasks(appleupdatesavailable)

  File "/usr/local/munki/managedsoftwareupdate", line 233, in doInstallTasks

    only_unattended=only_unattended)

  File "/usr/local/munki/munkilib/appleupdates.py", line 1685, in installAppleUpdates

    only_unattended=only_unattended)

  File "/usr/local/munki/munkilib/appleupdates.py", line 1433, in InstallAppleUpdates

    catalog_url = self._GetAppleCatalogURL()

  File "/usr/local/munki/munkilib/appleupdates.py", line 696, in _GetAppleCatalogURL

    'No default Software Update CatalogURL for: %s' % os_version)

munkilib.appleupdates.CatalogNotFoundError: No default Software Update CatalogURL for: 10.11

So that's not it either.

[sondjata]

Install log:

managedsoftwareupdate --checkonly

Oct 21 11:03:50 CH140-0DGF8J8 softwareupdated[432]: BackgroundActivity: Got CheckForCatalogChange

Oct 21 11:03:50 CH140-0DGF8J8 softwareupdated[432]: softwareupdated: Catalog URL changed (from "http://[sus-server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog" to "<default>"). Resetting state.

Oct 21 11:03:50 CH140-0DGF8J8 DownloadService[1052]: Resetting state of download service

Oct 21 11:10:22 CH140-0DGF8J8 softwareupdated[432]: BackgroundActivity: Got CheckForCatalogChange

Oct 21 11:10:22 CH140-0DGF8J8 softwareupdated[432]: softwareupdated: Catalog URL changed (from "<default>" to "http://149.151.151.98/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog"). Resetting state.

Oct 21 11:10:22 CH140-0DGF8J8 softwareupdated[432]: Adding client SUUpdateServiceClient pid=7731, uid=0, installAuth=NO rights=(), transactions=0 (/usr/sbin/softwareupdate)

Oct 21 11:10:22 CH140-0DGF8J8 DownloadService[1052]: Resetting state of download service

Oct 21 11:10:22 CH140-0DGF8J8 softwareupdated[432]: SUScan: Scan for client pid 432 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated)

Oct 21 11:10:22 CH140-0DGF8J8 softwareupdated[432]: SUScan: Using catalog http://[sus-server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog

Oct 21 11:10:28 CH140-0DGF8J8 softwareupdated[432]: JS: 10.11

Oct 21 11:10:31 CH140-0DGF8J8 softwareupdated[432]: SUScan: Elapsed scan time = 9.3

Oct 21 11:10:31 CH140-0DGF8J8 softwareupdated[432]: Scan (f=1, d=0) completed 

Oct 21 11:10:31 CH140-0DGF8J8 softwareupdated[432]: 8 updates found:

031-04978 | CoreLSKD Configuration Data 8

031-33027 | MRT Configuration Data 1.2

031-34599 | Gatekeeper Configuration Data 81

031-37830 | Core Suggestions Configuration Data 707

031-38223 | Chinese Word List Update 4.2

031-38723 | XProtectPlistConfigData 1.0

031-41757 | Digital Camera RAW Compatibility Update 6.17

zzzz031-36653 | iTunes 12.3

Oct 21 11:10:32 CH140-0DGF8J8 softwareupdated[432]: Ramped updates marked

Oct 21 11:10:32 CH140-0DGF8J8 softwareupdated[432]: Removing client SUUpdateServiceClient pid=7731, uid=0, installAuth=NO rights=(), transactions=0 (/usr/sbin/softwareupdate)

Oct 21 11:10:33 CH140-0DGF8J8 softwareupdated[432]: BackgroundActivity: Got CheckForCatalogChange

Oct 21 11:10:33 CH140-0DGF8J8 softwareupdated[432]: softwareupdated: Catalog URL changed (from "http://[sus-server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog" to "<default>"). Resetting state.

Oct 21 11:10:33 CH140-0DGF8J8 softwareupdated[432]: BackgroundActivity: Got CheckForCatalogChange

Oct 21 11:10:34 CH140-0DGF8J8 DownloadService[1052]: Resetting state of download service

Oct 21 11:10:34 CH140-0DGF8J8 softwareupdated[432]: Adding client SUUpdateServiceClient pid=7751, uid=0, installAuth=NO rights=(), transactions=0 (/usr/sbin/softwareupdate)

Oct 21 11:10:34 CH140-0DGF8J8 softwareupdated[432]: softwareupdated: Catalog URL changed (from "<default>" to "http://[sus-server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog"). Resetting state.

Oct 21 11:10:34 CH140-0DGF8J8 installd[370]: PackageKit: Adding client PKInstallDaemonClient pid=432, uid=200 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated)

Oct 21 11:10:34 CH140-0DGF8J8 DownloadService[1052]: Resetting state of download service

Oct 21 11:10:34 CH140-0DGF8J8 softwareupdated[432]: SUScan: Scan for client pid 432 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated)

Oct 21 11:10:34 CH140-0DGF8J8 softwareupdated[432]: SUScan: Using catalog http://[sus-server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog

Oct 21 11:10:40 CH140-0DGF8J8 softwareupdated[432]: JS: 10.11

Oct 21 11:10:43 CH140-0DGF8J8 softwareupdated[432]: SUScan: Elapsed scan time = 9.2

Oct 21 11:10:43 CH140-0DGF8J8 softwareupdated[432]: Scan (f=1, d=0) completed 

Oct 21 11:10:43 CH140-0DGF8J8 softwareupdated[432]: 8 updates found:

031-04978 | CoreLSKD Configuration Data 8

031-33027 | MRT Configuration Data 1.2

031-34599 | Gatekeeper Configuration Data 81

031-37830 | Core Suggestions Configuration Data 707

031-38223 | Chinese Word List Update 4.2

031-38723 | XProtectPlistConfigData 1.0

031-41757 | Digital Camera RAW Compatibility Update 6.17

zzzz031-36653 | iTunes 12.3

Oct 21 11:10:43 CH140-0DGF8J8 softwareupdated[432]: Ramped updates marked

Oct 21 11:10:44 CH140-0DGF8J8 softwareupdated[432]: SoftwareUpdate: Added foreground transaction [0x9] for RAWCameraUpdate6.17-6.17, iTunesX-12.3

Oct 21 11:10:44 CH140-0DGF8J8 softwareupdated[432]: Stopping transaction with ID [0x9]

Oct 21 11:10:44 CH140-0DGF8J8 softwareupdated[432]: SoftwareUpdate: Removed foreground transaction [0x9]

Oct 21 11:10:44 CH140-0DGF8J8 softwareupdated[432]: Removing client SUUpdateServiceClient pid=7751, uid=0, installAuth=YES rights=(system.install.apple-software, system.install.apple-software.standard-user, system.install.software, com.apple.SoftwareUpdate.modify-settings), transactions=0 (/usr/sbin/softwareupdate)

Oct 21 11:10:44 CH140-0DGF8J8 softwareupdated[432]: Running session-idle tasks.

Oct 21 11:10:44 CH140-0DGF8J8 softwareupdated[432]: Checking for inapplicable local products remaining on disk for cleanup

Oct 21 11:10:45 CH140-0DGF8J8 softwareupdated[432]: BackgroundActivity: Got CheckForCatalogChange

Managedsoftwareupdate --installonly 

Oct 21 11:10:45 CH140-0DGF8J8 softwareupdated[432]: softwareupdated: Catalog URL changed (from "http://[su server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog" to "<default>"). Resetting state.

Oct 21 11:10:45 CH140-0DGF8J8 DownloadService[1052]: Resetting state of download service

Oct 21 11:13:05 CH140-0DGF8J8 softwareupdated[432]: BackgroundActivity: Got CheckForCatalogChange

Oct 21 11:13:05 CH140-0DGF8J8 softwareupdated[432]: softwareupdated: Catalog URL changed (from "<default>" to "http://[su server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog"). Resetting state.

Oct 21 11:13:05 CH140-0DGF8J8 softwareupdated[432]: Adding client SUUpdateServiceClient pid=7833, uid=0, installAuth=NO rights=(), transactions=0 (/usr/sbin/softwareupdate)

Oct 21 11:13:05 CH140-0DGF8J8 installd[370]: PackageKit: Adding client PKInstallDaemonClient pid=432, uid=200 (/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated)

Oct 21 11:13:06 CH140-0DGF8J8 DownloadService[1052]: Resetting state of download service

Oct 21 11:13:06 CH140-0DGF8J8 softwareupdated[432]: Removing client SUUpdateServiceClient pid=7833, uid=0, installAuth=YES rights=(system.install.apple-software, system.install.apple-software.standard-user, system.install.software, com.apple.SoftwareUpdate.modify-settings), transactions=1 (/usr/sbin/softwareupdate)

Oct 21 11:13:06 CH140-0DGF8J8 softwareupdated[432]: BackgroundActivity: Got CheckForCatalogChange

Oct 21 11:13:07 CH140-0DGF8J8 softwareupdated[432]: softwareupdated: Catalog URL changed (from "http://[su server]/Reposado/html/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Allowed.sucatalog" to "<default>"). Resetting state.

 

[Gregory Neagle]

I don’t understand why you are modifying appleupdates.py.

-Greg

[sondjata]

Ever since I set up Reposado I have changed appleupdates.py to point to the in house update server. My understanding has been that this was the way to have a client reach out to the local server rather than Apple's.  I don't remember where I got that direction from but it certainly wasn't by accident and has been working for years.

I guess it's broken now and I've got to correct it.

[Gregory Neagle]

On Oct 21, 2015, at 8:46 AM, sondjata <sond...@gmail.com> wrote:

Ever since I set up Reposado I have changed appleupdates.py to point to the in house update server. My understanding has been that this was the way to have a client reach out to the local server rather than Apple's.  

No — that’s _never_ been recommended.

[sondjata]

OK. Going to reset this stuff up.

[sondjata]

Thanks for everyone who chimed in. with all the log watching and such I neglected to kill softwareupdated which kept blowing away my changes to com.apple.softwareupdate.plist.

Rebooted and the change stuck and updates proceeded normally with this modification.

[Mike Solin]

If I’m setting SoftwareUpdateServerURL in /Library/Preferences/ManagedInstalls.plist and setting the CatalogURL in /Library/Preferences/com.apple.SoftwareUpdate.plist, is there any danger of running into the problem described on OS X 10.11?

If so, and I push a ‘defaults delete’ for SoftwareUpdateServerURL, will this negatively affect my OS X clients running older versions?  At the moment, I still have about 60 OS X 10.7/10.8 clients - trying to bring everything up to date, but it’s slow going.

Mike

--

mi...@mikesolin.com / @flammable

http://mikesolin.com

--

[Gregory Neagle]

On Oct 21, 2015, at 4:57 PM, Mike Solin <mi...@mikesolin.com> wrote:

If I’m setting SoftwareUpdateServerURL in /Library/Preferences/ManagedInstalls.plist and setting the CatalogURL in /Library/Preferences/com.apple.SoftwareUpdate.plist, is there any danger of running into the problem described on OS X 10.11?

We don’t know yet — we don’t understand the problem well enough or what exactly is triggering it.

If so, and I push a ‘defaults delete’ for SoftwareUpdateServerURL, will this negatively affect my OS X clients running older versions? 

If both URLs are the same, then no.

The _only_ reason to have ever used ManagedInstalls’ SoftwareUpdateServerURL was to set a _different_ catalog URL than the one “normally” used by SoftwareUpdate. So if that’s what you are doing, deleting the SoftwareUpdateServerURL would cause Munki to start using the system’s “normal” CatalogURL for Apple updates.

[Mike Solin]

Excellent.  Thanks, Greg - I’ll remove SoftwareUpdateServerURL.  Both have always been the same in my environment.

Mike

--

mi...@mikesolin.com / @flammable

http://mikesolin.com

[Lee Ramsay]

Greg et al,

Does anyone know in El Cap if the softwareupdate CLI utility honours a caching server, if the caching server is "properly configured"?

Lee

[Erik Gomez]

Yes, however be careful. 

https://onemoreadmin.wordpress.com/2015/10/21/the-evil-triangle-el-capitan-sus-and-caching/

Sent from my iPhone

[Kyle Vitale]

Now that the public beta of 10.11.2 is out, anyone test to see if this is still an issue? This evil triangle is, well, evil.