Early experimental Universal2 build of Munki 5.3

[Gregory Neagle]

https://github.com/munki/munki/releases/tag/v5.3.0a1

This is an early experimental build of Munki 5.3 that should be Universal and run natively on Apple Silicon. Visit the link for more information.

-Greg

[Kevin M. Cox]

Only had time for a quick test tonight and managedsoftwareupdate won't run on my Apple Silicon MBP.

sudo managedsoftwareupdate -a

zsh: killed     sudo managedsoftwareupdate -a

Under bash I get "Killed: 9"

5.2 does works fine on this machine.

-- Kevin

[Stephen Boyle]

Just tested - managedsoftwareupdate seems to crash:

bash-3.2# managedsoftwareupdate -v

Killed: 9

seems to be an error in munki-python:

bash-3.2# /usr/local/munki/munki-python 

Killed: 9

What can I do to get some more useful info? I don't seem to see any crashreports.

[Gregory Neagle]

Try

codesign -s -  /usr/local/munki/Python.framework/Versions/3.9/bin/python3.9

Sent from my iPhone

On Nov 29, 2020, at 5:54 PM, Stephen Boyle <ste...@thirdvantage.com> wrote:

Just tested - managedsoftwareupdate seems to crash:

--
Find related discussion groups here:
https://github.com/munki/munki/wiki/Discussion-Group
---
You received this message because you are subscribed to the Google Groups "munki-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to munki-dev+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/69bbab98-4425-4d91-9832-bf2cbf0dbb47n%40googlegroups.com.

[Stephen Boyle]

Here is my output- Thanks:

sphensilhagen:~ sphen$ sudo codesign -s -  /usr/local/munki/Python.framework/Versions/3.9/bin/python3.9

objc[61462]: Class AMSupportURLConnectionDelegate is implemented in both ?? (0x1ef92a7a0) and ?? (0x1145542b8). One of the two will be used. Which one is undefined.

objc[61462]: Class AMSupportURLSession is implemented in both ?? (0x1ef92a7f0) and ?? (0x114554308). One of the two will be used. Which one is undefined.

sphensilhagen:~ sphen$ sudo codesign -v -v /usr/local/munki/Python.framework/Versions/3.9/bin/python3.9

/usr/local/munki/Python.framework/Versions/3.9/bin/python3.9: valid on disk

/usr/local/munki/Python.framework/Versions/3.9/bin/python3.9: satisfies its Designated Requirement

sphensilhagen:~ sphen$ /usr/local/munki/munki-python 

dyld: Library not loaded: @rpath/Versions/3.9/Python

  Referenced from: /usr/local/munki/munki-python

  Reason: no suitable image found.  Did find:

/usr/local/munki/Python.framework/Versions/3.9/bin/../../../Versions/3.9/Python: code signature in (/usr/local/munki/Python.framework/Versions/3.9/bin/../../../Versions/3.9/Python) not valid for use in process using Library Validation: Trying to load an unsigned library

/usr/local/munki/Python.framework/Versions/3.9/bin/../../../Versions/3.9/Python: stat() failed with errno=1

Abort trap: 6

sphensilhagen:~ sphen$ spctl --assess -v /usr/local/munki/Python.framework/Versions/3.9/bin/python3.9

objc[61887]: Class SPExecutionPolicy is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class AppWrapper is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class AppWrapperPolicyResult is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class AppWrapperPolicy is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class SPLog is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class MIS is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class SPExecutionHistoryItem is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class SPExecutionPolicyItem is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class SPDeveloperPolicy is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

objc[61887]: Class GKScanResult is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.

/usr/local/munki/Python.framework/Versions/3.9/bin/python3.9: rejected

[Gregory Neagle]

Seems like you have a pretty clear trail to follow:

/usr/local/munki/Python.framework/Versions/3.9/bin/../../../Versions/3.9/Python: code signature in (/usr/local/munki/Python.framework/Versions/3.9/bin/../../../Versions/3.9/Python) not valid for use in process using Library Validation: Trying to load an unsigned library

So that's going to need to be signed as well, which might lead you to the next thing to be signed...

-Greg

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/22faea2d-40ab-4b61-b5b9-874faa084214n%40googlegroups.com.

[Gregory Neagle]

For those of you testing the experimental build on Apple Silicon and seeing the Killed (9) errors, here's something to try (as root):

codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f /usr/local/munki/Python.framework/Versions/Current/Python

find /usr/local/munki/Python.framework/Versions/Current/bin/ -type f -perm -u=x -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \;

find /usr/local/munki/Python.framework/Versions/Current/lib/ -type f -perm -u=x -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \;

find /usr/local/munki/Python.framework/Versions/Current/lib/ -type f -name "*dylib" -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \;

you may need to do something similar with the GUI apps:

codesign -s - --deep --force --preserve-metadata=identifier,entitlements,flags,runtime /Applications/Managed\ Software\ Center.app

codesign -s - --deep --force --preserve-metadata=identifier,entitlements,flags,runtime /Applications/Managed\ Software\ Center.app/Contents/Resources/MunkiStatus.app

codesign -s - --deep --force --preserve-metadata=identifier,entitlements,flags,runtime /Applications/Managed\ Software\ Center.app/Contents/Resources/munki-notifier.app

(Though I'd be interested to hear if Managed Software Center.app launches without doing these things)

-Greg

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/75B74BAB-C4B0-46BA-81DD-E443F400FFF8%40mac.com.

[Stephen Boyle]

Thanks Greg-

The commands were run and it did indeed replace the existing signatures. however I do still get "Killed: 9"

The GUI/MSC does launch and run without issue from what I can see. is labelled as Apple architecture in activity monitor.

[Gregory Neagle]

On Nov 30, 2020, at 11:27 AM, Stephen Boyle <ste...@thirdvantage.com> wrote:

Thanks Greg-

The commands were run and it did indeed replace the existing signatures. however I do still get "Killed: 9"

The GUI/MSC does launch and run without issue from what I can see.

Before or after doing the ad-hoc signing?

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/59897cf7-3ff0-45ea-9c5f-f13ea78dd690n%40googlegroups.com.

[Stephen Boyle]

GUI worked without adhoc signing.

[Gregory Neagle]

So now let's add signing the embedded Python.app and remove the resiging of the Munki GUI apps:

codesign -s - --deep --force --preserve-metadata=identifier,entitlements,flags,runtime /usr/local/munki/Python.framework/Versions/3.9/Resources/Python.app

codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f /usr/local/munki/Python.framework/Versions/Current/Python

find /usr/local/munki/Python.framework/Versions/Current/bin/ -type f -perm -u=x -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \;

find /usr/local/munki/Python.framework/Versions/Current/lib/ -type f -perm -u=x -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \;

find /usr/local/munki/Python.framework/Versions/Current/lib/ -type f -name "*dylib" -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \;

-Greg

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/1d295eb9-c0da-4026-8d16-48c15cd05f10n%40googlegroups.com.

[Stephen Boyle]

excellent! it is working! munki-python and managedsoftwareupdate.

[Eric Holtam]

Initial testing on intel hardware running macOS 10.15.7 with the bundled Python framework is favorable. No noticeable changes or errors.

I ran `managedsoftwareupdate --munkipkgsonly` and properly downloaded 4 updates.  I opened Managed Software Center and was able to allow the installations to install from there.

-Eric

On Sunday, November 29, 2020 at 7:01:10 PM UTC-6 gregn...@mac.com wrote:

[Gregory Neagle]

Another Super Early Experimental Universal2 Build of Munki 5.3: https://github.com/munki/munki/releases/tag/v5.3.0a2

Change from v5.3.0a1:

• "ad-hoc" code signing of the Python framework to allow it to actually run on Apple Silicon, which requires all executable code and libraries to be signed.

-Greg

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/1d5843fd-3732-4f1b-a07c-515e1fa22b1dn%40googlegroups.com.

[Gregory Neagle]

Would really love confirmation (or denial) that this build works "as-is" on Apple Silicon...

-Greg

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/D0258D96-2D4D-44A1-B0F4-EC12E5627E44%40mac.com.

[Stephen Boyle]

Hi Greg-

I just installed with the new a2 release and it seems to work right out of the box! take that as one confirmation. Thank you!

[Kevin M. Cox]

Just grabbed the latest version and it worked straight away on my M1.

-- Kevin

[Justin Holt]

Confirming v5.3.0a2 worked on our two M1 devices.

[benrei...@gmail.com]

Works on our test M1.

[David Vandenborn]

I'm trying to configure a new unconfigured MacBook Pro M1 using bootstrappr.

I made sure that the Macintosh HD and Data volumes were mounted as r/w using diskutil and pointed Bootstrappr to the Data volume for installation.

munkitools-5.3.0.4248.pkg is the first package that gets installed. However, this fails with the error message 'This package requires Rosetta 2 to be installed. Please install Rosetta 2 and then try again".

So, no luck there...

David

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/325A9771-E989-44C3-8E6E-18878F8FF1B3%40mac.com.

[Gregory Neagle]

Yes, the package does not yet explicitly declare support for arm64, so Apple’s installer assumes the worst case scenario. 

Sent from my iPhone

On Dec 2, 2020, at 7:20 AM, 'David Vandenborn' via munki-dev <munk...@googlegroups.com> wrote:

I'm trying to configure a new unconfigured MacBook Pro M1 using bootstrappr.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-dev/2A158CD2-C0FF-4961-B04E-D5326056893E%40yahoo.com.

[Erik]

I highly encourage people in here testing to attempt to build their own version of munki 5.3 alpha rather than use Greg's posted versions so we can potentially iron out bugs in the build process.

I've been issuing PR's to Greg and talking to him about issues I've experienced in trying to build a universal python framework.

Please download the code and run `./code/tools/make_munki_mpkg_from_git.sh -b v5.3.0a2` and run the following commands against your framework file:

find ./installapplications/Python.framework/Versions/Current/lib -name "*.so" | wc -l
171
find .//Python.framework/Versions/Current/lib -name "*.so" | xargs file | grep "2 architectures" | wc -l
171

find ./installapplications/Python.framework/Versions/Current/lib -name "*.dylib" | wc -l
16
find ./installapplications/Python.framework/Versions/Current/lib -name "*.dylib" | xargs file | grep "2 architectures" | wc -l
16

If the number of files differ from the files that contain both architectures, the tooling has silently failed to produce a universal python.

[Erik]

apologies for the bad copy/paste on my part

find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.so" | wc -l
171
find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.so" | xargs file | grep "2 architectures" | wc -l
171

find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.dylib" | wc -l
16
find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.dylib" | xargs file | grep "2 architectures" | wc -l
16

this would be the path you use _after_ you install the newly created framework, not the path the build tool will create for you.

[Justin Holt]

I seemed to have some trouble building a Universal2 python from my Intel mac.  Attached is the output from make_munki_mpkg_from_git.sh as well as the output from my M1 Mac try to run the resulting build. 

justin@Justins-MacBook-Air ~ % /usr/local/munki/managedsoftwareupdate -vvv --checkonly
Python is missing ObjC bindings.
justin@Justins-MacBook-Air ~ % find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.so" | wc -l
     166
justin@Justins-MacBook-Air ~ % find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.so" | xargs file | grep "2 architectures" | wc -l
      74
justin@Justins-MacBook-Air ~ % find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.dylib" | wc -l
      16
justin@Justins-MacBook-Air ~ % find /usr/local/munki/Python.framework/Versions/Current/lib -name "*.dylib" | xargs file | grep "2 architectures" | wc -l
      16