Weird timestamps in ManagedInstallReport.plist

[kevaru]

I've been using Munki for over a decade now without any major issues  but I'm stuck with this one. Maybe someone can help me to find the problem:

On some of our machines (10.15, also tried to upgraded to 11.6.3) when munki (uninstalled, reinstalled 5.6.3) runs on the client (no matter whether triggered manually or automatically by launched) it writes the file /Library/Managed Installs/ManagedInstallReport.plist

This file is then not recognized as proper .plist file and cannot be parsed by Munkireport. The reason is a strangely composed timestamp key:

<key>Conditions</key>

<dict>

    ...

    <key>date</key>
    <date>2030437302-06-07T24:60:-2147483648Z</date>

This should look like:

<key>Conditions</key>

<dict>

    ...

    <key>date</key>
    <date>2022-02-03T19:21:39Z</date>

Strangely enogh, Munki creates correct time stamps in files like /Library/Preferences/ManagedInstalls.plist

        <key>LastCheckDate</key>
        <date>2022-02-03T18:21:42Z</date>

My python skills are not good enough to figure out how Munki creates the date in /Library/Managed Installs/ManagedInstallReport.plist. Greg already told me that other code could influence the content of <key>Conditions</key> in ManagedInstallReport.plist. I really don't see what that could be.

Any ideas?

[Gregory Neagle]

"My python skills are not good enough to figure out how Munki creates the date in /Library/Managed Installs/ManagedInstallReport.plist.”

https://github.com/munki/munki/blob/main/code/client/munkilib/info.py#L875-L877

--
You received this message because you are subscribed to the Google Groups "munki-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to munki-discus...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/20b3b099-9e72-4530-9be3-28a5c66305aan%40googlegroups.com.

[Gregory Neagle]

$ cd /usr/local/munki/

$ ./munki-python 

Python 3.9.7 (v3.9.7:1016ef3790, Aug 30 2021, 16:25:35) 

[Clang 12.0.5 (clang-1205.0.22.11)] on darwin

Type "help", "copyright", "credits" or "license" for more information.

>>> from munkilib import info

>>> info.predicate_info_object()['date']

2022-02-03 10:53:07 +0000

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/21620E42-F3EF-456A-9A4E-966FF811A900%40mac.com.

[kevaru]

🤨, something going wrong there:

macmini2:munki root# ./munki-python
Python 3.8.5 (v3.8.5:580fbb018f, Jul 20 2020, 12:11:27)
[Clang 6.0 (clang-600.0.57)] on darwin

Type "help", "copyright", "credits" or "license" for more information.
>>> from munkilib import info
>>> info.predicate_info_object()['date']

-5877520-03-03 -8:-31:-23  +0000

[Gregory Neagle]

$ cd /usr/local/munki/

$ ./munki-python

Python 3.9.7 (v3.9.7:1016ef3790, Aug 30 2021, 16:25:35) 

[Clang 12.0.5 (clang-1205.0.22.11)] on darwin

Type "help", "copyright", "credits" or "license" for more information.

>>> from Foundation import NSDate, NSTimeZone

>>> from munkilib import reports

>>> the_date = NSDate.dateWithString_(reports.report.get('StartTime', reports.format_time()))

>>> print(the_date)

2022-02-03 21:16:06 +0000

>>> timezone = NSTimeZone.defaultTimeZone()

>>> print(timezone)

America/Los_Angeles (PST) offset -28800

>>> seconds_offset = timezone.secondsFromGMTForDate_(the_date)

>>> print(seconds_offset)

-28800

>>> new_date = NSDate.alloc().initWithTimeInterval_sinceDate_(seconds_offset, the_date)

>>> print(new_date)

2022-02-03 13:16:06 +0000

--
You received this message because you are subscribed to the Google Groups "munki-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to munki-discus...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/b29cea4e-1ab0-43c7-afa7-ea885b66239fn%40googlegroups.com.

[kevaru]

Thank you so much for your time. I know you have much better things to do than this. But I think we're getting there. Munki code seems absolutely fine. It appears to be user (permission?) related. I noticed that when I start a python shell with root priviledges, it does not fetch a time and then subtracts the time zone difference. That explains the negative value:

cd /usr/local/munki

sudo ./munki-python

Python 3.9.7 (v3.9.7:1016ef3790, Aug 30 2021, 16:25:35)
[Clang 12.0.5 (clang-1205.0.22.11)] on darwin
Type "help", "copyright", "credits" or "license" for more information.

>>> from Foundation import NSDate, NSTimeZone
>>> from munkilib import reports
>>> the_date = NSDate.dateWithString_(reports.report.get('StartTime', reports.format_time()))
>>> print(the_date)

None

>>> timezone = NSTimeZone.defaultTimeZone()
>>> print(timezone)
Europe/Zurich (GMT+1) offset 3600
>>> seconds_offset = timezone.secondsFromGMTForDate_(the_date)
>>> print(seconds_offset)
3600

>>> new_date = NSDate.alloc().initWithTimeInterval_sinceDate_(seconds_offset, the_date)
>>> print(new_date)

-5877520-03-03 -8:-31:-23  +0000
>>>

Same as root user:

ash-3.2$ sudo -i

cd /user/local/munki

macmini2:munki root# ./munki-python

Python 3.9.7 (v3.9.7:1016ef3790, Aug 30 2021, 16:25:35)
[Clang 12.0.5 (clang-1205.0.22.11)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from Foundation import NSDate, NSTimeZone

>>> the_date = NSDate.dateWithString_(reports.report.get('StartTime', reports.format_time()))
>>> print(the_date)

None

>>> timezone = NSTimeZone.defaultTimeZone()
>>> print(timezone)
Europe/Zurich (GMT+1) offset 3600
>>> seconds_offset = timezone.secondsFromGMTForDate_(the_date)
>>> print(seconds_offset)
3600

>>> new_date = NSDate.alloc().initWithTimeInterval_sinceDate_(seconds_offset, the_date)
>>> print(new_date)

-5877520-03-03 -8:-31:-23  +0000
>>>

However:

(as local admin)

cd /usr/local/munki

./munki-python

Python 3.9.7 (v3.9.7:1016ef3790, Aug 30 2021, 16:25:35)
[Clang 12.0.5 (clang-1205.0.22.11)] on darwin
Type "help", "copyright", "credits" or "license" for more information.

>>> from Foundation import NSDate, NSTimeZone
>>> from munkilib import reports
>>> the_date = NSDate.dateWithString_(reports.report.get('StartTime', reports.format_time()))
>>> print(the_date)

2022-02-03 22:20:53 +0000

ls -al /usr/local/munki

drwxr-xr-x   6 root  wheel    192  3 Feb 21:58 Python.framework
-rwxr-xr-x   1 root  wheel   8370 31 Jan 20:10 app_usage_monitor
-rwxr-xr-x   1 root  wheel  12214 31 Jan 20:10 appusaged
-rwxr-xr-x   1 root  wheel  16566 31 Jan 20:10 authrestartd
drwxrwxr-x   2 root  wheel     64  3 Feb 21:59 cleanup
-rwxr-xr-x   1 root  wheel  11101 31 Jan 20:10 iconimporter
-rwxr-xr-x   1 root  wheel   2521 31 Jan 20:10 launchapp
-rwxr-xr-x   1 root  wheel   8078 31 Jan 20:10 logouthelper
-rwxr-xr-x   1 root  wheel   3743 31 Jan 20:10 makecatalogs
-rwxr-xr-x   1 root  wheel   4929 31 Jan 20:10 makepkginfo
-rwxr-xr-x   1 root  wheel  50153 31 Jan 20:10 managedsoftwareupdate
-rwxr-xr-x   1 root  wheel  40957 31 Jan 20:10 manifestutil
lrwxr-xr-x   1 root  wheel     45  3 Feb 21:58 munki-python -> Python.framework/Versions/Current/bin/python3
-rwxr-xr-x   1 root  wheel  25062 31 Jan 20:10 munkiimport
drwxr-xr-x  43 root  wheel   1376  3 Feb 21:58 munkilib
-rwxr-xr-x   1 root  wheel   1618 31 Jan 20:10 precache_agent
-rwxr-xr-x   1 root  wheel   3516 31 Jan 20:10 ptyexec
-rwxr-xr-x   1 root  wheel   3542 31 Jan 20:10 removepackages
-rwxr-xr-x   1 root  wheel  23348 31 Jan 20:10 repoclean
-rwxr-xr-x   1 root  wheel  11987 31 Jan 20:10 supervisor

Since munki runs as root, this causes the problem. I tried to chown -R root:wheel 755 /usr/local/munki

Same result. This is beyond me 😵‍💫

Gregory Neagle schrieb am Donnerstag, 3. Februar 2022 um 22:18:41 UTC+1:

$ cd /usr/local/munki/

$ ./munki-python

Python 3.9.7 (v3.9.7:1016ef3790, Aug 30 2021, 16:25:35) 

[Clang 12.0.5 (clang-1205.0.22.11)] on darwin

Type "help", "copyright", "credits" or "license" for more information.

[kevaru]

Hallelujah, found it. The root account's region was set to US with 12-hour time setting. Therefore the python variable 'the_date' was set to 'None' when executed as root. Two different time formats on one system seem to derail the train.

I really appreciate your time and help. FWIW, I'd like to offer you a brief ego-booster-story as a sign of gratitude:

When I started out as a teacher back in 2010 I slipped into the responsibility for a couple of macs. The number grew rapidly and it was then when I came accross Munki and I have embraced and loved it to this day having spread the word accross numerous other schools in the meantime. I work as a full time mac sys-admin now and I fondly remember when I used to ask my students in Englisch classes who they would love to meet. Girls where all about Justin Bieber, Brad Pitt and Beyonce. The boys wanted to see 50Cent, Tom Brady or some soccer star. Sometimes they asked me and I told them: I'd choose Greg Neagle as he is the master of that superb munki that helps me so much with our computers. The puzzled faces combined with that look of disbelief will forever remain unforgotten.

Thanks again,

Kevin

[Gregory Neagle]

I’m glad you figured it out, though it would be nice to see Munki deal with the scenario better.

And thank you for the kind words.

-Greg

-- 
You received this message because you are subscribed to the Google Groups "munki-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to munki-discus...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/60b59a19-5ebb-402c-b9a5-832d77e7c3a2n%40googlegroups.com.