Managed Software Center Shows Updates for Previous OS Version

[Alanna Clare]

We're using munki for software and Apple updates. Two of my Mac minis recently starting showing an update for 10.11.6 in the Managed Software Center. This is strange, because the minis are currently running 10.12.x (one is at 10.12.4 and the other at 10.12.5). 

I have had complaints from both users that they run the update, and it immediately appears in their MSC again (because it didn't really install, because it can't). 

• Why aren't they showing the 10.12.6 update instead of the 10.11.6 one?

• How can I remove this particular Apple update from the MSC? 

   - Do I need to uninstall and reinstall the munki tools?

   - Will bringing them both up to 10.12.6 solve the issue?

Any input appreciated. Thanks!

[Mr. Alan Siu]

Are you importing actual Apple update .pkg files into your Munki repo? Or are you just setting the InstallAppleSoftwareUpdates flag to true on your client machines?

If the former, I'd recommend the latter, since it just uses macOS's built-in softwareupdate command.

More details here:

https://github.com/munki/munki/wiki/Apple-Software-Updates-With-Munki#details

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

--
You received this message because you are subscribed to the Google Groups "munki-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.
To post to this group, send email to munki-...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/a52cc880-10c6-4793-bd58-452581df8a24%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Alanna Clare]

We're setting the flag to true; we don't import the Apple pkg files to our repo. Just had another 10.12.6. machine (laptop this time) show the 10.11.6 update yesterday. I deleted and reinstalled (a newer version of) munki, but the MSC still showed the 10.11.6 update. A new version of Firefox just became available, though (perhaps in the last 30 minutes or so), and when it checked and found that update, none of the others (10.11.6, ARD 3.9, etc.) came back. So I'm going to run around to the others and see if I can force a check on them, too. If that resolves it, I'll note that.

On Thursday, August 3, 2017 at 5:20:31 PM UTC-7, Mr. Alan Siu wrote:

Are you importing actual Apple update .pkg files into your Munki repo? Or are you just setting the InstallAppleSoftwareUpdates flag to true on your client machines?

If the former, I'd recommend the latter, since it just uses macOS's built-in softwareupdate command.

More details here:

https://github.com/munki/munki/wiki/Apple-Software-Updates-With-Munki#details

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

On Thu, Aug 3, 2017 at 4:50 PM, Alanna Clare <amc...@gmail.com> wrote:

We're using munki for software and Apple updates. Two of my Mac minis recently starting showing an update for 10.11.6 in the Managed Software Center. This is strange, because the minis are currently running 10.12.x (one is at 10.12.4 and the other at 10.12.5). 

I have had complaints from both users that they run the update, and it immediately appears in their MSC again (because it didn't really install, because it can't). 

• Why aren't they showing the 10.12.6 update instead of the 10.11.6 one?

• How can I remove this particular Apple update from the MSC? 

   - Do I need to uninstall and reinstall the munki tools?

   - Will bringing them both up to 10.12.6 solve the issue?

Any input appreciated. Thanks!

--
You received this message because you are subscribed to the Google Groups "munki-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discus...@googlegroups.com.

[Mr. Alan Siu]

Yeah, I'm not sure what's going on there. Perhaps softwareupdate had trouble getting to the Apple servers and cached something weird? Who knows? But the fact it went away after another check bodes well.

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/5a3d7cc5-0136-4310-a91a-46768601140d%40googlegroups.com.

[Alanna Clare]

Well, it went away on the laptop, which had been updated to 10.12.6. It's not working on the minis, which are at 10.12.4 and 10.12.5. So perhaps for some reason with the unusual 10.11.6 upgrade, if the machines were originally 10.11.x, but are now 10.12, but not 10.12.6, it for some reason defaults to providing the 10.11.6 update instead of the 10.12.6 one? Weird. When I can get the users off them, I'll update them to 10.12.6 through the App Store and see if that changes anything.

[Mr. Alan Siu]

Can you post the output of the following command from one of the Mac Minis that's experiencing the issue? Feel free to redact anything private (like authentication credentials or the name of your server):

sudo managedsoftwareupdate -vvv

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/1cb923af-aefd-4eb6-8198-140776dcd204%40googlegroups.com.

[Alanna Clare]

There's pages of it. You want it all, or can I skip it checking for things that are already up-to-date (Firefox, Chrome, ShelfMenu) and stuff that isn't installed?

Towards the end, it says 

=====

ERROR: No default Software Update CatalogURL for: 10.12

    **Checking for Apple Update Metadata**

    Looking for detail for: 031-96040, version latest...

    Not found

    Looking for detail for: 031-98397, version latest...

    Not found

    Looking for detail for: 091-00404, version latest...

    Not found

    Looking for detail for: zzzz091-04057, version latest...

    Not found

    The following Apple Software Updates are available to install:

        + Security Update 2017-001-10.11.6

           *Restart required

        + Safari-10.1

        + Remote Desktop Client Update-3.9.2

        + iTunes-12.6

===========

so I am wondering if some of these older machines are configured incorrectly for Apple updates. (I started in November, and there was no overlap between me and the guy who set up our repo originally - I upgraded all the machines to Sierra; most were on Yosemite or El Capitan.)

[Mr. Alan Siu]

ERROR: No default Software Update CatalogURL for: 10.12

What do you have set as the CatalogURL, either with a defaults write command or a profile?

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/c24f2a83-dd43-41ef-8114-04621290a5c4%40googlegroups.com.

[Alanna Clare]

Our "defaults write" commands are

• defaults write /Library/Preferences/ManagedInstalls InstallAppleSoftwareUpdates -bool TRUE
• defaults write /Library/Preferences/ManagedInstalls SoftwareRepoURL "https://munki.<something>.com/munki_repo"
• defaults write /Library/Preferences/ManagedInstalls ClientIdentifier "csr" (or other options, but true in this case)

Other computers, including other minis of the same vintage, check for Apple updates just fine. I just checked one of the minis that is also on 10.12.5, and the upgrade that appears in that MSC is correct (10.12.6), and the lines in the managedinstalls.plist in Preferences are the exact same. Same client identifier, too, and same model mini. I don't see anything about a catalogURL. Yet one works and the other doesn't.

In the "Library/Managed Installs" directory for that non-working  one, there's an AppleUpdates.plist that lists 10.11.6 (see attached image, taken when previewing in finder). Maybe that plist should be deleted? Or I could copy over the one from the other machine that properly wishes to install 10.12.6...

[Alanna Clare]

Running the managedsoftwareupdates command on the working machine resulted in something much different:

=====

Checking Apple Software Update catalog...

    Caching CatalogURL https://swscan.apple.com/content/catalogs/others/index-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog

    Options: {'logging_function': <function display_debug2 at 0x10b5d2cf8>, 'ignore_system_proxy': None, 'additional_headers': {'User-Agent': u'managedsoftwareupdate/2.8.2.2855 Darwin/16.6.0 (x86_64) (Macmini5,1)'}, 'file': '/tmp/munki_swupd_cache/mirror/apple.sucatalog.download', 'cache_data': {

    etag = "\"548aa1-5564205482e00\"";

    "last-modified" = "Tue, 08 Aug 2017 18:20:40 GMT";

}, 'url': 'https://swscan.apple.com/content/catalogs/others/index-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog', 'follow_redirects': True, 'download_only_if_changed': True, 'can_resume': True}

    URLSession_task_didReceiveChallenge_completionHandler_

    Authentication challenge for Host: swscan.apple.com Realm: None AuthMethod: NSURLAuthenticationMethodServerTrust

    Allowing OS to handle authentication request

    Status: 304

    Headers: {u'Expires': u'Wed, 09 Aug 2017 02:45:20 GMT', u'Keep-Alive': u'timeout=15, max=472', u'Server': u'Apache', u'Connection': u'Keep-Alive', u'Etag': u'"548aa1-5564205482e00"', u'Cache-Control': u'max-age=14400', u'Date': u'Tue, 08 Aug 2017 22:45:20 GMT'}

    Item is unchanged on the server.

    /tmp/munki_swupd_cache/mirror/apple.sucatalog already exists and is up-to-date.

    Skipping Apple Software Update check because sucatalog is unchanged, installed Apple packages are unchanged and we recently did a full check.

    CheckForSoftwareUpdates result: True

    **Checking for Apple Update Metadata**

    Looking for detail for: 091-22860, version latest...

    Not found

    Looking for detail for: zzzz091-25489, version latest...

    Not found

    The following Apple Software Updates are available to install:

        + macOS Sierra Update-10.12.6

           *Restart required

        + iTunes-12.6.2

===============

So where is the CatalogURL supposed to be? It appears to work in the one, but not in the other.

[Mr. Alan Siu]

The CatalogURL is specified here (or not—doesn't have to be specified at all):

defaults read /Library/Preferences/com.apple.SoftwareUpdate

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/ca02bcef-9258-4e58-98d5-3eaf15a399f5%40googlegroups.com.

[Alanna Clare]

It's not specified in either the plist that works or the one that doesn't.

Two keys (well, date keys are different too, but I expected that) are different:

<key>LastAttemptBuildVersion</key> for non-working Mac says "16E195" (isn't that 10.12.4?) while for the working one it says "16F73"

<key>LastAttemptSystemVersion</key> for non-working has "10.11.6 (15G1217)" while the one that is correct has "10.12.5 (16F73)" 

One of our other ones is even crazier. It's on 10.12.6, the "lastbuild" line  in com.apple.SoftwareUpdate says 16G29, the "lastattemptsystemversion" says 10.12.4, and it's still only offering the 10.11.6 security update in the MSC.

Not sure where to go from here!

[Mr. Alan Siu]

Well, I think you need to figure out what's going on with your Apple updates. It really has nothing to do with Munki, since Munki uses Apple's built-in softwareupdate utility.

Take Munki out of the equation for a bit.

What happens when you run this command on one of the misbehaving machines?

softwareupdate -l

(that's a lowercase L, by the way, not a 1 or an uppercase i)

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/9e3fe715-3c2f-4d3a-9271-11cd8526c008%40googlegroups.com.

[Alanna Clare]

Thank you so much for continuing to help me with this! Looks like the software update tool isn't working on those computers not updating. Should I delete (remove/rename) the softwareupdate.plist, perhaps? Or is there something else I could try? When I "read" the catalogURL of Library/Preferences/com.apple.SoftwareUpdate, it says it doesn't exist, so this mini should be checking Apple's servers, as I understand it.

From non-updating computer:

Software Update Tool

Finding available software

No new software available.

=======

From properly-updating computer:

Software Update Tool

Finding available software
Software Update found the following new or updated software:

* macOS Sierra Update-10.12.6
macOS Sierra Update (10.12.6), 800057K [recommended] [restart]

* iTunesX-12.6.2
iTunes (12.6.2), 277572K [recommended] 

[Mr. Alan Siu]

I don't think removing that file will help. Any chance you have a profile installed that sets the CatalogURL?

If you go to System Preferences > Profiles, do you see anything there that manages com.apple.SoftwareUpdate and is perhaps setting a CatalogURL?

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/e9f3d5fe-6184-4f1f-9854-8727fb712ac4%40googlegroups.com.

[Alanna Clare]

We don't use any Profiles. But I was thinking I may need to rebind these to our network account server and see if that helps any. I didn't think there was anything there that might impede the update, but I don't know for sure (it's outsourced).

[Mr. Alan Siu]

Sorry—I didn't read your last post carefully enough. If this was your output from listing the available software updates, that should be a good thing, actually, unless you know for sure there are updates that it should be pulling. At least instead of pulling the wrong updates, it's pulling nothing.

Software Update Tool

Finding available software

No new software available.

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/da48bf70-5707-4472-a047-d7bcfdba6aeb%40googlegroups.com.

[Alanna Clare]

Yeah, the software update tool says there is no new software (and in the case of the mini I ran it on, it is on 10.12.6), but the Managed Software Center is still telling her she needs to install the update to 10.11.6. So in this case, I'd like to erase that setting from the MSC. I got another message about the 10.11.6 update right after I ran the terminal command that resulted in the "no new software" response.

[Gregory Neagle]

Have you told us what version of the Munki tools you are running? I'm suspecting you are not running a version recommended for use with 10.12.x.

Sent from my iPhone

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/453ba0a7-bb7a-4b4f-ae84-748774e12ae2%40googlegroups.com.

[Mr. Alan Siu]

Okay. I'm shooting in the dark here a bit, but can you try renaming this file

/Library/Managed Installs/swupd/mirror/apple.sucatalog

and then running a

sudo managedsoftwareupdate --checkonly

to see if it's still trying to pull in weird updates?

Alan Siu

Client Systems Analyst

St. Ignatius College Preparatory

To unsubscribe from this group and stop receiving emails from it, send an email to munki-discuss+unsubscribe@googlegroups.com.

To post to this group, send email to munki-...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/munki-discuss/453ba0a7-bb7a-4b4f-ae84-748774e12ae2%40googlegroups.com.

[Alanna Clare]

On Julie's machine, the MSC says version 4.1.2627, copyright 2010-2014, possibly installed in 2016; not sure where to find the munkitools version number. On Scott's machine, before I deactivated it and gave him a laptop, I deleted the old MSC and reinstalled Munki 2.8.2 on Tuesday. When I ran it, it still wanted to install 10.11.6 although he was running 10.12.x.

[Alanna Clare]

Really not sure whether this is an issue with Apple software updates or the Managed Software Center. Kathy's computer is on 10.12.4, MSC (4.1.2627) shows only the new Firefox update, but her preferences say to run the Apple ones as well. If I enter softwareupdate -l in terminal, it comes back with the proper updates (12.12.6, Remote Desktop 3.9.3, and iTunes 12.6.2). But even rechecking in MSC still results in only Firefox. What version should be installed? And how can I cleanly uninstall/reinstall it, seeing as the one I did Tuesday gave me the same results afterwards?