AFP548 – Autopkg – Download Recipe Decision Making Process

It’s been a long-standing goal of mine to help people get started making their own recipes for autopkg, which was recently spurred on by revisiting my previously-discussed recipeGenerationUtils. The autopkg wiki can only be so instructive on the process besides some general guidelines, so I thought I’d expand on some points here, while zooming-in on the download recipe in particular. In this flowchart, I take apart the decision making process for what processors to choose and when, which should cover most possibilities.

Why a separate download recipe?

While there are folks who skip download recipes entirely, it really helps sharing and reuse by folks using different management systems if you do insert this step as a separate recipe. Let’s get started:

First, decide whether you need the feature of targeting a specific localization or version. This came up recently in regards to Office2011 having a 14.1.0 dependency stated by the vendor, which you can specifically run once as a target, which therefore satisfies that requirement in munki (as instructed in the munki recipe itself). This also comes into play for Mozilla products, as they distribute localizations separately. If you need features like those, you’ll probably be writing a custom processor to pull out the download URL you want, as Hannes Juutilainen does to support different versions of 1Password.
Next, certain products like GoogleChrome make their download available at an unchanging(as of yet…) URL that may simply go to (or redirect to) a download link for the most current version. If that’s the case, lucky you! You’re (mostly) done. (Things like Box Sync or the Atom text editor need to have their helper files copied into place, which you’ll need to add into the package itself or shove into a pkginfo file with munki. Also, between products like flash and java having issues deciding what source or trigger is the ‘most approved’ method to grab their software through, you may want to be flexible and change it if you’re better off mirroring the mechanism built in to their software for autoupdate, see the next step.)
If that isn’t the case, you can look into whether there is a publicly available update feed for the product, such as the Sparkle framework or an ‘appcast’ RSS feed. Sometimes you need to be crafty and trick the feed into thinking you’re the software itself calling home by using a user agent string, but it’s good to be relying on a native way of determining if your customers would be prompted for updates from the vendor (assuming auto-update check mechanisms were enabled). You’d commonly find the URL in the Info.plist file inside the app bundle, for example the SUFeedURL key in /Applications/Bartender.app/Contents/Info.plist
Instead, if the developer at least has their software available from a consistent download URL, e.g. if they just follow a common pattern by inserting the new version number, you can use the URLTextSearcher processor to get the product download URL pulled out to pass to URLDownloader.
Finally, before resorting to writing a custom processor, you may want to check if it’s currently in Homebrew Cask, as a processor exists to piggyback on that projects collection, (making all that heavy lifting I did way back kind of moot…)

Nearly home free

After getting your download URL, the remaining steps should be somewhat the same: after URLDownloader, you’d insert the EndOfCheckPhase to stop if the product is unchanged, and finally the CodeSignatureVerification processor can check the validity of the download, assuming either the package or app bundle itself is properly signed.

The CodeSignatureVerification processor can deal with a couple forms of downloads to check, but if it’s a zip archive you may need to add the Unarchiver processor before it, and designate what path to expect when it comes to the app bundle. See this for a template with a bit more detail that covers the common case, or the official docs.

And there we have it! Hopefully this doesn’t seem too hand-wavy and can be of help to folks looking at what pieces to snap together out of the autopkg processor lego kit. Good luck, feel free to remix my graphic above, and please chime in with any questions in the comments!