[larkost]

If you want to try something out, I think I have some code that will allow InstaDMG to use InstallerChoices.xml files beyond the OS level one. I do have to note that I have not checked the InstallerChoices sections as well at the rest, because I am not using InstallerChoices.xml files at this point. However, for the brave:

first replace the lines:
[code]
install_system
install_updates
[/code]
with
[code]
install_packages_from_folder “$UPDATE_FOLDER”
install_packages_from_folder “$CUSTOM_FOLDER”
[/code]

then replace the “install_updates” and “install_custom” functions with this one:

[code]# install packages from a folder of folders (01, 02, 03…etc)
install_packages_from_folder() {
GROUP_FOLDER=”$1″

/bin/date “+$CREATE_DATE %H:%M:%S: Beginning Update Installs from $GROUP_FOLDER” | /usr/bin/tee -a “$LOG_FILE” “$PKG_LOG” >&3

/bin/ls -A1 “$GROUP_FOLDER” | /usr/bin/awk “/^[[:digit:]]+$/” | while read ORDERED_FOLDER
do
if [ -h “$GROUP_FOLDER/$ORDERED_FOLDER/InstallThisOneOnly” ]; then
FILE_LOCATION=`/usr/bin/readlink “$GROUP_FOLDER/$ORDERED_FOLDER/InstallThisOneOnly”`
if [ “$OS_REV” -eq 0 ]; then
CHOICES_FILE=”” # 10.4 can not use them
else
CHOICES_FILE=`echo “$FILE_LOCATION” | /usr/bin/awk ‘sub(/\.[^\.]+$/, “.xml”)’`
if [ -e “$GROUP_FOLDER/$ORDERED_FOLDER/InstallerChoices.xml” ]; then
CHOICES_FILE=”$GROUP_FOLDER/$ORDERED_FOLDER/InstallerChoices.xml”

elif [ ! -e “$CHOICES_FILE” ]; then
CHOICES_FILE=””
fi
fi

if [ CHOICES_FILE != “” ]; then
# With an InstallerChoices.xml file
/usr/sbin/installer -verbose -applyChoiceChangesXML “$CHOICES_FILE” -pkg “$FILE_LOCATION” -target “$CURRENT_IMAGE_MOUNT” | /usr/bin/tee -a “$LOG_FILE” >&4
/bin/echo ” Installed $FILE_LOCATION with XML Choices file: $CHOICES_FILE” | /usr/bin/tee -a “$LOG_FILE” “$PKG_LOG” >&3

else
# Without an InstallerChoices.xml file
/usr/sbin/installer -verbose -pkg “$GROUP_FOLDER/$ORDERED_FOLDER/InstallThisOneOnly” -target “$CURRENT_IMAGE_MOUNT” | /usr/bin/tee -a “$LOG_FILE” >&4
/bin/echo ” Installed $FILE_LOCATION” | /usr/bin/tee -a “$LOG_FILE” “$PKG_LOG” >&3
fi
else
/bin/ls -A1 “$GROUP_FOLDER/$ORDERED_FOLDER” | /usr/bin/awk ‘tolower($1) ~ /\.(m)?pkg$/’ | while read UPDATE_PKG
do
CHOICES_FILE=`/bin/echo “$UPDATE_PKG” | /usr/bin/awk ‘sub(/\.[^\.]+$/, “.xml”)’`
if [ “$OS_REV” -eq 0 ]; then
CHOICES_FILE=”” # 10.4 can not use them

elif [ ! -e “$GROUP_FOLDER/$ORDERED_FOLDER/$CHOICES_FILE” ]; then
CHOICES_FILE=””
fi

if [ “$CHOICES_FILE” != “” ]; then
/usr/sbin/installer -verbose -applyChoiceChangesXML “$GROUP_FOLDER/$ORDERED_FOLDER/$CHOICES_FILE” -pkg “$GROUP_FOLDER/$ORDERED_FOLDER/$UPDATE_PKG” -target “$CURRENT_IMAGE_MOUNT” | /usr/bin/tee -a “$LOG_FILE” >&4
/bin/echo ” Installed $GROUP_FOLDER/$ORDERED_FOLDER/$UPDATE_PKG with XML Choices file: $CHOICES_FILE” | /usr/bin/tee -a “$LOG_FILE” “$PKG_LOG” >&3

else
/usr/sbin/installer -verbose -pkg “$GROUP_FOLDER/$ORDERED_FOLDER/$UPDATE_PKG” -target “$CURRENT_IMAGE_MOUNT” | /usr/bin/tee -a “$LOG_FILE” >&4
/bin/echo ” Installed $GROUP_FOLDER/$ORDERED_FOLDER/$UPDATE_PKG” | /usr/bin/tee -a “$LOG_FILE” “$PKG_LOG” >&3
fi
done
fi
done
}[/code]

[larkost]

I have confirmed that this works and solves the problem.

[larkost]

Ok… slight change to the code:

[code]# clean up some generic installer mistakes
clean_up_image() {
/bin/date “+$CREATE_DATE %H:%M:%S: Correcting some generic installer errors” | /usr/bin/tee -a “$LOG_FILE” “$PKG_LOG”

# find all the symlinks that are pointing to $CURRENT_IMAGE_MOUNT, and make them point at the “root”
/usr/bin/find -x “$CURRENT_IMAGE_MOUNT” -type l | while read THIS_LINK
do
if [ `/usr/bin/readlink “$THIS_LINK” | /usr/bin/grep -c “$CURRENT_IMAGE_MOUNT”` -gt 0 ]; then

/bin/echo “Correcting soft-link: $THIS_LINK” | /usr/bin/tee -a “$LOG_FILE”
CORRECTED_LINK=`/usr/bin/readlink “$THIS_LINK” | awk “sub(\”$CURRENT_IMAGE_MOUNT\”, \”\”) { print }”`

/bin/rm “$THIS_LINK”
/bin/ln -s “$CORRECTED_LINK” “$THIS_LINK”

fi
done

# make sure that we have not left any open files behind
/usr/sbin/lsof | /usr/bin/grep “$CURRENT_IMAGE_MOUNT/” | /usr/bin/awk ‘{ print $2 }’ | /usr/bin/sort -u | /usr/bin/xargs /bin/kill 2>&1 | /usr/bin/tee -a “$LOG_FILE”
}[/code]

[larkost]

Have you actually tried getting a Kerberos ticket to make sure that you are setup correctly? Kerberos requires that you be setup for the KDC domain. Have you also paid attention to the CUPS documentation saying that only IPP connections can use Kerberos at this point?

[larkost]

I am trying to create a generic fix for this, and have come up with the following code:

[code]# clean up some generic installer mistakes
clean_up_image() {
# find all the symlinks that are pointing to $CURRENT_IMAGE_MOUNT, and make them point at the “root”
/usr/bin/find -x “$CURRENT_IMAGE_MOUNT” -type l | while read THIS_LINK
do
if [ `/usr/bin/readlink “$THIS_LINK” | /usr/bin/grep -c “$CURRENT_IMAGE_MOUNT”` -gt 0 ]; then

/bin/echo “Correcting soft-link: $THIS_LINK” | /usr/bin/tee -a $LOG_FILE
CORRECTED_LINK=`/usr/bin/readlink “$THIS_LINK” | awk “sub(\”$CURRENT_IMAGE_MOUNT\”, \”\”) { print }”`
/bin/ln -s -f “$CORRECTED_LINK” “$THIS_LINK”

fi
done
}[/code]

You also have to add “clean_up_image” on a line by itself before “close_up_and_compress”. I think it works, but am still waiting for the final check-run to process.

[larkost]

Just in case you were waiting on my testing: so far I have not run into any unexpected problems.

There is only the single expected problem: since both the target volume and the installer disk mount visible to the finder, sometimes if you launch applications while the InstaDMG process is running you will get the application from either of those sources. When my one-liner gets called it will happily tell those processes to quit, which can be a little unexpected. I would argue that this is still the “correct” behavior, and that we should solve it by going the other way. I have a little code to this effect, but I need to do more work for the case that someone already has the OS disk mounted.

And if you have a process with child processes (rather common), then there is a chance that this will try and kill the child process after killing the parent process has already taken care of it. This is not a big deal, and will only result in a small error message. In theory another process could have assumed this process id, but the chances of that happening during the milliseconds between kill events is vanishingly small. And since we are already running as root, there are much better attack vectors through us than a timing exploit, so it is unlikely that someone would try and use this aspect in any malicious way.

[larkost]

I am a little surprised that no-one commented, but in any case, here is a second version of the script.

I am also including a copy of the instadmg.bash script that I have made a couple of modifications on (kills process that are using things in the image, and that better handles finding the pkg’s inside folders).

The big additions to this are the ability to include one catalog file in another, and the ability to have a folder that contains all of the files for a package. The latter is useful in including the XCode mpackage and its folder of packages.

I am also including my “vanilla” catalog file that generates an up-to-date 10.5.2 dmg from a 10.5.0 Retail disk with all the generic updates. The resulting output from InstaDMG should be useable on any Intel mac, except possibly the MacBook Air and the latest iMac. I am also including a catalog file that I am currently working on to get XCode working (not yet completely tested).

[url]http://www.stanford.edu/~larkost/InstaUpToDate0.2.zip[/url]

Please: feedback is appreciated!

[larkost]

Ok.. another version. This one will not try to kill the same process more than one time:

[code]/usr/sbin/lsof | /usr/bin/grep “$CURRENT_IMAGE_MOUNT/” | /usr/bin/awk ‘{ print $2 }’ | /usr/bin/sort -u | /usr/bin/xargs /bin/kill[/code]

I am also continuing to test.

[larkost]

A simple way of doing the culling would be this line:

[code]/usr/sbin/lsof | grep “$CURRENT_IMAGE_MOUNT/” | /usr/bin/awk ‘{ print $2 }’ | /usr/bin/xargs /bin/kill [/code]

That should kill off any processes that have files open on the target volume. I have put this in my version of the script near the end of both the install_updates and install_custom sections. I am still working on completely checking this, but it seems to work out in my testing.

Edit: I forgot to mention that I am not combining the grep into the awk because the string we are testing for has “/”s in it, and would get awkward to escape.

[larkost]

I hope this time it makes it though… My posts keep getting rejected as spam….

I created a project for this, and got something that worked. Unfortunately that was before 802.1X was stable in 10.5, so I was mostly writing for 10.4. However, I would bet that with only minor tweaks that you could get it working for 10.5.

I have the project up on Google’s Code hosting:

http://code.google.com/p/macenterprise8021x/

If you do take it up, I can add you to the project. I have moved to a new job since writing that code, so no longer have access to a 802.1X network to test it, so I can’t really develop it any further.

But the project itself would make a great login-hook that could be used to keep the computers configured the way you want (without interfering with other uses).

[larkost]

[QUOTE][u]Quote by: macshome[/u][p]It sounds like you are using the 10.4 version of SIU. In the new, Automator based, SIU the blockcopy images are gone.

Which isn’t to say that you can’t create a NetBoot set with SIU and then convert it to an ASR image. But that will require more work than InstaDMG really as the system would be configured for NetBoot.[/p][/QUOTE]

To be clear, the blockcopy option is gone because Apple has made the “from folder” option for creating disk images much more compatible with restoring via block-level copying than it used to be. Now you don’t have to worry about things until you hit 256 GB on your target partition (the one you are restoring to). It used to be that the geometry of the disk had to be very similar, but those restrictions were eased in 10.3. For more details see “man asr” and look for the “HOW TO GET THE FASTEST RESTORES” section.

So the files produced by SIU are just as compatible as those produced by InstaDMG. The only things you have to do is to pull them out of the NBI folder, and run asr over them to make sure that it will be happy streaming them.

At the moment the big difference is that InstaDMG has more people around it. Otherwise said: no one seems to be writing things for SIU. I really like SIU’s idea of having everything in a workflow, but there are some missing pieces before I start using it.

[larkost]

The solution to this is to create a local group (use Wrokgroup Manager from the ‘Server tools, and aim it at localhost). Then add the an AD group that everyone s in to that, and give that local group admin rights.

And the system prefs things is a long-standing bug. Apple has fixed it a couple of times, only to have it come right back.

[larkost]

The first thing to check on would be check your DNS all over on your Active Directory setup. Check both forward and reverse DNS entries. The other thing to note is that 10.4 does not work with distributed filesystems. Maybe that will be in the cards for 10.5.

[larkost]

I wrote an article about this a while ago, this might help you out:

[url]http://prowiki.isc-csg.upenn.edu/index.php/Solving_timeout_issues_with_ActiveDirectory[/url]

[Author]

Posts