##osx-server

gneagle: ok…so it has downloaded it (checked with unzip -l) but doesn’t seem to be showing the new template. I must have done something wrong i’ll go back and check :)

gneagle: oh yeah i’ve zipped them with the whole paths. d’oh

fuzzylogiq: Follow the wiki exactly

yes i see my folly now. i wasn’t in the correct directory when zipping

j0aqu1m: I think some of the wifi issues attributed to discoveryd were actually due to the changes in the wifi stack that were attempting to bring iOS and OS X features into alignment, plus the new P2P discovery modes and such.

Thanks frogor

Which simply changing out discoveryd wasn't going to alter.

frogor: Thanks!

10.10.4 has some great security fixes in it, period, so should definitely be installed for any 10.10 production machines.

The best part about writing presentations is discovering cool stuff

I just now discovered spctl --assess

Nick_ZWG: Whatcha using it for?

It seems to be the easiest way to verify if a package will pass gatekeeper via CLI

spctl --assess --type install package.pkg

if it exits 0, it's fine

otherwise it'll say "rejeceted"

*rejected

found that here: https://developer.apple.com/library/mac/documen...

Interesting. Are you building enough packages and signing them to warrant that check?

No, this isn't something I think I'd ever really need to use in production

but I'm writing stuff about code signing and the rabbit hole of Apple's dev notes brought me here

and I'm finding cool stuff

Yeah. Those flags aren't documented in the manpage. Nice.

The section about adding custom gatekeeper rules is neat, too

I had no idea

I also can't think of many reasons why that would be necessary aside from a really weird custom dev environemnt

s/em/me

Plus it's technically not saying whether it's actually a validly signed package as much as it's whether the system trusts it as a validly signed package.

frogor: Right. It's only a Gatekeeper check.

Not an actual installer cert check.

I'm actually not totally sure the best way to verify an installer cert

(without running it Installer)

Nick_ZWG: There's some other invocations here: https://developer.apple.com/library/mac/technot...

codesign, check-signature

(though the latter isn't included in OS X)

The spctl method seems like the way I'd go.

If Gatekeeper doesn't raise a fuss, then installation should be fine.

frogor: codesign --verify doesn't work with packages, though

too bad on that

frogor: pffft hahahah

Nick_ZWG: use pkgutil --check-signature

(but I bet you knew that)

That seems to be the fastest verification

and most reliable

You could still have a package that passes Gatekeeper but was rejected by Installer

pkgutil --check-signature would be the same check Installer uses

Nice to see that invalid packages exit 1 with --check-signature

#TheMoreYouKnow

My favorite slide so far https://www.dropbox.com/s/nk504jgt6322sr2/Scree...

Oh, I see, apple's "check-signature" tool is just a script that calls either pkgutil --check-signature or codesign -v --deep -R based on the file extension

howdy all

anyone try to build a 10.10.4 image with AutoDMG yet?

sohailmamdani_ yup

sohailmamdani_: I built one yesterday.

sohailmamdani_ yup, built one yesterday

not sure if the pr for the profiles has been merged yet

as of this morning

Works fine, though I don't include updates in the image.

hfike_: Per's on vacation, so it may take a bit before he can do it.

rtrouton I was wondering

if one really wanted it, you could go get the PR manually

Or just add the extra pkgs manually

I'm trying to remember the website that allowed you to customize and download a dock profile. Can anyone remember the name of it?

i almost did that, but not really urgent for me

No need to wait for Per or a PR to be merged

robkolic something something dockmaster

robkolic: http://errorfreeit.com.au/blog/2015/4/28/dock-m...

That's it.

Thanks guys

gotcha

rtrouton: got that profiles warning

sohailmamdani_: i'm building one now. almost done.

elliotjordan: about to click go on mine

seems to have succeeded

sohailmamdani_: But all that means is that AutoDMG doesn't info about 10.10.4 yet

It doesn't mean that anything is _broken_

AutoDMG doesn't _have_ info about 10.10.4 yet

Once Per adds it or merges a PR or you add a profile locally, no more warning

But functionality does not change

FWIW, i received no warnings about missing profiles

No _code_ is changing

elliotjordan: It warns you that it doesn't have a profile for 10.10.4 (or something along those lines)

i didn't get that warning either

ESD is newer than supported or some such

no warnings at all

Odd

"Installer newer than update profile"

If you don't have "apply updates" checked maybe that warning doesn't show?

gneagle_: building now...

AutoCasperNBI on the other hand looks like it does need updating?

(but that’s probably more appropriate for the Macadmins/JAMF channel)

well macmule is sometimes in here

He’s over in Slack right now :-)

courtesy of @erik on the Macadmins Slack #jamfnation channel

updated profile for 10.10.4/autodmg

by which you mean egomez in here

Allister: indeed

egomez_: thanks man!