I don't use the PKGs as I find using the softwareupdate command the most efficient method to process patches, wrapped around and enforced using this GitHub script https://github.com/mpanighetti/install-or-defer

@Cayde-6 I’ve been doing similar using one-liners (softwareupdate —install -a) which has also failed to install after downloading the update. The command line failed both as a Jamf Self Service policy and manually.

@tomt Not that it helps, but in my testing deploying the Security Update 2021-001 (Catalina) .pkg via Self Service has been working ok. However I have seen the behavior you describe before with the installer tool bailing on the macOS Catalina installer when triggered by a Self Service initiated script calling startosinstall, but running successfully if the user launches Install macOS Catalina.app themselves. I opened an AppleCare support case on it but never got a resolution.

The strange thing is that both methods have been working just fine for a long time now. It just seems to be this particular update that is causing issues. I have my fingers crossed that Apple will release a full Combo 10.15.7 updater that includes the Sudo fix. I'm not holding my breath though as Apple does not seem to care much about Admins these days.

@tomt The .pkg version of Security Update 2021-001 (Catalina) that was released on 2021-02-09 (not to be confused with the original .pkg with the same name made available on 2021-02-08) does incorporate the sudo fix from the macOS Catalina 10.15.7 Supplemental Update that is only available via Sofwtare Update. It should install on any build of 10.15.7.

@sdagley Yes, that's where my problem is. That package is failing with no decent log output that could tell me why. I'm hoping someone else has seen this and it's not just limited to my environment.

There is a utility to pull updates directly from Apple's CDN and I'm blanking on the name.

@tomt I get errors like those all the time with various Security Updates from Sierra through Mojave and I'd expect Catalina as well... are you installing the package straightaway, or are you caching and then installing cached in two separate policies? I found using the latter method in conjunction with a script to actually ensure the pkg was staged in /Library/Application Support/JAMF/Waiting Room to be useful - most of the time when installer errored it was due to the cached package having been purged.

I'm getting the same uninformative error if I run the update manually via the command line.

In Terminal, "softwareupdate --list --install -a" brought up the security update as well as Safari. Both downloaded normally, Safari 13.0.4 installed happily but the security update failed with "there was an error".

It's just weird...

@tomt SUS Inspector may be the utility you're thinking of.

@tomt Did you check /var/log/install.log for any hint what might have gone wrong?