Erase-Install.sh Question

Also, when it updates the OS, it downgrade Safari from 16 to 15.6.1.

To ensure Safari and stuff like that is up-to-date, you need to run a separate policy that has the Software Update portion of the policy configured, preferably with the reboot options also configured.

I ran in to an issue while trying to this on an Intel mac. So far this tool works great. I got the below error message and I'm thinking it's maybe because this Mac has 2 partitions, Macintosh HD and Macintosh Data.

@SMR1 That error indicates a problem with the installinstallmacos.py script that erase-install tried to use to build the macOS Monterey installer. Use the --pkg (that's "minus minus pkg" in case it gets reformatted) option (https://github.com/grahampugh/erase-install/wiki/3.-Downloading-(caching)-a-macOS-installer-pkg) which tells erase-install to download an Apple created macOS installer .pkg instead.

I added the --pkg to the below string I was using. I worked with 2 users on Intel Mac's that got errors before adding the --pkg. On one one of them, it looks like it updated, but the policy isn't showing as complete in the Policy Log. Just waiting for the other user to log back on.

log/Library/Management/erase-install/erase-install.sh --reinstall --pkg --os=12 --update --min-drive-space=35 --current-user --check-power --no-fs --depnotify --cleanup-after-use

@SMR1 That's normal. Since the Mac restarts at the end if startosinstall works then the policy running the erase-install script terminates without technically completing. You'll want the Mac to report inventory at login (or use a LaunchDaemon that runs a script on startup to see if the macOS build version has changed and do a `jamf recon` if so) so the Mac falls out of scope for the update policy

Ok, makes sense. It's weird, I'm seeing different failure issues on some devices. I'm thinking the users aren't letting the script and are restarting, because once the upgrading screen goes away it can take a few minutes to restart and I think they're restarting manually. Would that be the case for these errors? 

[run_installinstallmacos] Error obtaining valid installer. Cannot continue.

After checking one of the devices that is getting the error where it's failing at 30%. When I go to the device in Jamf and go to applications, it shows the installer listed, so it's downloading, but I'm not sure if they're restarting it manually. Also, even though it's in self service, after it fails the first time, it keeps automatically kicking off. Could it be erroring out, because the downloader is already listed under applications?

Just adding some more issue's I came across. When I first started testing the script, I guess I was using the option that downloads the latest version. I tested it on a few and it worked. The next day I did it and Ventura installed and I didn't know it came out that day. I did have it in a self-service policy and one user ran it, but it looks like it didn't complete, so I thought it was ok and that was 3 weeks ago. I was trying to have him test the update again because his Mac showed 12.5.1 and it's worked fine on 9 devices. It looks like when he ran it 3 weeks prior, it cached the Ventura install, so this time testing it, it installed Ventura even though this is file and process info

log/Library/Management/erase-install/erase-install.sh --reinstall --pkg --os=12 --update --min-drive-space=35 --current-user --check-power --no-fs --depnotify --cleanup-after-use

@SMR1 Pay heed to what the different options tell the erase-install script do. They're all explained in the Wiki (https://github.com/grahampugh/erase-install/wiki) and according to it using --update will download any newer macOS installer which probably isn't what you want :

If the --update parameter is used, and an installer application is already cached on the system, the script will compare the version of the cached system with the installer that is available from Apple's catalogs. If a newer version is available, the cached installer is removed and the latest version is downloaded. Nothing is downloaded if the versions are the same or the cached system is newer (for example there is a cached beta installer).

---

If you're looking for a specific version of macOS, then use the --build option (--build=21G217 is what you'd specify for macOS 12.6.1), and omit the --os and --update options

I did see the info about --update in the wiki, which I removed after the fact, but this worked fine on 9 other devices with no issues. Regarding the above errors I posted, would those be because the user restart before it finished, because it might have been taking to long.

The 1st of the two errors you posted on Tuesday implies there was a bad version of the installer downloaded. The 2nd error I've seen when the BridgeOS updater can't be downloaded by the macOS installer (you can't pre-download it). Do you use any sort of network traffic inspection/filtering? Those can cause problems with the latter, but why it's only on some systems and not all I couldn't say.

My guess on the second error is they might have been on the VPN, even though I told them do not connect. I'll do some more testing with the --update removed. Thanks

I had a user test again and still getting the 2nd error. The thing is, it's downloading the installer and placing it in Applications. I verified with the user that he can see the Install macOS Monterey under /Applications

@SMR1 It's not the download of the macOS Monterey installer that's likely to be a problem, but the secondary BridgeOS installer that will be downloaded while running the macOS Monterey installer on x86 Macs with the T2 chip. That download will fail if the traffic to the Mac is being SSL inspected and the Apple server providing the download isn't exempted. Apple's KB article on what servers need to be exempted can be found here: https://support.apple.com/en-us/HT210060 

Last question I swear. When the user runs it from self-service, do they need to close out self-service for it to completely install. Just asking because I seen another script for another way to install it and it says self service needs to close.

@SMR1 It has not been my experience that Self Service has to be closed for an erase-install initiated update to complete.