Adobe CC and Catalina

[jlococo]

Does anyone have a solution for deploying Adobe CC packages on Catalina? I just created a new package from the Admin Console today, since I thought the old one wasn't compatible and uploaded it, but the policy fails during enrollment, check-in, or manually via self-service. The error is

"The installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance" "The package is attempting to install content to the System volume"

I'm guessing that second line is more telling. Must be a new security design in Catalina?

I'm also experiencing this with another package as well. The packages work fine under Mojave or prior though.

The other interesting thing is that if the packages are pre-installed in Mojave, and then the computer is upgraded to Catalina, then the software functions just fine.

Both were created as packages in Composer on the latest jamf pro 10.16 apps.

[grecopj]

Why are you recreating the Adobe Package in Composer? You should be able to just upload the downloaded package directly into Jamf Admin and scope away.

[jlococo]

Trying to upload the downloaded package to either the cloud server or through jamf admin results in the package being converted to a zip file. Even though the zip file uploads, it immediately causes the policy to fail when trying to run it.

[c_archibald]

Why not use the PKG installer or updater that CCP outputs?

[grecopj]

If you open the zip that downloads from Adobe, there is a folder called "Build". Within that is the install package that you upload via JAMF admin. It's a PKG installer.

[jlococo]

Yes that is the .pkg file i am trying to upload to either JAMF Admin or the cloud server (the .pkg inside the build folder) but both methods add .zip to the end of it. Making the package and policy useless. However if I create the package in Composer and output it as a .pkg that uploads fine. And i can see the policy run in the jamf.log But then it fails because of the System volume error

[grecopj]

Got it, mine do not compress as I have not migrated. Found this article that touches on that. https://www.jamf.com/jamf-nation/discussions/10400/uploading-pkg-and-appears-as-pkg-zip

[jared_f]

I have been running into a similar issue. The solution I found was to create a folder that is named the same as the Adobe CC PKG. Place the PKG in that and use Disk Utility to compress it into a DMG. Upload to your distribution point and then use the Install PKG from DMG script. Also, cache it prior to install.

Jamf Cloud distribution points cannot handle the size of Adobe Installers. In our case, we keep it on our on-prem distribution point.

[dan-snelson]

@jlococo If you manually copy the Adobe Admin Console-generated .PKGs to a test Mac running Catalina, can you manually perform the install?

I'm running into a similar issue and observed a message "Installer would like to access files in your Desktop folder." (which is where my .PKG resided).

I then observed: System Preferences > Security & Privacy > Privacy > Full Disk Access > com.adobe.acc.installer.v2

I'm now testing updating my Privacy Preferences Policy Control Configuration Profile, using the following as the Code Requirement:
anchor apple generic and (certificate leaf[field.1.2.840.113635.100.6.1.9] / exists / or certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = JQ525L2MZD)

[stutz]

@jlococo

Make sure your PPPC profile has an entry for "com.adobe.acc.AdobeCreativeCloud". Give it SystemPolicyAllFiles access.

My package was failing as well and determined I needed to have the PPPC for Creative Cloud app. The package wants access to the desktop and probably other things. One troubleshooting step to take is to try to install the package manually and see if it comes up with the same errors or needing access to a certain location (like desktop, documents, downloads).

You may also have to do the same thing with "com.apple.installer". Give it SystemPolicyAllFiles access.

It has nothing to do with pkg or zip files. My Adobe package zip's when I upload to JAMF.

Hope that helps.

[zinkotheclown]

@jlococo Are you using LoginLog? I found that on the newer MacBook Airs, just running this causes the Adobe installer to fail in Catalina. I found that if the currently logged in user isn't root, the install runs fine. On the 2015 MBA's the installer reports the same fail msg but the Adobe app installs anyway.

@stutz I tried adding a PPPC for Adobe CC a few weeks ago and that didn't work in my environment.

[djdavetrouble]

There is quite a bit of detail on this in the adobe channel in macadmins slack. The installers as of about a week ago install via double click, but only at loginwindow via JAMF. That means failure during enrollment, from SS or via Jamf remote in most cases, and breaks our current workflow for sure. The other workaround is drop the pkg locally and run installer -pkg via post install script. Annoyingly, jamf support is providing a work around via composer.

[jamesandre]

I downloaded a new Photoshop CC 2019 PKG from the Admin Console on the 29th. Uploaded to local File Share Distribution Point and it gets turned into a ZIP. I don't have a PPPC entry for com.adobe.acc.AdobeCreativeCloud or com.apple.installer.

I've just installed Photoshop via Self Service on 10.15.1 without issue.

In the past, the generic error "The installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance" has been caused by running Adobe Apps or processes.

[jhuls]

@jlococo While I haven't worked with Catalina yet(hoping to next week), I can't help but suspect your issues are due to something else entirely. For instance, unless I missed it have you tried running the pkg installer that is inside the zip file and build directory that was downloaded from Adobe's site? Does that install ok? I'm not saying to put it in Jamf but just copy it to the same Catalina machine and try installing it.

Here at work we're throwing every thing into one pkg on Adobe's site and then we deploy that to the workstations that need it. It's huge at around 20GB but it makes for simpler maintenance at the moment. With it being huge though the downside is that I had one system that needed to have around 55-60GB free to install it. I'd like to rethink that and make smaller installs but they don't want to change it on the Windows side and the boss wants them to be deployed the same way. My point is though...are you sure you have enough drive space?

Take the zip out of the equation and make sure the installer itself works if you haven't already. Also, take a look at your drive space. That should help narrow down if it's a zip or drive space issue.

[jhuls]

@djdavetrouble Ack! Somehow I missed your post when I responded to the op. Good to know!

No Catalina here yet...simply no time to look at it but my CIO got excited about Catalina after he talked to Apple at Educause and wants it on his system asap. <sigh>

[jlococo]

I'll try the PPPC fix, but as a few of you have asked, the .pkg inside the build folder is what I am trying to upload, and yes that .pkg installer runs just fine on Catalina if I manually install it. It's when I try to deploy the composer package through jamf that I get the failure message because the Composer package wants to modify the /System folder. That same error doesn't happen in Mojave, so it must be a new security measure in Catalina. I talked with jamf support yesterday and they are aware of this issue, but do not have an official solution for me yet.

[cbd4s]

It was certainly a confusing and frustrating process in the last week or two when we were trying to deploy the new version Adobe CC desktop app. We created and downloaded the package CCA_en_US_MAC.zip from the Adobe admin console on the 28th. So it is still the latest. The package contains an empty Exceptions folder, a CCA.ccp file and a Build folder that has the actual CCA_Install.pkg installer. Our current deployment was simply using the old version pkg file uploaded through Jamf Admin. But unfortunately, it is not that straight forward for the latest version.

We tried the following methods in our testing (10.14.6 and 10.15.1 clean client machines with no Adobe installed, Jamf Pro 10.9):

1. Self Service and Jamf Remote: same as our current setup to simply install the CCA_Install.pkg uploaded through Jamf Admin. I think this uses the /Library/Application Support/JAMF/Downloads folder to temporarily store the installer. To eliminate the possible issue with the automatic zipping in the upload process, I mounted the distribution point volume, double clicked the zip file to extract the CCA_Install.pkg file. Jamf Admin can detect and add it into the package contents at launch.

2. Jamf Remote: cache CCA_Install.pkg and use script to install it from the JAMF Waiting Room folder.

3. Manually run (GUI) or use terminal installer command to install the cached CCA_Install.pkg from the JAMF Waiting Room folder.

The problem occurred at the Running package scripts and Validating packages step with the error message (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. An error occurred while running scripts from the package “CCA_Install.pkg”.)

Interestingly the subsequent installation from my user profile downloads folder either by GUI or command line had no issue at all. What confused us more was after the successful installation from my downloads folder, all the Jamf methods above started working as well. Then we removed Adobe software from the test machine (manually or using the Uninstall Adobe Creative Cloud), the Jamf methods broke again with the same error.

I think this is the problem and the solution:
Problem: The access permission of the parent folder where the CCA_Install.pkg is executed. Although I already have Read&Write access to the CCP_Install.pkg file, I need to also have Read&Write access to the Waiting Room folder in order for the installation (GUI or command line) within this folder to work.

Solution: I was able to simply use disk utility to package the CCA_Install.pkg into a dmg file. Then use "hdiutil mount -quiet -nobrowse /Library/Application Support/JAMF/Waiting Room/CCP_Install.dmg" to mount the dmg and "installer -package /Volumes/CCP_Install/CCP_Install.pkg -target /" to install.

Observation: Someone good at bash scripting (so not me) may be able to find out the actual cause from the 3 scripts inside CCA_Install.pkg: InstallationCheck, preupgrade, preinstall. Dragging CCA_Install.pkg into Composer and convert to source can reveal these scripts and 3 other plist files, just no actual installer.

Hope this can save some of your time.

[bsuggett]

Hi all,

the new InstallPKGsfromDMG is available.

Passed parameters are
5(forcesuccessflag)
6(useinstallerapp)
7(allowUntrusted)
8(applyChoiceChangesXMLFile)
9(multipkgs).

If you need/want to bypass an untrusted installer. Supply parameter 6 with "YES" without quotes, and parameter 7 with "YES" without quotes.

If you want to install multiple pkgs from a single DMG, supply parameter 9 with "YES" without quotes.

Parameters 5, 6, 7, and 9 can be used in conjunction with each other.

There's just some packages that just don't like being installed using the jamf binary.

Hope this helps...

[kerouak]

I ran into this when I packaged an App in Mojave, then tried to deploy to a Catalina based device...
I just re-packaged it on a catalina device and hey presto..

[robertojok]

I had similar issues and created several versions of Adobe CC 2020 for catalina. In the end, having taken a look at the logs, it turns out that the issue really isn't the adobe installer as such but that certain applications within the installer will not run in catalina 10.15 but will run in any higher version of Catalina. So it is worth taking a good look at the installer logs and located the "fail" it will likely tell you which application does not install due to OS incompatibility. Another reason for these failures is available displace. Under certain situations some of the apps like Premiere Pro will refuse to install unless there is ample disk space... again the installer logs will tell you this.

[TCS]

@cbd4s , really appreciate your summary. I wound up just packaging the CC Desktop App installer as a DMG and ran this one liner with rests in files and processes "sleep 30; hdiutil mount -quiet -nobrowse /Library/Application Support/JAMF/Waiting Room/CCA_Install.dmg; sleep 15; installer -package /Volumes/CCA_Install/CCA_Install.pkg -target /" without quotes.
Our naming conventions for the package were nearly identical, so I went the lazy route.

[monaronyc]

@dan-snelson hey, was wondering, where were you able to pull this code requirement from? Man, i searched everywhere to try and and figure this out. No luck! and would this work on our devices as well?

anchor apple generic and (certificate leaf[field.1.2.840.113635.100.6.1.9] / exists / or certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = JQ525L2MZD)

[dan-snelson]

@monaronyc Does the following answer your question?

codesign -dr - /Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app

Executable=/Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud
designated => anchor apple generic and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = JQ525L2MZD)

[bryantdresher]

We usually manually Zip the Adobe installer .pkg files and then upload the zipped files with Jamf Admin. We've found Jamf Admin to be unreliable in creating the Zip files. (And you can automate it for large batches)

[GabeShack]

Has anyone had any luck to just install the Creative Cloud Desktop app and then just let the users do the installs of the CC apps they want? That's what I'm looking at now.

Gabe Shackney
Princeton Public Schools

[monaronyc]

@dan-snelson okay, NOW its looking better! BOO YA! So can i copy and paste this in? Like would it work in our environment?

codesign -dr - /Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app

Executable=/Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud
designated => anchor apple generic and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = JQ525L2MZD)

[dan-snelson]

@gshackney Yes, if you can tolerate your users seeing trial versions of apps for which they're not licensed.

@monaronyc Certainly worth a try; as always, YMMV.

[GabeShack]

If it means only installing what they want, I won't mind that. Just switched to Named User Licensing leveraging our logins with federation. Working well! Our licensing only gives access to the items in the below screen shot.
Gabe Shackney
Princeton Public Schools

[jhuls]

@gshackney I work in a community college setting and I'll say that each environment and group of users can be different with their own challenges but I can tell you that in our environment we used to let our marketing people install their Adobe applications when they wanted to and it was a disaster. One lady in particular always had to have the latest, greatest as soon as it was available and within anywhere from 24hrs to a week, she had all kinds of problems with her work where we would then have to sit with her to detangle the mess she made. If I remember right, it was almost always InDesign. After going through this with her and others a couple years, we took advantage of a change in management to present our issues and they agreed that we should control software rollout. They're probably just as understaffed as our dept is so they don't like unplanned down time.

While marketing could still run into bugs, this way we have a better chance of preparing for issues that might come up. We've been doing it this way a few years now and it's night and day better. Initially we got it to them within a month of Adobe's newest versions being released in the fall but now we're doing it at the end if the fall semester. It works better for them and us.

As for the rollout we're currently rolling out the monster package. This isn't my choice. I'd prefer to break it up and offer them up through Self Service but my director isn't fond of that idea. He's been pushing Self Service for some other things though lately so I hope to convince him to switch things over soon. In either case though it's made available more on our schedule for support reasons.

[carlo_anselmi]

@dan-snelson
How did you create the PPPC profile for adobe.acc.installer.v2?
I have tried using PPPC Utility with /Library/PrivilegedHelperTools/com.adobe.acc.installer.v2 but from there you can't add it
It seems I have the same problem on catalina with some Adobe pkg created from the console
Thank you!

[pvcit]

Zipping up the pkg (not letting jamf do it) well enough in catalina. Easier than dmg, either way though Adobe should be providing flat pkgs and would not have to do this.