An update on App Installers

[JustinC]

At this year’s JNUC 2021, we announced App Installers; a streamlined way to deploy and update Mac applications, removing the tedious tasks of sourcing, deploying and maintaining non-Mac App Store titles. 

This month, we launched a private beta with select customers to gather initial feedback on the new workflow. All customers can expect to see App Installers in the Jamf Beta Program early next year. Any interested customer can sign up for the Jamf Beta Program here.

Once generally available, App Installers will be included with cloud-hosted Jamf Pro, Business Plan, and Enterprise Plan subscriptions. We are very excited to make this new workflow available and we cannot wait to hear your feedback.

[KyleEricson]

Great news!

[alexloew]

Awesome, really looking forward to this!

[user-vMArwXaKZp]

Great ! Finally should i say 🙂  !! Will spare a lot of time !!

[scottb]

One can hope!  I'd love to see something done as well to beef up OS updates/upgrades.  This is so long overdue!

Thanks @jamf for working on this.  Looking forward to seeing it in action.

[rstasel]

No on-prem option? Really? death by a thousand cuts... 

[user-eZxmRKlCMh]

Hey @JustinC,

is there any docu for beta customer on the usage?

Best Regards

Konstantin

[JustinC]

Hi @user-eZxmRKlCMh 

There is a guide that is accessible to the private beta customers (it was published in the App Installers private beta forum). As App Installers moves to being more publicly accessible, there will be documentation available at that time.

[KyleEricson]

How can we signup for this beta? @JustinC 

[dletkeman]

I'd be all over this beta but it sounds like we'll have to wait until early 2022 for a public beta.

[user-eZxmRKlCMh]

Hey @JustinC,

I have the beta but I cant find this guide... I have access to this here: https://community.jamf.com/t5/jamf-pro-10-35-0-beta/gh-p/jamfpro10350

So where should I look :D?

Best

[JustinC]

The private App Installers beta group was seperate to the standard Jamf Pro beta forum and the guide was published in the seperate forum. We are still making further changes to App Installers and hope to be able to open the feature up in a public beta in the near future.

[alexloew]

Hey Justin, appreciate the update! Really looking forward to the future of patching with Jamf Pro. Question about the public beta of "App Installers", will it be coupled with a future Jamf Pro beta release or be its own separate beta release?

[dletkeman]

Can't wait for this.  I'd gobble it up if it were available.  Hungry and juicy.  This sure sounds like a AAA grade cutlet.  MMmmmm!

[KyleEricson]

Can we get a beta for this now? @JustinC 

[dletkeman]

Still excited for this.  Hope it comes soon.

[KyleEricson]

@JustinC How can we get into this beta really need this for my clients?

[JustinC]

Hi @KyleEricson. We are just wrapping up the current dev cycle and hope to make it available as a public beta very shortly. I will provide an update in the next week or so as we get the dates finalized. I appreciate everyone's interest and patience with this.

[JustinC]

Hi everyone. Please join the JAMF Pro 10.37 Beta program to get your first look at App Installers.

You can enrol in the 10.37 beta here https://account.jamf.com/pre-release/beta-program

[joelsenders]

Hey Justin, I installed 10.37 in my on-prem dev environment and everything seems to be working with the enabled Cloud Services Connection. However, I am getting mixed signals about this being available for on-prem customers once it leaves the "preview" phase. Do you know if this will be available to on-prem environments? If not, I think we need to get a feature request going as this would be extremely useful (I'm sure) to us who have on-prem environments.

[JustinC]

@joelsenders App Installers is for Jamf Cloud subscription customers. Whilst today App Installer will work with a non Jamf Cloud instance, it is not supported. There will be some changes in a future iteration of App Installers that will rely on infrastructure that is only available in Jamf Cloud. Once that change is made, the feature will cease to work in an on prem environment.

[joelsenders]

Thanks, Justin. For anyone who is on-prem and interested in this, please upvote the feature request here: https://ideas.jamf.com/ideas/JN-I-25878

[Monkeyfist]

Don't upgrade to 10.38 they took away app installers for on-prem.

[adeane]

I wish that I had seen this earlier. :( I was using app installers previously. The release notes on 10.39 say "App Installer Enhancements" - I guess by that they mean removal if you're on prem. This is kind of a kick in the pants...

[user-eZxmRKlCMh]

Hey @JustinC,

thanks! Where can we find some more informations? We have the BETA 10.37 but I cant find it.

Best Konstantin

[JustinC]

Hi @user-eZxmRKlCMh 

There is a seperate section in the 10.37 beta documentation specific to App Installers. This will walk you through how to use this feature.

[andrewsp]

I don't understand why this isn't being implemented into the Patch Management section where we can control who gets what version of the app (Early Adopters vs All). With this new App Installers, you have a choice of all clients or all servers. This should have been combined in one location, 

[joelsenders]

I think since it uses management commands (like VPP) as opposed to the binary, it shares the section with Mac App Store apps. This probably makes the most sense since they work in the same way.

[JustinC]

Hi @andrewsp. @joelsenders is correct. App Installers uses MDM instead of the Jamf Binary so the underlying behaviour is constrained by what we are able to do with MDM commands. There are a number of other significant architecture differences with App Installers, the packages not being hosted on a customer distribution point as one example, that prevent us from just combining the two feature areas into one. There will be more control over the deployment behaviour in a future release of App Installers.

[uurazzle]

@JustinC  historically MDM hasn't always worked properly or as expected. I understand that Jamf is trying to future-proof with using MDM, but seems like it might be "wise" to cover your basis and allow the Jamf binary be a backup or plan-B when issues arise with the MDM implementation.

[uurazzle]

I agree, need release branching and control like basic dev, testing & production to stage and control releases.

@JustinC is there a concept of rollback with the app installer implementation? What if you dev did testing and it worked as expected but when put into production something "issue" or breaking a app workflow was discovered can you easily rollback to a working version of the application?

[JustinC]

@uurazzle during all of the customer research that was done prior to and during the development of App Installers numerous workflow options were identified. We will be bringing more control options over the deployment behaviour in future releases of App Installers.

[uurazzle]

Does the current process do any QA on the installer does it install or security or virus QA process on the developer installers? I have seen many developer installers that incorrectly set permissions or do many bad installation processes. For example, AutoPKG, uses virus total to do VirusTotal. VirusTotalAnalyzer is an AutoPkg processor to query downloaded files from the VirusTotal database. Since Jamf ones Jamf Protect, maybe it can be updated and implemented to do a security audit of App Installers before they are released in production?

[JustinC]

@uurazzle  we do a security scan on all media downloaded before they enter our build process. We also have Jamf Protect running on our build test environment so that we can check for malicious behaviour whilst the app is running (which a standard AV scan on downloaded media will not pick up).

[thebrucecarter]

Curious as to why they require smart groups only?

[JustinC]

@thebrucecarter unfortunately there was an incompatibility between what I will call 'traditional code' and the 'new code' that App Installers uses which meant that at this time we were unable to use traditional static scoping mechanisms. We hope to address this in a future release of App installers.

[iestynd]

Hello @JustinC,

Curious whether this was brought up in the BETA program at all?

FWIW I have raised https://ideas.jamf.com/ideas/JN-I-25934 bit disappointed that this feature does not follow the scoping format of the rest of the UI, especially in terms of static groups (we use these as rollout/testing groups) but hoping this could be implemented in the near future.

[JustinC]

@iestynd We were aware of the limitation during development however did not want to hold up the release of App Installers due to this limitation and instead made the decision to release it with Smart Group based scoping and will add traditional scoping when possible. 

[uurazzle]

Are app Installers Only Available to Jamf Cloud Customers?

So, the App Installer implementation is stated only available to Jamf cloud subscription, but initially might work with on-premise subscriptions? Is there a technical reason why it will be only available to Jamf cloud customers? If there is a political or financial reason, seems like you could consider other options to allow the on-premise customers the ability to use it until their organization can consider moving to a Jamf Cloud implementation due to multiple reasons like issues with upload stability or automation with the installer package with Jamf Cloud, or security.

I have created a feature request, please vote it up if you need or would like it available to on-premise Jamf instances.
https://ideas.jamf.com/ideas/JN-I-25878

[gzilla13]

Since App Installers will not work for on-prem, couldn't you give everyone the ability to download the packages you build on what I assume is a CDN you manage. We would at least not need to go out and get the packages for the software to use them in Patch Management,  like we currently do. I have a feature request open for this.

https://ideas.jamf.com/ideas/JN-I-25896