Worked this out with @rtrouton based on both his installation script as well as the one located at cobbservations.wordpress.com
Wanted to offer Xcode 8 (requires OS X 10.11.5 or later) to our user population via Self Service.
Downloaded the Xcode 8 installation package from the App Store using the App Store Capture Methodology (yes, VPP would be better), described at:
https://derflounder.wordpress.com/2013/10/19/downloading-microsofts-remote-desktop-installer-package-from-the-app-store/
Added the 4.43GB installation package to the JSS, created a Self Service policy to install it, and used this script below (set to Run After) to handle all of the post-installation processing (so that users are not prompted for admin credentials). You may want to customize the script for your environment (we don't disable the Gatekeeper validation, and our users are already developers, nor do we have multiple versions of Xcode installed, so those line-items are disabled, but it's your call):
#!/bin/bash
# Accept EULA so there is no prompt
if [[ -e "/Applications/Xcode.app/Contents/Developer/usr/bin/xcodebuild" ]]; then
"/Applications/Xcode.app/Contents/Developer/usr/bin/xcodebuild" -license accept
fi
# Just in case the xcodebuild command above fails to accept the EULA, set the license acceptance info
# in /Library/Preferences/com.apple.dt.Xcode.plist. For more details on this, see Tim Sutton's post:
# http://macops.ca/deploying-xcode-the-trick-with-accepting-license-agreements/
if [[ -e "/Applications/Xcode.app/Contents/Resources/LicenseInfo.plist" ]]; then
xcode_version_number=`/usr/bin/defaults read "/Applications/Xcode.app/Contents/"Info CFBundleShortVersionString`
xcode_build_number=`/usr/bin/defaults read "/Applications/Xcode.app/Contents/Resources/"LicenseInfo licenseID`
xcode_license_type=`/usr/bin/defaults read "/Applications/Xcode.app/Contents/Resources/"LicenseInfo licenseType`
if [[ "${xcode_license_type}" == "GM" ]]; then
/usr/bin/defaults write "/Library/Preferences/"com.apple.dt.Xcode IDEXcodeVersionForAgreedToGMLicense "$xcode_version_number"
/usr/bin/defaults write "/Library/Preferences/"com.apple.dt.Xcode IDELastGMLicenseAgreedTo "$xcode_build_number"
else
/usr/bin/defaults write "/Library/Preferences/"com.apple.dt.Xcode IDEXcodeVersionForAgreedToBetaLicense "$xcode_version_number"
/usr/bin/defaults write "/Library/Preferences/"com.apple.dt.Xcode IDELastBetaLicenseAgreedTo "$xcode_build_number"
fi
fi
# DevToolsSecurity tool to change the authorization policies, such that a user who is a
# member of either the admin group or the _developer group does not need to enter an additional
# password to use the Apple-code-signed debugger or performance analysis tools.
/usr/sbin/DevToolsSecurity -enable
# Add all users to developer group, if they're not admins
/usr/sbin/dseditgroup -o edit -a everyone -t group _developer
# If you have multiple versions of Xcode installed, specify which one you want to be current.
/usr/bin/xcode-select --switch /Applications/Xcode.app
# Bypass Gatekeeper verification for Xcode, which can take awhile.
if [[ -e "/Applications/Xcode.app" ]]; then xattr -dr com.apple.quarantine /Applications/Xcode.app
fi
# Install Mobile Device Packages so there is no prompt
if [[ -e "/Applications/Xcode.app/Contents/Resources/Packages/MobileDevice.pkg" ]]; then
/usr/sbin/installer -dumplog -verbose -pkg "/Applications/Xcode.app/Contents/Resources/Packages/MobileDevice.pkg" -target /
fi
if [[ -e "/Applications/Xcode.app/Contents/Resources/Packages/MobileDeviceDevelopment.pkg" ]]; then
/usr/sbin/installer -dumplog -verbose -pkg "/Applications/Xcode.app/Contents/Resources/Packages/MobileDeviceDevelopment.pkg" -target /
fi
# Install XcodeSystemResources.pkg so there is no prompt
if [[ -e "/Applications/Xcode.app/Contents/Resources/Packages/XcodeSystemResources.pkg" ]]; then
/usr/sbin/installer -dumplog -verbose -pkg "/Applications/Xcode.app/Contents/Resources/Packages/XcodeSystemResources.pkg" -target /
fi
exit 0
Wow...I may owe @RobertHammen a beer, and @rtrouton a Pepsi at JNUC2016...if they're going this year. :)
PS, any way to get the Additional Components installed without having to snapshoot? Thought the last two sections to install PKGs would eliminate that?
@dfarnworth_barc pretty sure you're thinking of older versions of Xcode being downloadable. New version will always direct you to App Store. [See correction below] Apple provides downloads for versions are provided so developers can run concurrent versions and use xcode-select to toggle between versions. Like when a developer needs to create something for an older iOS version that the new version of Xcode doesn't support iOS Simulators for that iOS version.
@RobertHammen My apologies, I forgot to circle back after testing. The only difference between this process and ours, we don't hijack Apple's App Store packages. Instead we allow App Store to install, and we grab it from there. This way we don't get in the way of the App Store process, and a proper _MASReceipt is present.
Pretty sure first launch prompted me, thinking back it may have been to install or update Command Line Tools. We ended up adding a line to the script to run /usr/bin/xcode-select --install, but I have to search through my notes.
We were packaging iOS Simulators but are trying to avoid having to deal with that madness (that's a lot of bits dude!)...we opened a ticket with AppleCare Enterprise Support to see if they've got a command line method to install so we don't have to reinvent the wheel.
Yea, admin rights would alleviate this, but we have to play by the rules. Admin rights where I'm employed requires a Security Exception. Queue in the occasional "You're not doing it my way, so you're doing it rong!" mantras...#rollsEyes
Not interested in being on the front page of <redacted> with the headline"Famous company hacked because IT Department was too cool to give a $#!+". My mom isn't famous, so being employable is a thing for most of us.
@gregneagle understood, and agreed. The AppleCare Engineer explained that would happen. We discussed risk, support, etc.
Two options for VPP deployment of Xcode. Apple's suggestion that elevates rights for install of Apple related stuff, or Local Admin Privileges (user requests security exception) that elevates rights across the board. We can provide most of the automation as a policy that user has to trigger through Self Service, but there is a hole.
If we deploy non-AppStore version of Xcode, we can add Command Line tools, and all the settings/suppression, to the payload. This should cover all prompts, but we are still getting a prompt due to only one of three additional required component packages installing (strange; looking into it). Same hole as VPP method.
Our intent is to provide deployment via VPP plus one Self Service policy, which results in user getting the limited elevated rights as suggested by Apple.
Or to deployment the old way, by deploying non-AppStore version, plus Command Line Tools, plus the script that gives user limited elevated rights as suggested by Apple.
The third option would be user can either submit a request for a security exception (to get Local Admin Privileges), or call Help Desk each time he/she gets a prompt.
Its good to know Apple is taking these admin prompts seriously, hopefully they'll do something soon so we won't have to jump through so many hoops to deploy their software. :)
