Flash Update Script

[djdavetrouble]

Deleted old cringey script , the real one is below.

[agerson]

Wow! Thanks everyone. This fell into the "exactly what I was looking for" category.

[cwaldrip]

Figured out where the PPAPI url is...

https://fpdownload.adobe.com/get/flashplayer/pdc/"${latestver}"/install_flash_player_osx_ppapi.dmg

[SMMC]

Can this be run through self service? We put it in as a script but the self service quits with no error messages in the jamf.log

[peterlbk]

Hi @SMMC ,

I have this running in a recurring policy and seems to work fine. can you check your logs on the JSS to see what's wrong?

Cheers Peter

[McGinn]

Thanks for the help everyone

[cwaldrip]

@SMMC We have it setup as a self service item and it works fine.

[mm2270]

Just a FWIW, since I've been monitoring this thread, my own update script continues to work to identify the current Flash Player plugin version and the download location (and downloading and installing it of course) It may be because my method is using Adobe's own distribution download URL you obtain when you sign up for distribution, to get the current release location. Maybe that's the trick going forward to prevent things from breaking. I haven't changed anything with my script in a number of months so I didn't need to make any adjustments to be able to update Flash.

[gachowski]

I signed up a second time as the fist link I had when Adobe told everyone that they were going to change stopped working. The new link takes me to a master page with all the download links.

I select the "Download DMG Installer (for System Administrators)" link and that will download the .pkg installer, however I can not "curl" that link.

Also there are I think two threads about this and two different links are working plus mm2270 original link ... I am confused and this really isn't rocket science...

I have no way of knowing what link will work next when there is another update : )

C

[mm2270]

I select the "Download DMG Installer (for System Administrators)" link and that will download the .pkg installer, however I can not "curl" that link.

Yes its possible to curl that link. I'm doing it in my script. The trick is to include the -L flag since that is a redirect link. The -L flag for curl asks curl to follow redirects when it encounters them. Try the following as an example:

curl --connect-timeout 8 --max-time 8 -sfL "Adobe_Dist_URL_Goes_Here" | awk -F'"' '/Download DMG.*for System Administrators/{print $2}' | grep "adobedist" | grep "osx_pkg"

Of course, change the "Adobe_Dist_URL_Goes_Here" to your actual distribution URL. The one that gives you that full listing.

This will, or should, give you the full download path to the installer DMG. Although note the address it returns includes your unique distribution UID in the string. It still works to curl that down to a machine though.

If you want to get the PPAPi version download URL, just change the last grep to:

grep "osx_ppapi_pkg"

Just a note. You may need to adjust the --connect-timeout and --max-time integers (these are in seconds) I had to add those because Adobe's distribution page is woefully slow to load, even over curl. So these help make sure curl doesn't give up too early, or hang indefinitely trying to accessing the page. Not sure why a company with a billion plus in revenue can't make their pages load a bit faster, but whatever.

[gregneagle]

Or you could make use of the assistance of hundreds of other interested Mac admins and use autopkg...

http://autopkg.github.io/autopkg/

[cgiordano]

@peterloobuyck First, thanks for updating the script with the correct URL for NPAPI so quickly. Second, due to my own inexperience, I'm not sure how you were able to deduce the newest URL so quickly. For my own education, would you be able to explain that to me?

@gregneagle Unfortunately, not all organizations are allowed to us AutoPKG due to the fact that it's open source software. My company's privacy policy is pretty strict and if the open source developer doesn't have a privacy statement I'm not allowed to even think about using the software. It works for most orgs but not all.

[gachowski]

@mm2270

Thank you very much Mike!!! I wasn't using any Flags : )

C

[gregneagle]

@cgiordano I understand that some organizations have rules around open source. You definitely should adhere to your organization's rules.
What you describe would then also not allow you to use some random script you found posted to JamfNation as well, no? I don't see that @peterloobuyck has posted a privacy statement, or even released his script as open source. You might be in violation.
So you have to write your tools and maintain them yourself to remain in accordance with your company's privacy policy. I'd think you'd have to stay away from using Python, Perl, Ruby and/or bash to write your tools as well unless those open source projects also have privacy statements.

[donmontalvo]

[tcandela]

@peterloobuyck so the adobe script you posted replaces the broken one ?

haven't tested it yet but just wanted to ask

[peterlbk]

@cgiordano , I just downloaded the file manually, then I selected 'Show Info' in Finder. The URL is right there...

@tcandela Right, I adjusted the download url and download page. Works fine again.

[cwaldrip]

@mm2270 I tested the script on your GitHub repository (installLatestFlashPlayer-v1.sh) and it doesn't download the latest dmg, but html saying the "The requested URL /get/flashplayer/current/licensing/mac/install_flash_player_24_osx_pkg.dmg was not found on this server"

Is there a newer script I should be looking for?

edit: It's actually creating a dmg file per the curl command, but its only a few bytes and if I open it in TextEdit it's a brief snippet of HTML with that message.

[mm2270]

@cwaldrip Ah, no. That script is old, and I should really remove it at this point since its definitely not working anymore. As you already discovered. The one I was referencing isn't something published on my github page unfortunately. I've been meaning to do it, but because it continues to be a work in progress, I held off on doing that. Its really a rework of another script on my github that I also should remove, called "Update_Core_Apps.sh"

If you want to try out the one I'm talking about, send me an email at mm2270 [at] icloud [dot] com and I can shoot the script over to you at some point this week. Just as a reminder though, for the Flash portion to work, it does require signing up with Adobe to get a distribution license, so be sure you have that in place before anything.

[rblaas]

@mm2270 I am kinda stuck on the custom url part . I signed up at adobe and I got an email with a download url which I should not share.. I entered this url in the script but still it does not work.. So my guess is that I have the wrong url...

Any tips ?

[cwaldrip]

@rblaas Downloads from the adobe agreement site are more than just...
https://fpdownload.macromedia.com/get/flashplayer/distyfp/current/mac/install_flash_player_24_osx.dmg

But really something like...
https://fpdownload.macromedia.com/get/flashplayer/distyfp/current/mac/install_flash_player_24_osx.dmg?adobedist=<10_digit_number>-<32_character_string>

It includes a session ID that's only good for that browser session, so the long URL won't work for scripting as far as I know. But I think others have figured out how to do it. Personally, I'm back to using the public link even though I've signed up for the distribution page.

[rblaas]

@cwaldrip I guess that's where the problem lies... I don't have url's like that....

I did apply for the Agreement..

regards,

Ronald

[rblaas]

@cwaldrip I did receive a licence agreement but I can not find any usable url in it.

I must be looking at the wrong places

[mm2270]

@rblaas The URL I received that I'm using in my script looks something like the following:
http://www.adobe.com/products/flashplayer/distribution4.html?auth=<LONG-UID-STRING-HERE>

Do you see anything in your emails from Adobe that look like that?

[rblaas]

@mm2270 I don't have that.. What can I possible have done wrong?

Mine ends with distribution5.html
with no authentication id or whatever

[mm2270]

Hmm. I'm not sure. When did you sign up? I know it took a few days, if I recall now, when I first signed up, before I got the URLs. Also, I noticed you have distribution5.html. Mine is still distribution4.html. I wonder if that makes a significant difference. I will need to look into that. I'm guessing mine is an older URL since I signed up a while back.

[cwaldrip]

To see the long URL you can't just copy paste from the web site. They do some 'magic'. Download a file, and then use Get Info to see the URL the file was downloaded from, and a link to the page it came from (separated by a comma).

[mm2270]

@cwaldrip FWI, it wasn't necessary for me to download anything to get that long URL. For me, it was right in the email Adobe sent me after signing up. I'm looking at that email now. To be fair, it was from March 29, 2016. So its possible they no longer send the full URL in the email, but some kind of redirect link that gets you there in some other fashion.

Edit: On second looks, I see that your address is from actually downloading the DMG. So, the issue with using that is, while it works today, when Adobe decides to change some portion of that address, as they did kind of recently, the script will break, since its now using the wrong direct link to the download. By using the distribution page and some code to scrape the location, it should continue to work even when Adobe switches things up. That's why I'm using that in my script, not the direct link. IOW, the script will locate the actual download location from their distribution page and then download it from there, rather than hardcoding in a path from their fpdownload site.

That said, there is of course no guarantee Adobe won't completely change around their distribution page at some point and break what I'm doing.

[cwaldrip]

Yeah, it doesn't look like they include it in the email any longer. The address from the download seems to be a session ID, which times out after a few minutes or an hour or so. Hovering over the provided URL reveals the same generic URL.

[mm2270]

Ok, thanks for that. Well, that explains the difference. The change must have happened when they moved to the distribution5.html pages. I see hitting that exact page brings me to a sign in page, so that means it will no longer work. Time to rethink this.
As others have already ranted about, Adobe seems hell bent on putting the final nails into their own product with this onerous process, just to get a stupid installer for their plug-in. You have to wonder what they are thinking sometimes!

[gachowski]

I can back you guys up...

My 1st link that I received in 2016 has the auth code and the my new link from this year doesn't : )

C

[rblaas]

Ok,

@mm2270 So for now the status is that it is not working?

@cwaldrip I do see the adobedist id you are referring to...

[mm2270]

@rblaas I'm sorry, but yes, since Adobe has changed the link to not have an embedded auth code in it, unless you still have one of the older links that does have that auth code in it, my script won't pull down the installer. The page it hits requires you to actually log in now, unlike before where it just brought you right to the install locations.

You're better off using some of the code from other posts above that use a direct path. You just may need to keep an eye on that and update it every so often according to Adobe's whims.

[WhippsT]

In case it hasn't been posted yet, the script posted by @rtrouton on GitHub works perfectly to update Flash. It works flawlessly as of today.

https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/install_latest_adobe_flash_player

[cwaldrip]

Argh. I really need a week to figure out how SED works. Until then, can someone see why this line has stopped getting the current version number?

latest_ver=`/usr/bin/curl -s http://www.adobe.com/software/flash/about/ | sed -n '/Safari/,/</tr/s/[^>]*>([0-9].*)<.*/1/p' | head -1`

[russeller]

This works for me.

latestver=$(curl -s http://get.adobe.com/flashplayer/about/ | grep -A4 "Macintosh" | grep -A2 "Safari" | sed -e 's/<[^>][^>]*>//g' -e '/^ *$/d' |  tail -n 1 | awk '{print $1}' |tr -d "
")

You can test it out by just running this part in terminal

curl -s http://get.adobe.com/flashplayer/about/ | grep -A4 "Macintosh" | grep -A2 "Safari" | sed -e 's/<[^>][^>]*>//g' -e '/^ *$/d' |  tail -n 1 | awk '{print $1}' |tr -d "
"

I just changed grep to -A2 I think it was previous -A1

[cwaldrip]

Ah, that got me where I needed to go. Thanks @ssrussell

[mm2270]

Any particular reason not to curl against the official Adobe FlashPlayer Mac version xml file instead of trying to scrape the page?

$ curl -sf http://fpdownload2.macromedia.com/get/flashplayer/update/current/xml/version_en_mac_pl.xml | xmllint --format - | awk -F'"' '/<update version/{print $2}' | sed 's/,/./g'
$ 25.0.0.171

[cwaldrip]

Oh, the xml file is good to know. How's it updated though when the NPAPI and the PPAPI versions diverge (happened a couple of weeks ago)?

[mm2270]

Hmm. That's a good question, which I don't know the answer to. As far as I can tell, that xml will always show the most current NPAPI version. I'm not sure how Adobe handles it for PPAPI though. I get the feeling that xml is only for NPAPI, and just by coincidence it often matches up with the PPAPI version, except for on occasion.

[peterlbk]

Hi Guys, the latest curl line on here didn't work for me. I added one last awk request to it:

curl -s http://get.adobe.com/flashplayer/about/ | grep -A4 "Macintosh" | grep -A2 "Safari" | sed -e 's/<[^>][^>]>//g' -e '/^ $/d' | tail -n 1 | awk '{print $1}' | tr -d "
" | awk -F "<" '{print$1}'

As for why we don't use the xml, it's a fact that that source of version checking is not available.