How to update Chrome automatically

[LewisLebentz]

I have just written a blog post on how to automatically update Google Chrome using Jamf if anyone is interested. You can find my blog post here:

https://lew.im/2017/03/auto-update-chrome/

I have seen a few different methods posted here, but most require some admin intervention (uploading new packages, changing version numbers etc.) but this method is fully automated. Create the Extension Attribute, Smart Group and Policy and you're good to go! Every time Google release a new version of Chrome, this script will automatically grab it and install it on your Macs.

[CorpIT_eB]

@ryan.ball That gave me a Code 0

I will let you know if this updates the current version of Chrome and toggles on auto updates after a recon push.

Thanks again for all your hard work @ryan.ball

[rqomsiya]

I'm getting this error with @ryan.ball 's script:

KSInstallAction install script failure. Exit code: 12. Standard error output: "goobspatch: old hash mismatch: ee3b7cc8d6e24be4a5cd4bf41330bc783aac1411 != 08a53d4ffe4dd04384ff193b609c604b99af24f0 dirpatcher.sh: couldn't create /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/75.0.3770.90/Google Chrome Framework by applying /tmp/KSInstallAction.5kcwe9seHm/m/.patch/framework_75.0.3770.80_75.0.3770.90.dirpatch/Google Chrome Framework$gbs to /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/75.0.3770.80/Google Chrome Framework .keystone_install: dirpatcher of versioned directory failed, status 13 ".

Anyone seen this?

[sdagley]

@rqomsiya Notice the mix of version numbers in that output

[rqomsiya]

@sdagley I only have one version installed, why do you think it might be pulling different versions?

Thanks!

[sdagley]

@rqomsiya Take a look inside the Google Chrome.app package (right-click on the Google Chrome.app icon select Show Package Contents from the popup menu that will be displayed). Dig down into Contents/Frameworks/Google Chrome Framework.framework/Versions and you'll see there are actually multiple versions present.

I suspect either @ryan.ball's script has a problem running when there is more than 1 version present, the v75 Chrome updater mechanism has a problem when more than 1 version is present, or your install of Chrome was corrupted.

[ryan_ball]

Somehow this became my script, so I took it upon myself to add error checking and some output that might help people. I'm afraid that adding multiple versions to the thread has probably caused some confusion for folks, so I've posted a version on my github for the community to try.

[msw-sa]

Written by Ryan Ball after somehow becoming responsible for it

@ryan.ball Hah I know the feeling — thanks for your work on this. I'm sure it will be used by many 👍

[Dr_Jones]

This method has worked perfectly for me over the past year

1. https://grahamgilbert.com/blog/2018/03/14/google-chrome-update-notifications-with-yo/
2. https://github.com/grahamgilbert/chrome_update_notifier

[CorpIT_eB]

@Dr_Jones You mean in terms of Notifications correct not a script for updating and keeping It's self updated.

[mostlymac]

@rqomsiya I'm getting that same error. Did you ever find a solution?

[rqomsiya]

@millssa4 I just completely uninstalled Chrome and re-installed then applied the script as a post flight script.

[CorpIT_eB]

@ryan.ball Sorry to bother with this again but I have a question. I been using your script and it was working very well however today I noticed that even though I am getting:

Script exit code: 0
Script result: Keystone installed
Registered Chrome with Keystone

It will not update the latest version now that is 75.0.3770.142 if I try to manually do it I get the following:

KSInstallAction install script failure. Exit code: 12. Standard error output: "goobspatch: old hash mismatch: 393008d2729f964aab6934b31481b8a2e253ab7b != 5c333879450103300e0ca50c73676b2dd9acac13
dirpatcher.sh: couldn't create /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/75.0.3770.142/Google Chrome Framework by applying /tmp/KSInstallAction.K76DdNHJfN/m/.patch/framework_75.0.3770.100_75.0.3770.142.dirpatch/Google Chrome Framework$gbs to /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/75.0.3770.100/Google Chrome Framework
.keystone_install: dirpatcher of versioned directory failed, status 13
".

Same situation as @rqomsiya

Did Google change something yet again or is it just a script adjustment?

[ryan_ball]

Are you using the version from my github?

[ryan_ball]

Also, are you going to the Chrome > About menu and trying to see if it is able to be updated?

[CorpIT_eB]

@ryan.ball

Are you using the version from my github?

Yes sir the one and the same, been working amazing until now.

So that error is directly from the about page when "Manually" trying to update Chrome.

KSInstallAction install script failure. Exit code: 12. Standard error output: "goobspatch: old hash mismatch: 393008d2729f964aab6934b31481b8a2e253ab7b != 5c333879450103300e0ca50c73676b2dd9acac13 dirpatcher.sh: couldn't create /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/75.0.3770.142/Google Chrome Framework by applying /tmp/KSInstallAction.K76DdNHJfN/m/.patch/framework_75.0.3770.100_75.0.3770.142.dirpatch/Google Chrome Framework$gbs to /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/75.0.3770.100/Google Chrome Framework .keystone_install: dirpatcher of versioned directory failed, status 13 ".

@ryan.ball could it be that your variable $chromeMajorVersion -ge 75 now needs a bit of tweaking as I feel since the major release has not been made and the only thing changed was was decimal value from .100 to .142 the script is still grabbing .100 even though your operator clearly states "greater than or equal" again not really sure if that's what is happening just a theory. Much like, @sdagley stated earlier. What do you think @ryan.ball?

[ryan_ball]

I think it was due to the running of the preflight/postflights in the script on my Github. I've removed them and it seems to update normally now. You might have to remove/re-install Chrome to test this for functionality.

[CorpIT_eB]

@ryan.ball I hate to ask man, but do you happen to have a uninstaller script that I might be able to use I been reading several articles on how to script it but it seems like there are various locations I might have to script in

[sdagley]

@CorpIT_eB To remove Chrome just do this via an Execute Command line in a Files and Processes payload:
rm -rf "/Applications/Google Chrome.app"

[CorpIT_eB]

@sdagley Thanks, i had tried that and it was not working on my earlier testing but I didn't add the -rf switch to it nor was I adding it to the Files and Processes I'll give this a try.

Thanks Again.

[sdagley]

@CorpIT_eB Application bundles are just directories. You can't simply do an rm on a directory if it isn't empty. The -rf means recursively delete anything in the path /Applications/Google Chrome.app without prompting, so anything in the directory is first removed then the directory itself.

[Arre]

Hi, I saw this KSInstallAction error as well this morning when testing out our deployment, the Chrome package was minor version 100 going to 142. I had a non-imaged computer with minor 100 on it, but the python script was not executed on it (it was not DEP deployed and still prompted to set up auto updates). When I manually entered the admin password and enabled the updates, tried to manually update Chrome and got the exact same error. There is a chance this is a Chrome / Google issue. I will investigate more about this...

[kyleblanc]

I've also been receiving this same KSInstallAction error stating a hash mismatch. Doesn't matter if I script the install/update of Chrome or if I package it manually using Composer. Once it tries to check for updates or fetch an auto update it fails with the same KSInstall hash error. Thought it was me doing something wrong but looks like it could be a Google/Chrome specific issue lately. I found this Google Chrome help thread this morning which appears to be affecting normal Chrome users as well, not just those messing with updates/packaging it.

[Arre]

I can confirm, I just set up a fresh Mojave installation (no JAMF or DEP) and used the unmodified version 75.0.3770.100 dmg (same version we are distributing) and got the same KSInstallAction error when doing a manual update check trying to update to 75.0.3770.142. So it appears our script is not the culprit, this is a Google / Chromimum problem.

[CorpIT_eB]

Confirmed to be a Chrome issue I think as there are multiple reports now: KSInstallAction install script failure.

[jwojda]

did this get resolved? The link @CorpIT_eB shows some people manually redownloaded and now it's working again.

[CorpIT_eB]

@jwojda I would of had to create a script to remove and then reinstall for, four machines that where showing this error so I reached out to them individually and told them to re-install Chrome so I didn't have to make any changes to the current script setup.

[federico_joly]

Hi all and thanks for the amazing work shared here! I have to observations:

1)
I'm not into Python so I grabbed the bash version of the 'enable-autoupdates' script. However this doesnt work for me. I tested manually deleting /Library/Google and the bash script doesn't recreate it. I get this error:
Keystone installed
Error: Failed to register Chrome with Keystone - code 0
line 51: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin: No such file or directory
Process finished with exit code 0

So apparently the bash script fails to install the keystone. The python script however does install it.
Any ideas?

2)
What's the point in enabling autoupdates if we have a smartgroup that detects (by using the EA that compares to that google hidden site) computers with Chrome older than the latest version installed, and a policy that installs the latest version in those computers?

Thank you!

[federico_joly]

Hi Again, disregard point 1). I was trying it from my editor and I had no output, it needed sudo. Fool me!

[msw-sa]

@federico.joly For me, the point is that using the application's built-in capability to stay updated is likely the most reliable possible option, and should continue to work even if something interrupts communication with JAMF.

[Éric]

@ryan.ball Thanks a lot, your script is a life saver

[maurits]

I have used a different approach, (tested on Chrome 78 and 79 on macOS 10.15.2), and when I use a script that runs a chown to $CurrentUser after installing as part of the policy

/usr/sbin/chown -R $3 "/Applications/Google Chrome.app"

and the default setting to enable autoupdate is working. No other script needed.
It may take a second start of Chrome, but this is my solution. We have single user Mac's. (does not work for multi-user mac's)
I keep an eye at the patch reporting, so really old versions can always force a re-intall of a current version. Most users with old versions are not using chrome ....

[msw-sa]

I regret to post that we just started having issues with @ryan.ball's python version of this script today. The error is

KeystoneRegistration.framework not found
Error: Keystone install failed

I'm just starting to look into it now so no findings yet. Just starting the conversation. I wonder if Google decided to re-organize the app package again or something...

Update #1
Verified Chrome 80 came out between yesterday evening and today. Likely related...

Update #2
In Chrome <80, there is a key in Chrome's info.plist called KSUpdateURL. In Chrome 79.0.3945.130 KSUpdateURL is https://tools.google.com/service/update2. Starting in Chrome 80, that key is gone.
In Chrome <80, there's a keyin Chrome's info.plist called KSProductID. In Chrome 79.0.3945.130 KSProductID is com.google.Chrome. Starting in Chrome 80, that key is gone.

I will keep looking into this after lunch but I expect anyone relying on this script will have the same problem starting today.

[ryan_ball]

@msw-sa Framework location probably changed again in v80. I can take a look at it a bit later today and update the code (unless some kind soul does a PR).

[msw-sa]

@ryan.ball Yup, looks like it was something like that. Not sure why Google keeps doing this. Imagine if there was product documentation and we didn't have to homebrew this crap......

[cbrewer]

It looks like ksinstall is now located in a new Helpers directory.

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall

Edit: I created a pull request for the bash version of this script (not thoroughly tested):
https://github.com/ryangball/chrome-enable-autoupdates

[sdagley]

@msw-sa I just downloaded Chrome 80.0.3987.87 and it has the KSUpdateURL and KSProductID keys in the app's Info.plist. Maybe them being missing was a temporary glitch and you just got lucky when you downloaded?

[msw-sa]

@sdagley That's interesting. I've seen the same on 2 machines now. I'll test another upgrade.

Edit: yup, on a machine I just upgraded now from 79 to 80, both of those keys are back. Smh

I can confirm the updated version of the script is working in our environment. Thanks to github user hjuutilainen for finding the change and updating the script. @ryan.ball I believe you are off the hook 👍

[ryan_ball]

@cbrewer tested your PR on v74, v79, and v80. Seemed good to me. Thank you.

[danlaw777]

pardon my ignorance in this but i have a few questions. do you just use the script that @cbrewer created and no other packaging is needed? or do you still need to add the latest chrome dmgs to your server?

[msw-sa]

@danlaw777 The script being discussed here is just for enabling automatic updates on an existing Chrome install. You can include a package, but you can also install the current stable version of Chrome with a script and then you don't have to maintain a current pacakge. Removed a couple of organization-specific things, otherwise my script looks like this:

#!/bin/sh

echo "Installing the current stable version of Google Chrome..."
echo "Downloading..."
curl -k --silent --retry 3 --retry-max-time 6 --fail https://dl.google.com/chrome/mac/stable/GGRO/googlechrome.dmg --output /googlechrome.dmg

echo "Mounting DMG..."
hdiutil attach -quiet -nobrowse /googlechrome.dmg -mountpoint /Volumes/GC/

echo "Installing..."
cp -r /Volumes/GC/Google Chrome.app/ /Applications/Google Chrome.app/

echo "Cleaning up..."
hdiutil detach /Volumes/GC/
rm -rf /googlechrome.dmg

chrome_version=`defaults read /Applications/Google Chrome.app/Contents/Info CFBundleShortVersionString`
echo "Chrome $chrome_version installed..."
echo "Install complete. Exiting..."

Hope this helps!