Installing Command Line Tools via Self Service

[falbrecht]

Hi

We are in the process of removing local admin rights for users machines. We are trying to figure out how to install command line tools, such as xcode, from self service. The issue we are foreseeing is authentication. We want to write scripts to take care of these installs and wanted to see if anybody else has dealt with something like this and may have some tips.

[MatthewGV]

Found this with a quick search https://gist.github.com/brysgo/9007731

[ljcacioppo]

This might be an option as well:

https://github.com/palantir/jamf-pro-scripts/blob/main/scripts/Install%20Xcode%20Command%20Line%20To...

[awoodbury]

We download the Installer .pkg from the Developer page here:

https://developer.apple.com/download/all

And push it out via a Policy.

[atrystan]

We are installing XCode using the Mac Apps (i.e. VPP) to keep it updated automatically. Have you found problems with compatibility by deploying the CLTs manually?

[donmontalvo]

@atrystan Hmm...fast forward two years, not sure if this is a recent change.

Command Line Tools are now updated via Apple Software Update.

Looks like if it is installed it'll be kept updated there. #questionmark

[atrystan]

This is also my experience. The change has also made it so that only admins can accept the license agreement on launch. As a result, it is necessary to accept terms and conditions as a root user during install.

In the end, we discovered that you can use the App Store Apps to get Xcode installed on the device during enrollment and then add an item in Self Service that does this as root:

xcodebuild -license accept

xcodebuild -runFirstLaunch

Once you do that, regular users can install and launch them.

[mm2270]

I do the same as @awoodbury, since it's free to set up a basic Apple developer account that has access to all the downloads for Xcode, command line tools and others.

[atrystan]

The problem is that Apple has made it so that only admins can launch Xcode now since they assume that only admins should be able to run a debugger. Specifically, non-admins are prevented from accepting the license agreement. In the end, we discovered that you can use the App Store Apps to get Xcode installed on the device during enrollment and then add an item in Self Service that does this as root:

xcodebuild -license accept

xcodebuild -runFirstLaunch

Once you do that, regular users can install and launch them.