To Use Composer or Not?

[DMH2000]

We were shown how to use Composer to package applications from DMGs when we purchased Jamf Pro.  You install the app to Applications via the DMG. Then you copy the app to Composer and supposed to change the perms to 'root' & 'wheel' and 'Apply Owner and Group to Frameworks and All Enclosed Items' to the uppermost folder (Applications).

My question is, some apps come as a Package (.pkg).  Can I just import the package to Jamf to push the app to users? Do the permissions really matter?  The 'root' and 'admin' permissions are always there in Composer, all of our associates are admins on their Macbooks.

Thanks in advance for any insights into this.

[obi-k]

If the vendor provides the .pkg, there's no need to re-invent the wheel. Yes, you can import to Jamf and push.

Having said that I would use Suspicious Package (or something equivalent) to inspect and validate the package before pushing. Of course, test, test, test.

https://mothersruin.com/software/SuspiciousPackage/ 

[DMH2000]

Thank you, we only go to legitimate websites like Microsoft which has the 'Company Portal' as a package. That is why I was asking. 

[sdagley]

@DMH2000 Even if you're only going to "legitimate" web sites for .pkg installers @obi-k 's recommendation to validate them with Suspicious Package after downloading is still valid.

[sgiesbrecht]

Never heard of this tool but I will be using it now.  Thank you @obi-k 

[obi-k]

Yeah, for Company Portal I've just used what Microsoft offered. You can dump it into the Suspicious Package application and see what's inside for the heck of it. Always good to inspect.

[gurduv]

Composer is nice, but I use Packages to build custom pkgs.

I get much more flexibility and the GUI is more friendly to me:

http://s.sudre.free.fr/Software/Packages/about.html

[dreh15]

@gurduv with Packages, doesn’t one have to check the disk to see where things were installed? For instance, if an Adobe CC app is added, there’s the app in /Applications, but there might be things installed in /Library or ~/Library. Composer would look for all those things, but with Packages, wouldn’t it need to be looked for manually to add to the package being created?

[sdagley]

@dreh15 Packages does not have a "Watch for file system changes and create an installer for any changed files" mode like Composer does. You'd have to manually add anything you want installed to your Packages created installer project.

[NickGuru]

I get the following "this application was downloaded from the internet", select ok to proceed... Try to go to the vendor example FireFox, Chrome, etc... for the PKG..  furthermore. I don't like using composer.. it takes a real long time to package stuff.. I recommend "Packages"... http://s.sudre.free.fr/Software/Packages/about.html