Bootstraping OS X w/ Munki & Simian
TL;DR How-to do managed software installation to bootstrap OS X using Munki and Simian.
Munki is managed software installation for OS X.
“[…] a set of tools that, used together with a webserver-based repository of packages and package metadata, can be used […] to manage software installs (and in many cases removals) on OS X client machines.”
“Munki can install software packaged in the Apple package format, […] and drag-and-drop disk images as installer sources."Munki
Simian is “Enterprise Mac OS X Software Deployment on App Engine”
At Macworld SF 2011, Google’s Mac Operations and Security teams open-sourced Simian, a project that builds on Munki, providing a highly-scalable server hosted on Google App Engine.Munki
Get Going…
Following the simian Wiki AdminSetup to setup the admin machine for server deployment and management…
At first the make test build failed with:
Running M2Crypto-0.21.1/setup.py -q bdist_egg --dist-dir /var/folders/n4/t_4jzs_j203bvtvx4lvvjv2c0000gn/T/easy_install-gHfZ5L/M2Crypto-0.21.1/egg-dist-tmp-9cO19V
SWIG/_m2crypto.i:31: Error: Unable to find 'openssl/opensslv.h'
SWIG/_m2crypto.i:45: Error: Unable to find 'openssl/safestack.h'
SWIG/_evp.i:12: Error: Unable to find 'openssl/opensslconf.h'
SWIG/_ec.i:7: Error: Unable to find 'openssl/opensslconf.h'
error: Setup script exited with error: command 'swig' failed with exit status 1
make: *** [test] Error 1
On Simian’s Google Group I found the discussion OpenSSL error in simian pkg postflight and distilled the following suggestion (actually distilled and assembled from various sources - a.k.a “learning the hard way”):
- Make sure Xcode is installed and do
xcode-select --install make test- Obtain an App Engine instance…
- Adjust
etc/simian/settings.cfg make release
Simian uses 2 layers of certificate exchange, both SSL and custom, to make certain authentication of client and server.Simian
For creating a basic CA from scratch, creating server identities and finally creating client identities follow the steps outlined on Simian and Certificates wiki page.
In order to package a deployable client - i.e. to package a client that is deployable to your Mac fleet - via make dmg (following the PackagingDeployableClient wiki page) make copy ca_public_cert.pem and server_public_cert.pem into etc/simian/ssl (NOT into one of the existing subdirectories!).
To test Simian configurations, including the validity of the client certificates and communication with the server execute the following command:
$ sudo simianauth --debug
Create first package following the section Importing Firefox on Munki wiki page DemonstrationSetup:
cd /Users/Shared/ \
mkdir munki_repo \
mkdir munki_repo/catalogs \
mkdir munki_repo/manifests \
mkdir munki_repo/pkgs \
mkdir munki_repo/pkgsinfo
Configure tool munkiimport:
$ /usr/local/munki/munkiimport --configure
Create manifest for the Firefox package:
$ /usr/local/munki/makepkginfo ~/Downloads/Firefox\ 25.0.dmg | mate
Ready to copy & paste into Simian’s Package Admin, button New Package: https://simian.example.com/admin/packages
Hints and workarounds
If faced with the following error when creating the client certificats:
failed to update database
TXT_DB error number 2
You might want to change the attribute unique_subject to no in the file index.txt.attr.
In order to force the make release task to ask each time for App Engine credentials change Makefile around line 265 by adding flag --no_cookies to appcfg.py call:
release: server_config
appcfg.py --no_ cookies update gae_bundle/
Find yourself a tool for quick and easy creation of *.dmg packages for apps that are not distributed in package formats supported by Munki/ Simian.
I for one settled on AnyToDMG available in the Mac App Store (not an Affiliate Link).