Hello, everyone.
Hopefully, you're enjoying your virtual 2020 JNUC so far.
My name is Chaz, and today we'll be going over
a demonstration and a keynote
for creating and deploying packages with Jamf Now.
Again, my name is Chaz.
I'm a technical support engineer here at Jamf,
and mainly what I do is,
I own and handle escalated Jamf Now cases and support.
Today's agenda, we'll be going over–
we'll be going over what a package is,
package deployments, requirements and resources.
We'll also create and sign a package
with Composer in a demonstration form.
We'll also upload and deploy that package that we create
using Composer, and then we'll observe package installation.
So let's dive into it.
What is a package?
Chances are, as a Mac user,
you've probably interacted with or used packages
at some point in time in your Mac usage career.
Package is a common Mac OS file type that can be used
to install files and scripts on Macs.
And as a Jamf Now admin,
you can utilize packages
to deploy things like applications,
scripts, printer drivers, and many more.
Really, there's a bunch of different ways
you can utilize packages to deploy content to your Mac,
and it's up to you to kind of choose
how you want to utilize packages to deploy that.
So package and using Jamf Now to deploy these packages,
it's important to go over the requirements
and resources to deploy packages
and create them as well.
You'll need a Jamf Now Plus subscription.
Jamf Now Plus is the escalated tier
of your Jamf Now account that you can upgrade to.
That gives you access to different features
and capabilities that the Jamf Now @@Standard Plan does not have.
The main feature that we'll be going over today
is the ability to create and deploy packages.
And then along with your Plus account,
you'll actually get access to Jamf Composer as well,
which is–which comes free with your Jamf Now account.
Composer is a tool that is used to create the package.
And your last requirement
is an Apple developer account membership,
and what that gives you access to is
a signing certificate that allows you
to sign packages for deployment.
Now, let's dig into the demonstration today.
That's going to be the majority of this presentation.
It's a demonstration of building and signing packages.
I should be sharing my screen now.
First place I want to navigate to is login.jamfnow.com.
This will be the login page for your Jamf Now Account;
you'll answer in your credentials.
We'll hit "log in," and once logged in,
we'll want to navigate to our account tab
to make sure that we're on the Plus subscription.
As you can see, I'm on Standard.
We'll go ahead and upgrade to Plus.
You'll get to see all the benefits of Plus when you go through
this upgrade process, and we'll hit "Change Plan."
And now we are on Jamf Now Plus,
and we can see our plan includes Jamf Composer for Mac
at no cost to you.
To download Composer,
all you have to do is hit "Learn More".
You get hit with this landing page where you get
this description of Composer.
You'll also get access to this Composer user guide,
which I recommend saving somewhere on your computer
as it's a very valuable resource for...
a product–pretty much it's a product breakdown
of Composer and how to use it.
So just having that handy will be beneficial.
And then we'll just also go ahead too
and download Composer on this page as well.
So...
this will take a couple seconds to download,
and once complete,
we'll go through the installation process.
And let's begin installation.
Here's Composer.
We always recommend to drag and drop Composer
to your applications folder just to make it more accessible
for you as an admin.
Drag it into your Applications folder,
and now we have Composer living in Applications.
So we'll go ahead and open up Composer;
we'll allow for it to open.
We'll enter in our admin password.
And first screen that you get met with
when opening up Composer is Composer telling you,
"Hey, I need full disk access
to do what I need to do to create your packages."
So we'll go ahead–
we'll go in the System Preferences.
We'll unlock System Preferences,
which will allow us to add Composer
and grant Composer full disk access.
So at any time you make a change under the security pane
of System Preferences,
you'll need to restart the application,
which I just said "Quit Now,"
and now Composer will have full disk access.
So when I go to build a package,
it can access any files and folders
on my Mac to build said package.
So go ahead and delete this lingering file on here
to kind of give you the full breakdown.
But once we get access to Composer, we see Composer.
And in this demonstration,
what I'll be doing is,
creating a Firefox package
for deployment to this test machine in front of me.
You may want to deploy Firefox to your Macs
if your users need Firefox,
and it's important to package it
because it's actually not available in Apple's–
Apple Business Manager portal
as a licensed app that you can deploy.
So the only way you could really
install Firefox is either through packaging it
and deploying it to your Macs
or having users go and manually install it,
which may not be desired.
So that's a way to deploy it to your Macs, is through packaging.
So I have Firefox
existing in my Applications folder right here.
What I'm going to do is drag and drop–
oops, drag and drop Firefox into Composer.
This converts Firefox into a source.
And so you can see kind of all the components
of Firefox within Composer
that are gonna be built into this package.
Important things to note is if Firefox requires
some sort of special files to be included along with it
that are unique to your organization or your needs in this deployment,
you can always edit the files of Firefox yourself.
Such–you know, a common one that's edited is "info.plist."
If you know what you're doing and you're able to reference
Firefox documentation
that may know of different ways that
you can customize the application,
you could edit it here.
And then when you drag it into Composer,
those edits will be saved
within the Firefox.app file itself.
So just kind of a pro tip to have in your back pocket.
Yeah, we converted.
We dragged and dropped Firefox into Composer.
It's now converted as a source.
We're almost ready to package it.
The final step that we'll want to do is jump into the menu,
and we'll want to check Preferences
to see how this package is being signed.
Again, one of those requirements for deploying packages
is an Apple developer certificate,
and that certificate signs your package.
So when you deploy it to your Mac,
it'll actually install,
because it's a requirement.
If you don't–if you're missing a signing certificate,
A, Jamf Now will just throw you in there
saying you can't upload this, and B,
if we were to allow you to upload it and deploy it,
it would just error out because it's
an MDM requirement as a signing certificate.
So on to this location.
You'll want to make sure "sign with" is clicked,
and you'll want to make sure you see
your developer certificate here.
And this list right here is just pulled
from the login items of your keychain.
So prior to any of this building,
you'll want to reference the resource
included in our handout that is–
that accompanies this presentation.
And in that handout,
there's a workflow that just details how you'd go about creating
and saving a signing certificate to your Mac.
I'm not gonna be demonstrating that in this presentation,
but if you have any issues with that,
don't hesitate to reach out to support,
and we'll help you out in creating that
and saving that signing certificate.
But as long as it's in the login items,
Keychain Composer will recognize it.
You'll see it in this dropdown list
and you'll be able to select it to sign it,
and it'll read as "developer ID installer" and then your name.
So I'm not gonna click "sign with" because I don't
have access to a developer certificate for this demonstration
just due to us not having access to that and support;
it's owned by our IT department.
So I actually signed
a different package that we'll be using
to test deployment with after we create
this instance of this Firefox package.
So...
we have the application that we want to deploy.
We confirm that it's checked with "sign with"
and our developer ID installer.
That means we're ready to create this
and turn this into a package.
So we'll go ahead– we'll hit "Build this package."
We'll choose where we want to save it.
We're going to be saving it to our desktop,
and this will begin the process of building
a Firefox package.
And we'll let this do its thing.
Don't hesitate to be asking any questions
that you may be getting as you're watching this presentation.
We'll be addressing them at the end of this presentation as well.
So, let's take a look at Finder,
and now we can see our Firefox package
that we just created today at 9:49,
which is right now,
and it's saved to the desktop
as we selected it to be.
Awesome.
One plug that I want to give
for a third party application that we use here daily
in support is Suspicious Package.
What this does is allow you to inspect
both packages that you create yourself,
as well as packages that you get from the Internet,
and inspect them and see kinda how they're built,
and whether they have an accompanying signing certificate.
Essentially, they just allow you to do
an overhead view of a package to make sure
all the necessary items are being met to allow for deployment.
So we can see that it is signed by
developer IT installer, Jamf software.
This is the one that I created ahead of time.
This isn't the one that I just created in Composer.
We can see in all files–
has the same structure
as the one that we saw in Composer,
Doesn't have any scripts in it.
Pretty barebones package with just the Firefox installer,
and we can see it has 152 items,
which are all these items under here.
So, yeah.
Mainly, Suspicious Package is valuable
for packages that you get off the Internet
because then you could confirm that yourself
since you didn't create it yourself.
So... and it's also–
Suspicious Package is a free application too.
Forgot to mention that.
We'll have it in the download link in the handout as well,
so if you want a– just a tool that we use in support
available to you for whatever testing you need to do,
you'll have the download link for that.
And we recommend that, you know, at a minimum,
you download and just have access to it.
So closed Suspicious Package; we're good on that.
We have our package created.
We technically can close Composer.
I'll just have it open in the background,
And the final step is uploading the package
that we just created into Jamf Now,
or–yeah, that we just created into Jamf Now.
And to do so, we'll click on the "Apps" tab right here,
we'll click on "Add an App,"
we'll click on "Upload Your App,"
and we'll go ahead and upload.
You can either drag and drop or browse for it on your computer,
and we'll click "Upload into Jamf Now".
The upload process, it's gonna take about two minutes
based on my previous test, and during this time,
I thought it'd kinda be important to drive home
the differences in ways that packages
can be obtained for deployment.
One is, you build and sign the package yourself.
We just went over that in Composer and what that looks like.
The other way that is pretty common too,
is just getting a package from the Internet,
whether that's from– directly from a developer's website
or through, you know, whatever means that
you grabbed the package from.
It's common to have packages that you can try to upload directly
into Jamf Now to deploy to your Macs.
The thing is, you'll want to make sure that the package
is built correctly to allow for Jamf Now deployment.
The two main things that you're gonna want to confirm are,
is the package that you installed from the Internet signed?
And you can use Suspicious Package to confirm that.
The other thing you'll want to confirm is,
is the package created for distribution?
And it's unfortunate,
but really the only way that you can confirm
that it's intended for distribution
is to test deployment yourself.
So all you need to do is upload it into your Jamf Now account
and then test-deploying it to a singular test machine,
and see what results you get.
The main error that you'll want to look for is,
the file distribution is not found.
And I'll be going over it
in a second where you'd see that error...
If you were in a test deployment and you were to–
you know, the package wasn't created for deployment.
So I'll be showing that in a second.
And then also, one final point I can mention is,
if you are suspecting that you're running into a package
that isn't intended for distribution,
always feel free to reach out to support.
We can test deployment ourselves as well
and let you know what we find when we deploy the package as well.
So I'll call this package @@"Firefox v 71.0."
That is the actual build of Firefox
that we uploaded into Jamf Now.
And this is a good way, as you as an admin
can differentiate what versions of Firefox that you have uploaded,
because if you, say for instance,
want to deploy version 72.0 when that comes out,
and you don't–you aren't confident in your end users
updating that pack– or that application themselves,
you can just upload v 72.0 into Jamf Now
and then scope that new package to the Apps tab at the blueprint.
But we got our package named; we have it "v 71."
We'll click "Done,"
and now we can see
the package is a part of our apps library,
which is awesome.
And now, really the only final thing left to do
is to try deploying it to the Mac that I'm currently signed in on,
or using, I should say.
So I'll open up Console.
Console is just like an application
that comes preinstalled on Mac.
The filter words I filter by
are "MDM" and "install," if I can type,
and what this will do is just filter out
all the random logs
that are being generated by the Mac and show us
the "install application" command
for the package that we're about to send to this computer.
So this allows us to see the processes happening
in the background when the Mac receives this command.
It's gonna be silent.
It's gonna be a silent experience for the end user
unless the installer requires some additional,
you know, key or– or some sort of code
that's associated with the app.
Then it'll prompt when the package tries to install,
but if it's a package that just, you know,
has you click "Next" a bunch, approve it and then install it.
It's gonna happen all silently in the background for the Mac.
So since Firefox will be a silent install,
we'll have Console opened
to view the logs that'll be generated.
So we have Firefox in in our app library.
We have console open on this Mac that we're signed in on.
Last thing to do is add the package
to the "Apps" tab at the blueprint.
As you can see here,
I have this test MacBook Pro
that I'm using right now for this demonstration,
associated with this Composer,
JNUC demonstration blueprint.
Last thing to do is hit "Add an App."
It'll go ahead and add
the Firefox package that I just added.
One thing that I almost screwed up is,
I'll want to remove Firefox, actually, from here first
to make sure that you can see it install.
I'll try my best to see if I can leave this open right after I...
right after I scope it
so you can make sure that
I'm not tricking you that it's being deployed.
So just added it to the "Apps" tab of the blueprint.
This is what the user experience will be.
We should see Firefox pop up here
any second, and when it does,
we'll also look at the Console
and then see the logs that are being written there,
just to kinda show you both sides,
both the user experience
and then what's going on in the background of the Mac.
So it did receive it.
I'm probably gonna miss it being installed if I tab away from it,
but we can see...
see if I can somehow minimize this.
There we go.
So we can see that
the scheduled install application command
was received right here at 56, so about a minute ago,
and I think it just popped up.
Yeah, we can see it right now on applications.
This command is the command
that Jamf Now sent that says, "Hey, computer,
"install this package from this location,"
and you can see the URL where Jamf Now is storing this package.
A lot of these other logs–
all these other logs are kinda, you know,
they're kinda fluff,
but the main one that you care about is
the scheduled install application from–
from, then, the location of the package.
This is also where you'd see
that distribution error that I was mentioning
when uploading the package.
If you're uploading a package that's not intended for distribution,
if you're filtering via this,
you'll see, "The package distribution does not exist,"
which is how the error reads,
and if that's the case,
the person who created that package did not create it
with MDM deployment in mind.
So what you'll just have to do is just drag that
package to Composer and essentially rebuild it
and re-sign it with your developer certificate,
and Composer by default builds
all packages as distribution packages.
So if you create a package in Composer,
it's gonna be created for Jamf Now deployment.
Perfect.
So we see the log; we saw Firefox appear here as installed.
That is what we wanted to see,
and that is, you know,
the end of the demonstration that I had for you today.
So I'll bring it back to the slides
that we have and, yeah,
I just wanted to say thank you for attending
this JNUC session
on deploying and creating packages with Jamf Now.
Again, there'll be a handout that will be
accompanying this presentation,
so reference that
for a lot of valuable information
and links that you can use.
You don't have to search them on the Internet.
You could just check that reference, and...
and view those links there.
Again, also, too, Jamf Now support will be here to help you out
with creating these packages.
So if you're running into any issues,
or you're not seeing the packages install
the way that they should,
the support will be here,
and then also, the Composer user guide, too,
is also a valuable tool to just make sure
that you're following the best practices
noted in that user guide.
So, again, I appreciate everyone's time today
for taking time out of their day
to learn about packages,
deploying packages, creating packages, all that stuff.
I appreciate your time,
and I hope that you have a good remainder of JNUC,
and if I don't hear from you in support,
have a good remainder of the summer into fall.
So have a good–
have a good rest of your day.
Thank you.