Using Managed i.e. mobileconfiig setting to control InstallMacOSMajorVersionTarget issue

[jelockwood]

Super supports using a local preference file in /Library/Preferences/ or using a managed i.e. MobileConfig preference file supplied via an MDM system like Jamf and in this case the setting is in /Library/Managed Preferences/

The Super script copies these settings in to its own preference file in /Library/Management/super/

In this particular case I have observed the following which I feel represents a bug or at least an issue people need to be aware of.

If you set a value for InstallMacOSMajorVersionTarget via a mobileconfig it is pushed to the client Mac and read by the Super script, it is then copied to its own preference file and obeyed.

If however you later delete this setting from the mobileconfig your MDM i.e. Jamf Pro will push a new copy of the mobileconfig to the client which no longer has this setting but the super script does not delete its copy of the setting and leaves it set to the old value.

In theory deleting the setting should mean to super that no longer is there a limit i.e. target version and whatever the latest version is that is available should be used. As per this report super does not do this and instead uses the previously defined value.

If however you push a new mobileconfig with a new value then the super script does read this and copy this again to its own preference file and does use it. So as in my case where we initially set this to limit super to version 14 aka Sonoma to delay using Sequoia - this worked, but when I deleted this value from the mobileconfig to in theory 'allow' whatever the latest version was i.e. Sequoia aka version 15 it did not. I had to explicitly set a new value of version 15 to allow Sequoia. In theory setting an absurd value like 99 might also have worked.

[jelockwood]

What may help the author @Macjutsu although it will require a reasonable amount of reworking is the following code snippet. This unlike the common basic defaults read command automatically reads preferences from either a local preference file or a managed i.e. mobileconfig derived preference file and will also automatically amalgamate settings from both.

Note: The operating system gives precedence to a managed preference file if an individual setting is in both.

readonly DOMAIN="com.macjutsu.super"
# Use CFPreferences no defaults command as it supports both local, managed and config profiles automatically
pref_value() {
	osascript -l JavaScript -e "ObjC.import('Foundation'); ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('$1').objectForKey('$2'))"
}

install-macos-major-version-target=$(pref_value ${DOMAIN} "InstallMacOSMajorVersionTarget")

Note: The above is with the idea that super would not need to use its own copy of the preference file. If Super is to continue to use its own copy then its logic needs changing so that if a setting e.g. InstallMacOSMajorVersionTarget is no longer defined then super needs to similarly undefine it in its own preference file.

[chriskeavey-kkl]

Whenever you make changes to a Configuration Profile for Super the guidance is to reset super to clear the cached preference file so that it is re-written with the new settings:

Guidance is at the foot of this Wiki Page:

https://github.com/Macjutsu/super/wiki/Jamf-Pro-Deployment

• If you make changes to super settings via configuration profile, consider also using the --reset-super option in Policy Script Parameters to clear any locally cached super options that may cause conflicts._