Ship signed universal macOS probo-agent pkg

Publish a notarized arm64+x86_64 .pkg from CI with the CGO tray
binary, Probo Agent.app, and global LaunchAgent. Keep the
LaunchDaemon enrollment-gated, align its plist path with the
launchd label, and document the Apple signing secrets.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

cmd/probo-agent/installer/macos/scripts/postinstall

@@ -21,8 +21,11 @@ BINARY="/usr/local/bin/probo-agent"
 STATE_DIR="/var/lib/probo-agent"
 RUN_DIR="/var/run/probo-agent"
 CONF_FILE="/tmp/probo-agent.conf"
+DAEMON_PLIST="/Library/LaunchDaemons/com.probo.agent.plist"
 TRAY_LABEL="com.probo.agent.tray"
 TRAY_PLIST_NAME="${TRAY_LABEL}.plist"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+TRAY_PLIST_TMPL="${SCRIPT_DIR}/launchagent.plist.tmpl"
 
 # Mirror everything to the install log. We keep stdout/stderr open
 # too so failures still surface in macOS Installer.app's log pane.
@@ -46,35 +49,33 @@ mkdir -p "${RUN_DIR}"
 chown root:wheel "${RUN_DIR}"
 chmod 0755 "${RUN_DIR}"
 
+# Render the shared Go LaunchAgent template (pkg/deviceagent/tray/
+# launchagent.plist.tmpl) with fixed install paths. Values are
+# installer constants, so XML metacharacters are not expected.
+render_tray_plist() {
+    local tmpl="$1"
+    local out="$2"
+
+    sed \
+        -e "s|{{xml \.Label}}|${TRAY_LABEL}|g" \
+        -e "s|{{xml \.ExePath}}|${BINARY}|g" \
+        -e "s|{{xml \.RunDir}}|${RUN_DIR}|g" \
+        "${tmpl}" > "${out}"
+}
+
 register_tray_launchagent() {
     local current_user user_uid agents_dir plist_path
 
     agents_dir="/Library/LaunchAgents"
     plist_path="${agents_dir}/${TRAY_PLIST_NAME}"
 
+    if [ ! -f "${TRAY_PLIST_TMPL}" ]; then
+        echo "error: tray LaunchAgent template missing at ${TRAY_PLIST_TMPL}"
+        return 1
+    fi
+
     mkdir -p "${agents_dir}"
-    cat > "${plist_path}" <<EOF
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
-  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>${TRAY_LABEL}</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>${BINARY}</string>
-        <string>tray</string>
-        <string>--run-dir</string>
-        <string>${RUN_DIR}</string>
-    </array>
-    <key>RunAtLoad</key>
-    <true/>
-    <key>KeepAlive</key>
-    <true/>
-</dict>
-</plist>
-EOF
+    render_tray_plist "${TRAY_PLIST_TMPL}" "${plist_path}"
 
     chmod 0644 "${plist_path}"
     echo "Installed tray LaunchAgent at ${plist_path}."
@@ -154,6 +155,24 @@ register_enrollment_url_scheme() {
     echo "Registered probo:// URL scheme."
 }
 
+# Restart a previously enrolled LaunchDaemon after upgrades. Preinstall
+# boots it out so the binary can be replaced; without /tmp/probo-agent.conf
+# enrollment is skipped and nothing else would load it again.
+restart_existing_daemon() {
+    if [ ! -f "${DAEMON_PLIST}" ]; then
+        return 0
+    fi
+
+    launchctl bootout system "${DAEMON_PLIST}" 2>/dev/null || true
+    if ! launchctl bootstrap system "${DAEMON_PLIST}"; then
+        echo "warning: could not start LaunchDaemon at ${DAEMON_PLIST}; it may start after reboot."
+        return 1
+    fi
+
+    echo "Started LaunchDaemon at ${DAEMON_PLIST}."
+    return 0
+}
+
 # An admin (or MDM) may stage /tmp/probo-agent.conf to drive an
 # unattended enrollment. Recognized keys (shell-style):
 #
@@ -227,6 +246,7 @@ else
     echo "No ${CONF_FILE} found; enrollment can be completed from the menu bar icon."
 fi
 
+restart_existing_daemon
 register_tray_launchagent
 register_enrollment_url_scheme
 

cmd/probo-agent/installer/macos/scripts/preinstall

@@ -2,8 +2,61 @@
 #
 # probo-agent macOS PKG preinstall script.
 #
-# Enrollment is handled by the menu bar helper after installation.
-# MDM may still pre-stage /tmp/probo-agent.conf for unattended
-# enrollment in postinstall.
+# Runs as root before the payload is laid down. Used to stop previous
+# LaunchAgent / LaunchDaemon instances so upgrades replace cleanly.
+# Failures here are non-fatal: a stuck launchctl must not block install.
 
+set -u
+
+LOG_FILE="/var/log/probo-agent-install.log"
+TRAY_LABEL="com.probo.agent.tray"
+TRAY_PLIST="/Library/LaunchAgents/${TRAY_LABEL}.plist"
+DAEMON_PLIST="/Library/LaunchDaemons/com.probo.agent.plist"
+
+mkdir -p "$(dirname "${LOG_FILE}")"
+exec > >(tee -a "${LOG_FILE}") 2>&1
+
+echo
+echo "=== probo-agent preinstall $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
+
+bootout_tray_for_user() {
+    local username="$1"
+    local user_uid
+
+    if [ -z "${username}" ] || \
+       [ "${username}" = "root" ] || \
+       [ "${username}" = "loginwindow" ]; then
+        return 0
+    fi
+
+    user_uid="$(id -u "${username}" 2>/dev/null || true)"
+    if [ -z "${user_uid}" ]; then
+        return 0
+    fi
+
+    launchctl bootout "gui/${user_uid}/${TRAY_LABEL}" 2>/dev/null || true
+}
+
+seen_users=" "
+for username in $(users 2>/dev/null || true); do
+    case "${seen_users}" in
+        *" ${username} "*) continue ;;
+    esac
+    seen_users="${seen_users}${username} "
+    bootout_tray_for_user "${username}"
+done
+
+console_user=$(stat -f "%Su" /dev/console 2>/dev/null || true)
+bootout_tray_for_user "${console_user}"
+
+if [ -f "${DAEMON_PLIST}" ]; then
+    launchctl bootout system "${DAEMON_PLIST}" 2>/dev/null || true
+    echo "Booted out LaunchDaemon at ${DAEMON_PLIST}."
+fi
+
+if [ -f "${TRAY_PLIST}" ]; then
+    echo "Existing tray LaunchAgent will be replaced by postinstall."
+fi
+
+echo "=== preinstall done ==="
 exit 0