22e50b3f11
Introduce the standalone device agent binary and shared library for enrollment, posture checks, self-update, and OS service integration. Include build targets, module deps, and release workflow so the agent can ship independently of server changes. Signed-off-by: Bryan Frimin <bryan@probo.com>
93 lines
3.0 KiB
Bash
Executable File
93 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# probo-agent macOS PKG postinstall script.
|
|
#
|
|
# Runs as root inside the macOS Installer.app sandbox after the
|
|
# payload has been laid down. Standard pkgbuild positional args:
|
|
#
|
|
# $1 = full path to the component package
|
|
# $2 = full path to the install location (selected target)
|
|
# $3 = mountpoint of the destination volume
|
|
# $4 = root directory ("/" for the target volume)
|
|
#
|
|
# We intentionally do not abort the install if enrollment fails:
|
|
# the binary is laid down regardless, and the operator can finish
|
|
# enrollment with `sudo probo-agent install ...` from Terminal.
|
|
|
|
set -u
|
|
|
|
LOG_FILE="/var/log/probo-agent-install.log"
|
|
BINARY="/usr/local/bin/probo-agent"
|
|
STATE_DIR="/var/lib/probo-agent"
|
|
CONF_FILE="/tmp/probo-agent.conf"
|
|
|
|
# Mirror everything to the install log. We keep stdout/stderr open
|
|
# too so failures still surface in macOS Installer.app's log pane.
|
|
mkdir -p "$(dirname "${LOG_FILE}")"
|
|
exec > >(tee -a "${LOG_FILE}") 2>&1
|
|
|
|
echo
|
|
echo "=== probo-agent postinstall $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
|
|
echo "pkg=$1 target=$2 mount=$3 root=$4"
|
|
|
|
if [ ! -x "${BINARY}" ]; then
|
|
echo "error: expected binary not found at ${BINARY}"
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "${STATE_DIR}"
|
|
chown root:wheel "${STATE_DIR}"
|
|
chmod 0700 "${STATE_DIR}"
|
|
|
|
# An admin (or MDM) may stage /tmp/probo-agent.conf to drive an
|
|
# unattended enrollment. Recognized keys (shell-style):
|
|
#
|
|
# PROBO_SERVER_URL=https://app.getprobo.com
|
|
# PROBO_ENROLLMENT_TOKEN=<token>
|
|
# PROBO_NO_AUTO_UPDATE=true
|
|
#
|
|
# We source the file in a subshell so a malformed line can never
|
|
# leak variables into our env, then validate the values we care
|
|
# about.
|
|
if [ -f "${CONF_FILE}" ]; then
|
|
echo "Found ${CONF_FILE}, attempting unattended enrollment."
|
|
|
|
eval "$(
|
|
set -e
|
|
# shellcheck source=/dev/null
|
|
. "${CONF_FILE}"
|
|
printf 'CONF_SERVER=%q\n' "${PROBO_SERVER_URL:-}"
|
|
printf 'CONF_TOKEN=%q\n' "${PROBO_ENROLLMENT_TOKEN:-}"
|
|
printf 'CONF_NOUPDATE=%q\n' "${PROBO_NO_AUTO_UPDATE:-}"
|
|
)"
|
|
|
|
if [ -z "${CONF_SERVER}" ] || [ -z "${CONF_TOKEN}" ]; then
|
|
echo "warning: ${CONF_FILE} is missing PROBO_SERVER_URL or PROBO_ENROLLMENT_TOKEN; skipping enrollment."
|
|
else
|
|
EXTRA_FLAGS=()
|
|
case "${CONF_NOUPDATE}" in
|
|
1|true|TRUE|yes|YES) EXTRA_FLAGS+=("--no-auto-update") ;;
|
|
esac
|
|
|
|
if "${BINARY}" install \
|
|
--server "${CONF_SERVER}" \
|
|
--enrollment-token "${CONF_TOKEN}" \
|
|
"${EXTRA_FLAGS[@]}"; then
|
|
echo "Device enrolled and service installed."
|
|
else
|
|
echo "warning: probo-agent install failed; the binary is in place and can be re-run by an admin."
|
|
fi
|
|
fi
|
|
|
|
# The token in the conf file is sensitive; clear it whatever
|
|
# the outcome so a successful install does not leave secrets
|
|
# in /tmp.
|
|
rm -f "${CONF_FILE}"
|
|
else
|
|
echo "No ${CONF_FILE} found; skipping automatic enrollment."
|
|
echo "Finish setup with: sudo ${BINARY} install --server <URL> --enrollment-token <TOKEN>"
|
|
fi
|
|
|
|
echo "=== postinstall done ==="
|
|
exit 0
|