{"id":1315,"date":"2022-12-09T15:45:11","date_gmt":"2022-12-09T20:45:11","guid":{"rendered":"https:\/\/www.brunerd.com\/blog\/?p=1315"},"modified":"2022-12-09T15:45:13","modified_gmt":"2022-12-09T20:45:13","slug":"determining-eligible-macos-versions-via-script","status":"publish","type":"post","link":"https:\/\/www.brunerd.com\/blog\/2022\/12\/09\/determining-eligible-macos-versions-via-script\/","title":{"rendered":"Determining eligible macOS versions via script"},"content":{"rendered":"\n

Every year Mac admins wonder which Macs will make the cut for the new MacOS. While it’s no mystery<\/a> which models those are, if you’ve got Jamf you’ll be wondering how to best scope to those Macs so you can perhaps offer the upgrade in Self Service or alert the user to request a new Mac! One way to scope a Smart Group is with the Model Identifier<\/strong> criteria and the regex operator, like this one<\/a> (I even chipped in!). It doesn’t require an inventory and results are near instant. Before I was any good at regex though, I took another route and made an Extension Attribute macOSCompatibility.sh<\/a>, where the Mac reports back to Jamf. (It also<\/em> has a CSV output mode for nerdy fun<\/a>!) Both methods however require manual upkeep and are now somewhat complicated by Apple’s new use of the very generic Macxx,xx<\/em><\/code> model identifier which doesn’t seem to follow the usual model name and number scheme of major version and minor form factor variants (on purpose<\/em> me-thinks!). Let’s look at some new methods that don’t<\/em> require future upkeep.<\/p>\n\n\n\n

Using softwareupdate –list-full-installers<\/h3>\n\n\n\n

macOS Big Sur (11) introduced a new command softwareupdate<\/code> --list-full-installers<\/code> which shows all eligible installers available for download by the Mac running that command. The funny thing about this is that even though it is a Big Sur or newer feature, if the hardware is old enough, like a 2017, it offer versions all the way back to 10.13 High Sierra! Monterey added build numbers to the output and it can be easily reduced to just versions with awk<\/code>:<\/p>\n\n\n\n

softwareupdate --list-full-installers | awk -F 'Version: |, Size' '\/Title:\/{print $2}'<\/code><\/pre>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
This one-liner can be made into a simple function. I’ve added a uniq<\/code> at the end for case where two differing builds have the same version, like 10.15.7. Here’s that function in a script with a little version check: <\/a>getSupportedMacOSVersions_SWU.sh<\/a><\/p>\n\n\n\n
#!\/bin\/sh\n: <<-LICENSE_BLOCK\ngetSupportedMacOSVersions_SWU - Copyright (c) 2022 Joel Bruner\nLicensed under the MIT License\nLICENSE_BLOCK\n\nfunction getSupportedMacOSVersions_SWU()( \n#getSupportedMacOSVersions_SWU - uses softwareupdate to determine compatible macOS versions for the Mac host that runs this\n\tif [ \"$(sw_vers -productVersion | cut -d. -f1)\" -lt 11 ]; then echo \"Error: macOS 11+ required\" >&2; return 1; fi\n\t#get full installers and strip out all other columns\n\tsoftwareupdate --list-full-installers 2>\/dev\/null | awk -F 'Version: |, Size' '\/Title:\/{print $2}' | uniq\n)\n\ngetSupportedMacOSVersions_SWU \n<\/code><\/pre>\n\n\n
\n
\"\"<\/a>
Output from Apple Silicon will never<\/em> include 10.x versions<\/figcaption><\/figure>\n<\/div>\n\n\n
Software Update (SWU) Based Extension Attribute for Jamf<\/h3>\n\n\n\n
The possible inclusion of 10.x versions in the output complicates things a bit. In ye olden OS X days, the “minor version” (after the first period) acted more like the major<\/em> versions of today! Still it can be done, and we will output any macOS 10.x versions, as if they are major versions like macOS 11, 12, 13, etc. Here’s getSupportedMacOSVersions-SWU-EA.sh<\/a><\/p>\n\n\n\n
#!\/bin\/sh\n: <<-LICENSE_BLOCK\ngetSupportedMacOSVersions-SWU-EA (Extension Attribute) - Copyright (c) 2022 Joel Bruner\nLicensed under the MIT License\nLICENSE_BLOCK\n\nfunction getSupportedMacOSVersions_SWU()( \n#getSupportedMacOSVersions_SWU - uses softwareupdate to determine compatible macOS versions for the Mac host that runs this\n\t#[ \"$(sw_vers -productVersion | cut -d. -f1)\" -lt 11 ] && return 1\n\tif [ \"$(sw_vers -productVersion | cut -d. -f1)\" -lt 11 ]; then echo \"Error: macOS 11+ required\" >&2; return 1; fi\n\t#get full installers and strip out all other columns\n\tsoftwareupdate --list-full-installers 2>\/dev\/null | awk -F 'Version: |, Size' '\/Title:\/{print $2}'\n)\n\n#get our version\nall_versions=$(getSupportedMacOSVersions_SWU)\n\n#depending on the model (2020 and under) we might still get some 10.x versions \nif grep -q ^10 <<< \"${all_versions}\" ; then versions_10=$(awk -F. '\/^10\/{print $1\".\"$2}' <<< \"${all_versions}\")$'\\n'; fi\n#all the other major versions\nversion_others=$(awk -F. '\/^1[^0]\/{print $1}' <<< \"${all_versions}\")\n\n#echo without double quotes to convert newlines to spaces\necho \"<result>\"$(sort -V <<< \"${versions_10}${version_others}\" | uniq)\"<\/result>\"\n<\/code><\/pre>\n\n\n
\n
\"\"<\/a>
The venerable 2017 MacBook Pro has quite a span<\/figcaption><\/figure>\n<\/div>\n\n\n
Now if you wanted to make a Jamf Smart Group for those that could run macOS 13<\/strong><\/code> you wouldn’t<\/em> want to match 10.13 by accident. You could<\/em> comment out the line in the script that matches versions beginning with ^10<\/code> or you could enclose everything in double quotes for the echo<\/code> on the last line, so the newlines remained or<\/em> you could use regex<\/strong> to match ([^.]|^)13<\/code> that is: not<\/em> .13<\/code> or if the hardware is so new ^13<\/code> is at the very beginning of the string. As 10.x capable hardware fades away such regex sorcery shouldn’t be needed.<\/p>\n\n\n\n
Using the Apple Software Lookup Service<\/h3>\n\n\n\n
“What’s the Apple Software Lookup Service<\/a>?!”, you may be asking? I myself asked the same<\/em> question! It’s a highly available JSON file that MDM servers can reference. If softwareupdate<\/code> is acting up or hanging (and it’s been known to do so!), you have all you need in this JSON file to do a little sanity checking of softwareupdate<\/code> too if you’d like. The URL<\/a> is found in the Apple MDM Protocol Reference<\/a> and it contains versions, models and their compatibility. <\/p>\n\n\n\n
This method has far fewer<\/em> patch and point versions than the softwareupdate<\/code> method above and the OSes start<\/strong> with Big Sur (11). No 10.x versions are in the ASLS. There are two “sets” in ASLS, PublicAssetSets<\/code>, which has only the newest<\/em> release of each major version and AssetSets<\/code> which has additional point releases (use the -a<\/code> option for this one). plutil<\/code> has quirky (IMO) rules for what it will and will not output as json<\/code> but the raw<\/code> output type can get around. It was introduced in Monterey and it can also be used to count array members, it’s goofy but manageable. Richard Purves has an article on that here<\/a>. The code is generously commented, so I won’t expound upon it too much more, here’s getSupportedMacOSVersions_ASLS.sh<\/a><\/p>\n\n\n\n
#!\/bin\/sh\n: <<-LICENSE_BLOCK\ngetSupportedMacOSVersions_ASLS - Copyright (c) 2022 Joel Bruner\nLicensed under the MIT License...\nLICENSE_BLOCK\n\nfunction getSupportedMacOSVersions_ASLS()( \n#getSupportMacOSVersions - uses Apple Software Lookup Service to determine compatible macOS versions for the Mac host that runs this\n#  Options:\n#  [-a] - to see \"all\" versions including prior point releases, otherwise only newest of each major version shown\n\n\tif [ \"${1}\" = \"-a\" ]; then\n\t\tsetName=\"AssetSets\"\n\telse\n\t\tsetName=\"PublicAssetSets\"\n\tfi\n\n\t#get Device ID for Apple Silicon or Board ID for Intel\n\tcase \"$(arch)\" in\n\t\t\"arm64\")\n\t\t\t#NOTE: Output on ARM is Device ID (J314cAP) but on Intel output is Model ID (MacBookPro14,3)\n\t\t\tmyID=$(ioreg -arc IOPlatformExpertDevice -d 1 | plutil -extract 0.IORegistryEntryName raw -o - -)\n\t\t;;\n\t\t\"i386\")\n\t\t\t#Intel only, Board ID (Mac-551B86E5744E2388)\n\t\t\tmyID=$(ioreg -arc IOPlatformExpertDevice -d 1 | plutil -extract 0.board-id raw -o - - | base64 -D)\n\t\t;;\n\tesac\t\n\n\t#get JSON data from \"Apple Software Lookup Service\" - https:\/\/developer.apple.com\/business\/documentation\/MDM-Protocol-Reference.pdf\n\tJSONData=$(curl -s https:\/\/gdmf.apple.com\/v2\/pmv)\n\n\t#get macOS array count\n\tarrayCount=$(plutil -extract \"${setName}.macOS\" raw -o - \/dev\/stdin <<< \"${JSONData}\")\n\n\t#look for our device\/board ID in each array member and add to list if found\n\tfor ((i=0; i<arrayCount; i++)); do\n\t\t#if found by grep in JSON (this is sufficient)\n\t\tif grep -q \\\"${myID}\\\" <<< \"$(plutil -extract \"${setName}.macOS.${i}.SupportedDevices\" json -o - \/dev\/stdin <<< \"${JSONData}\")\"; then\n\t\t\t#add macOS version to the list\n\t\t\tsupportedVersions+=\"${newline}$(plutil -extract \"${setName}.macOS.${i}.ProductVersion\" raw -o - \/dev\/stdin <<< \"${JSONData}\")\"\n\t\t\t#only set for the next entry, so no trailing newlines\n\t\t\tnewline=$'\\n'\n\t\tfi\n\tdone\n\n\t#echo out the results sorted in descending order (newest on top)\n\tsort -rV <<< \"${supportedVersions}\"\n)\n\n#pass possible \"-a\" argument\ngetSupportedMacOSVersions_ASLS \"$@\"<\/code><\/pre>\n\n\n
\n
\"\"<\/a>
PublicAssetSets (top) vs. AssetSets (bottom)<\/figcaption><\/figure>\n<\/div>\n\n\n
The fact that this method requires<\/em> Monterey for the plutil<\/code> stuff didn’t agree with me, so I made a version that uses my JSON power tool (jpt) so it will work on all earlier OSes too. It’s a tad large (88k) but still runs quite fast:  getSupportedMacOSVersions_ASLS-legacy.sh<\/a><\/p>\n\n\n\n
Just as with the softwareupdate<\/code> based function, the same can be done to reduce the output to only major versions and since it is v11 and up, a simple cut<\/code> will do!<\/p>\n\n\n\n
#major versions only, descending, line delimited\ngetSupportedMacOSVersions_ASLS | cut -d. -f1 | uniq\n\n#major versions only ascending\necho $(getSupportedMacOSVersions_ASLS | cut -d. -f1 | sort -n | uniq)<\/code><\/pre>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
ASLS Based Extension Attribute<\/h3>\n\n\n\n
The Apple Software Lookup Service (ASLS) JSON file itself doesn’t care what version of macOS a client is on, but the methods in plutil<\/code> to work with JSON aren’t available until Monterey. So here’s the ASLS based Extension Attribute a couple ways: getSupportedMacOSVersions-ASLS-EA.sh<\/a> and getSupportedMacOSVersions-ASLS-legacy-EA.sh<\/a> both get the job done.<\/p>\n\n\n
\n
\"\"<\/a>
Same. Same.<\/figcaption><\/figure>\n<\/div>\n\n\n
Bonus Methods for Determining Board ID and Device ID<\/h3>\n\n\n\n
The ASLS method requires either the Board ID or the Device ID and in a way that worked across all macOS versions and hardware architectures. I’ve updated my gist<\/a> for that (although gists are a worse junk drawer than a bunch of scripts in a repo if only because it’s hard to get an overall listing) and here’s a few callouts for what I came up with<\/p>\n\n\n\n
#DeviceID - ARM, UNIVERSAL - uses xmllint --xpath\nmyDeviceID=$(ioreg -arc IOPlatformExpertDevice -d 1 | plutil -extract 0.IORegistryEntryName xml1 -o - - | xmllint --xpath '\/plist\/string\/text()' - 2>\/dev\/null)\n#DeviceID - ARM, macOS 12+ only, uses plutil raw output\nmyDeviceID=$(ioreg -arc IOPlatformExpertDevice -d 1 | plutil -extract 0.IORegistryEntryName raw -o - -)\n#NOTE: Different output depending on platform! \n# ARM gets the Device ID - J314cAP\n# Intel gets the Model ID - MacBookPro14,3\n\n#Board ID - Intel ONLY, Mac-551B86E5744E2388\n#Intel, UNIVERSAL - uses xmllint --xpath\nmyBoardID=$(ioreg -arc IOPlatformExpertDevice -d 1 | plutil -extract 0.board-id xml1 -o - - | xmllint --xpath '\/plist\/data\/text()' - | base64 -D)\n#Intel, macOS 12+ only - uses plutil raw output \nmyBoardID=$(ioreg -arc IOPlatformExpertDevice -d 1 | plutil -extract 0.board-id raw -o - - | base64 -D)\n<\/code><\/pre>\n\n\n\n
Wrapping Up<\/h2>\n\n\n\n
This was all really an excuse to play around with the Apple Software Lookup Service JSON file, what can I say! And not just to plug jpt<\/a><\/code> either! It was fun to use the new plutil<\/code> raw type too (is fun the right word?) and “live off the land”. Be aware that the newest macOS version only appears once it’s publicly released<\/em>, so keep that in mind when scoping. You can still keep scoping in Jamf via Model Identifier Regex<\/a> or by my older extension attribute<\/a> just keep in mind you’ll need to update them yearly. Whereas, these newer EAs based on either softwareupate (getSupportedMacOSVersions-SWU-EA.sh<\/a>) or ASLS (getSupportedMacOSVersions-ASLS-EA.sh<\/a>, getSupportedMacOSVersions-ASLS-legacy-EA.sh)<\/a> should take care of themselves into the future. <\/p>\n","protected":false},"excerpt":{"rendered":"
Every year Mac admins wonder which Macs will make the cut for the new MacOS. While it’s no mystery which models those are, if you’ve got Jamf you’ll be wondering how to best scope to those Macs so you can perhaps offer the upgrade in Self Service or alert the user to request a new […]<\/p>\n","protected":false},"author":2,"featured_media":1332,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,19,46,37,51,4,12],"tags":[20,47,30,34,25,24],"class_list":["post-1315","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apple","category-bash","category-jamf","category-jpt","category-json","category-os-x","category-scripting","tag-bash","tag-jamf","tag-jpt","tag-json","tag-macos","tag-shell"],"_links":{"self":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/comments?post=1315"}],"version-history":[{"count":18,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1315\/revisions"}],"predecessor-version":[{"id":1343,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1315\/revisions\/1343"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/media\/1332"}],"wp:attachment":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/media?parent=1315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/categories?post=1315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/tags?post=1315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}