Using AutoPkg to build installers for Palo Alto’s GlobalProtect VPN software
As part of some recent testing, I needed to do some work with Palo Alto’s GlobalProtect VPN software. Palo Alto provides an installer package for GlobalProtect, but it has some interesting characteristics as the installer includes three installation options. One is enabled by default and the other two are disabled by default.
The first configuration is the option to install GlobalProtect, the default enabled configuration:
The second configuration is the option to uninstall GlobalProtect, which is disabled by default:
The third configuration is the option to enable the System Extension for GlobalProtect, which is disabled by default:
Note: In the image above, I’ve done some photoshopping because checking the third option to enable the System Extension for GlobalProtect also enables the option to install GlobalProtect. I made the change to the image to hopefully make more clear which option I was discussing.
The options to uninstall GlobalProtect and enable the System Extension for GlobalProtect can be managed by using an installer choices XML file to selectively enable only the desired option. For example, here’s the installer choices XML file for enabling only the option to uninstall GlobalProtect:
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Here’s the installer choices XML file for enabling only the option to enable the System Extension for GlobalProtect:
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Using these options, I was able to build recipes for AutoPkg which would automatically build three installer packages:
- An installer which installs GlobalProtect.
- An installer which uninstalls GlobalProtect.
- An installer which enables the System Extension for GlobalProtect.
The reason I chose to do this is that using AutoPkg to create these additional installer packages should help ensure any changes that Palo Alto makes to GlobalProtect’s uninstall and System Extension enablement will automatically be available whenever a new version of GlobalProtect is picked up by AutoPkg. In turn, this should save work for those deploying GlobalProtect because now they don’t need to figure out what may have changed between GlobalProtect releases. For more details, please see below the jump.
There is an existing AutoPkg .download recipe for GlobalProtect, available via the link below:
https://github.com/autopkg/peshay-recipes/blob/master/PaloAlto/GlobalProtect.download.recipe
Since that part of the recipe setup is already done, I focused on building AutoPkg .pkg recipes. For the example recipe shown below which handles creating the installer which installs GlobalProtect, the recipe won’t make any changes to the downloaded installer package beyond renaming it. This is because by default, the GlobalProtect installer package installs GlobalProtect.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The second and third .pkg recipes will wrap the downloaded installer package inside a second installer package, along with the following files which will also be stored in the second installer package:
- An installer choices XML file
- A postinstall script which will install the downloaded installer using the options configured by the installer choices XML file.
AutoPkg recipe to create an installer package which uninstalls GlobalProtect:
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| xml version="1.0" encoding="UTF-8"?> | |
| DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">; | |
| <plist version="1.0"> | |
| <dict> | |
| <key>Descriptionkey> | |
| <string>Downloads the current release version of the Global Protect VPN client and builds an installer package which uninstalls Global Protect.string> | |
| <key>Identifierkey> | |
| <string>com.company.pkg.GlobalProtect.uninstallstring> | |
| <key>Inputkey> | |
| <dict> | |
| <key>NAMEkey> | |
| <string>GlobalProtectstring> | |
| <key>VENDORkey> | |
| <string>PaloAltostring> | |
| <key>SOFTWARETITLE1key> | |
| <string>GlobalProtectstring> | |
| <key>SOFTWARETITLE2key> | |
| <string>Uninstallerstring> | |
| dict> | |
| <key>MinimumVersionkey> | |
| <string>1.0.0string> | |
| <key>ParentRecipekey> | |
| <string>com.company.download.GlobalProtectstring> | |
| <key>Processkey> | |
| <array> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>destination_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/unpackstring> | |
| <key>flat_pkg_pathkey> | |
| <string>%pathname%string> | |
| dict> | |
| <key>Processorkey> | |
| <string>FlatPkgUnpackerstring> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>patternkey> | |
| <string>%RECIPE_CACHE_DIR%/unpack/*gp.pkgstring> | |
| dict> | |
| <key>Processorkey> | |
| <string>FileFinderstring> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>destination_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/payload/GlobalProtect.appstring> | |
| <key>pkg_payload_pathkey> | |
| <string>%found_filename%/Payloadstring> | |
| dict> | |
| <key>Processorkey> | |
| <string>PkgPayloadUnpackerstring> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>input_plist_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/payload/GlobalProtect.app/Contents/Info.pliststring> | |
| <key>plist_version_keykey> | |
| <string>CFBundleShortVersionStringstring> | |
| dict> | |
| <key>Processorkey> | |
| <string>Versionerstring> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>PkgRootCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>pkgrootkey> | |
| <string>%RECIPE_CACHE_DIR%/pkgrootstring> | |
| <key>pkgdirskey> | |
| <dict> | |
| <key>Scriptskey> | |
| <string>0755string> | |
| dict> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>FileMoverstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>sourcekey> | |
| <string>%RECIPE_CACHE_DIR%/pkgroot/Scriptsstring> | |
| <key>targetkey> | |
| <string>%RECIPE_CACHE_DIR%/Scriptsstring> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>PkgCopierstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>source_pkgkey> | |
| <string>%pathname%string> | |
| <key>pkg_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/Scripts/GlobalProtect.pkgstring> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>FileCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>file_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/Scripts/uninstall_global_protect.xmlstring> | |
| <key>file_modekey> | |
| <string>0755string> | |
| <key>file_contentkey> | |
| <string><?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <plist version="1.0"> | |
| <array> | |
| <dict> | |
| <key>attributeSetting</key> | |
| <integer>1</integer> | |
| <key>choiceAttribute</key> | |
| <string>selected</string> | |
| <key>choiceIdentifier</key> | |
| <string>second</string> | |
| </dict> | |
| <dict> | |
| <key>attributeSetting</key> | |
| <integer>1</integer> | |
| <key>choiceAttribute</key> | |
| <string>selected</string> | |
| <key>choiceIdentifier</key> | |
| <string>com.paloaltonetworks.globalprotect.uninstall.pkg</string> | |
| </dict> | |
| </array> | |
| </plist>string> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>FileCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>file_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/Scripts/postinstallstring> | |
| <key>file_modekey> | |
| <string>0755string> | |
| <key>file_contentkey> | |
| <string>#!/bin/bash | |
| PKG="${0%/*}/GlobalProtect.pkg" | |
| ChoiceChangesXMLFile="${0%/*}/uninstall_global_protect.xml" | |
| ERROR=0 | |
| if [[ -f "$PKG" ]]; then | |
| /usr/sbin/installer -pkg "$PKG" -applyChoiceChangesXML "$ChoiceChangesXMLFile" -target "$3" | |
| if [[ $? -ne 0 ]]; then | |
| /usr/bin/logger -t "${0##*/}" "ERROR! Installation of package $PKG failed" | |
| ERROR=1 | |
| fi | |
| else | |
| /usr/bin/logger -t "${0##*/}" "ERROR! Package $PKG not found" | |
| ERROR=1 | |
| fi | |
| exit $ERRORstring> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>PkgCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>pkg_requestkey> | |
| <dict> | |
| <key>pkgrootkey> | |
| <string>%RECIPE_CACHE_DIR%/pkgrootstring> | |
| <key>pkgnamekey> | |
| <string>%VENDOR%_%SOFTWARETITLE1%_%SOFTWARETITLE2%_%version%string> | |
| <key>pkgtypekey> | |
| <string>flatstring> | |
| <key>idkey> | |
| <string>com.company.GlobalProtectUninstall.pkgstring> | |
| <key>optionskey> | |
| <string>purge_ds_storestring> | |
| <key>scriptskey> | |
| <string>Scriptsstring> | |
| <key>versionkey> | |
| <string>%version%string> | |
| dict> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>path_listkey> | |
| <array> | |
| <string>%RECIPE_CACHE_DIR%/pkgrootstring> | |
| <string>%RECIPE_CACHE_DIR%/payloadstring> | |
| <string>%RECIPE_CACHE_DIR%/Scriptsstring> | |
| <string>%RECIPE_CACHE_DIR%/unpackstring> | |
| array> | |
| dict> | |
| <key>Processorkey> | |
| <string>PathDeleterstring> | |
| dict> | |
| array> | |
| dict> | |
| plist> |
AutoPkg recipe to create an installer package which enables the System Extension for GlobalProtect:
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| xml version="1.0" encoding="UTF-8"?> | |
| DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">; | |
| <plist version="1.0"> | |
| <dict> | |
| <key>Descriptionkey> | |
| <string>Downloads the current release version of the Global Protect VPN client and builds an installer package which enables the Global Protect system extension.string> | |
| <key>Identifierkey> | |
| <string>com.company.pkg.GlobalProtect.systemextensionstring> | |
| <key>Inputkey> | |
| <dict> | |
| <key>NAMEkey> | |
| <string>GlobalProtectstring> | |
| <key>VENDORkey> | |
| <string>PaloAltostring> | |
| <key>SOFTWARETITLE1key> | |
| <string>GlobalProtectstring> | |
| <key>SOFTWARETITLE2key> | |
| <string>Systemstring> | |
| <key>SOFTWARETITLE3key> | |
| <string>Extensionstring> | |
| <key>SOFTWARETITLE4key> | |
| <string>Enablerstring> | |
| dict> | |
| <key>MinimumVersionkey> | |
| <string>1.0.0string> | |
| <key>ParentRecipekey> | |
| <string>com.company.download.GlobalProtectstring> | |
| <key>Processkey> | |
| <array> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>destination_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/unpackstring> | |
| <key>flat_pkg_pathkey> | |
| <string>%pathname%string> | |
| dict> | |
| <key>Processorkey> | |
| <string>FlatPkgUnpackerstring> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>patternkey> | |
| <string>%RECIPE_CACHE_DIR%/unpack/*gp.pkgstring> | |
| dict> | |
| <key>Processorkey> | |
| <string>FileFinderstring> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>destination_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/payload/GlobalProtect.appstring> | |
| <key>pkg_payload_pathkey> | |
| <string>%found_filename%/Payloadstring> | |
| dict> | |
| <key>Processorkey> | |
| <string>PkgPayloadUnpackerstring> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>input_plist_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/payload/GlobalProtect.app/Contents/Info.pliststring> | |
| <key>plist_version_keykey> | |
| <string>CFBundleShortVersionStringstring> | |
| dict> | |
| <key>Processorkey> | |
| <string>Versionerstring> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>PkgRootCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>pkgrootkey> | |
| <string>%RECIPE_CACHE_DIR%/pkgrootstring> | |
| <key>pkgdirskey> | |
| <dict> | |
| <key>Scriptskey> | |
| <string>0755string> | |
| dict> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>FileMoverstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>sourcekey> | |
| <string>%RECIPE_CACHE_DIR%/pkgroot/Scriptsstring> | |
| <key>targetkey> | |
| <string>%RECIPE_CACHE_DIR%/Scriptsstring> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>PkgCopierstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>source_pkgkey> | |
| <string>%pathname%string> | |
| <key>pkg_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/Scripts/GlobalProtect.pkgstring> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>FileCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>file_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/Scripts/install_system_extensions.xmlstring> | |
| <key>file_modekey> | |
| <string>0755string> | |
| <key>file_contentkey> | |
| <string><?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <plist version="1.0"> | |
| <array> | |
| <dict> | |
| <key>attributeSetting</key> | |
| <integer>1</integer> | |
| <key>choiceAttribute</key> | |
| <string>selected</string> | |
| <key>choiceIdentifier</key> | |
| <string>third</string> | |
| </dict> | |
| <dict> | |
| <key>attributeSetting</key> | |
| <integer>1</integer> | |
| <key>choiceAttribute</key> | |
| <string>selected</string> | |
| <key>choiceIdentifier</key> | |
| <string>com.paloaltonetworks.globalprotect.systemext.pkg</string> | |
| </dict> | |
| </array> | |
| </plist>string> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>FileCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>file_pathkey> | |
| <string>%RECIPE_CACHE_DIR%/Scripts/postinstallstring> | |
| <key>file_modekey> | |
| <string>0755string> | |
| <key>file_contentkey> | |
| <string>#!/bin/bash | |
| PKG="${0%/*}/GlobalProtect.pkg" | |
| ChoiceChangesXMLFile="${0%/*}/install_system_extensions.xml" | |
| ERROR=0 | |
| if [[ -f "$PKG" ]]; then | |
| /usr/sbin/installer -pkg "$PKG" -applyChoiceChangesXML "$ChoiceChangesXMLFile" -target "$3" | |
| if [[ $? -ne 0 ]]; then | |
| /usr/bin/logger -t "${0##*/}" "ERROR! Installation of package $PKG failed" | |
| ERROR=1 | |
| fi | |
| else | |
| /usr/bin/logger -t "${0##*/}" "ERROR! Package $PKG not found" | |
| ERROR=1 | |
| fi | |
| exit $ERRORstring> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Processorkey> | |
| <string>PkgCreatorstring> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>pkg_requestkey> | |
| <dict> | |
| <key>pkgrootkey> | |
| <string>%RECIPE_CACHE_DIR%/pkgrootstring> | |
| <key>pkgnamekey> | |
| <string>%VENDOR%_%SOFTWARETITLE1%_%SOFTWARETITLE2%_%SOFTWARETITLE3%_%SOFTWARETITLE4%_%version%string> | |
| <key>pkgtypekey> | |
| <string>flatstring> | |
| <key>idkey> | |
| <string>com.company.GlobalProtectSystemExtensionEnable.pkgstring> | |
| <key>optionskey> | |
| <string>purge_ds_storestring> | |
| <key>scriptskey> | |
| <string>Scriptsstring> | |
| <key>versionkey> | |
| <string>%version%string> | |
| dict> | |
| dict> | |
| dict> | |
| <dict> | |
| <key>Argumentskey> | |
| <dict> | |
| <key>path_listkey> | |
| <array> | |
| <string>%RECIPE_CACHE_DIR%/pkgrootstring> | |
| <string>%RECIPE_CACHE_DIR%/payloadstring> | |
| <string>%RECIPE_CACHE_DIR%/Scriptsstring> | |
| <string>%RECIPE_CACHE_DIR%/unpackstring> | |
| array> | |
| dict> | |
| <key>Processorkey> | |
| <string>PathDeleterstring> | |
| dict> | |
| array> | |
| dict> | |
| plist> |
Gloss