Macintosh agents were suddenly unable to download package files. It was not clear what change had been made.
The agent logs contained a continual pattern similar to the following for every package that needed to be download
WARN 2019-07-05 11:45:29.619 210 123145347371008 PackageDelivery > Empty codebases from NS for package {17872B48-9792-4C23-9783-D9BFDE505FC3}.
DEBG 2019-07-05 11:45:29.620 210 123145347371008 SecureStore > Failed to load item nsagent/packages/17872B48-9792-4C23-9783-D9BFDE505FC3/package.xml: 2165571600, Cannot open file for reading
WARN 2019-07-05 11:45:29.621 210 123145347371008 PackageDelivery > There are no cached codebases, download is not possible.
WARN 2019-07-05 11:45:29.621 210 123145347371008 PackageDelivery > Failed to get package {17872B48-9792-4C23-9783-D9BFDE505FC3} codebases. Error = 2147554186
NOTE 2019-07-05 11:45:29.622 210 123145347371008 PackageDelivery > CDownloadThread::WorkerFunction: Start download failed for PKG[{17872B48-9792-4C23-9783-D9BFDE505FC3} - /opt/altiris/notification/nsagent/var/packages/{17872B48-9792-4C23-9783-D9BFDE505FC3} - {E767AC81-08D6-43F1-A295-CA56BDFE7E2E}(1)], retry later
NOTE 2019-07-05 11:45:29.622 210 123145347371008 PackageDelivery > DownloadQueue::ProcessDownloadResult: Result - -2147413110, Package - {17872B48-9792-4C23-9783-D9BFDE505FC3}
NOTE 2019-07-05 11:45:29.623 210 123145347371008 PackageDelivery > CDownloadListItem::RetryLater: Set package PKG[{17872B48-9792-4C23-9783-D9BFDE505FC3} - /opt/altiris/notification/nsagent/var/packages/{17872B48-9792-4C23-9783-D9BFDE505FC3} - {E767AC81-08D6-43F1-A295-CA56BDFE7E2E}(1)] to download one more time 96 minutes later, next retry number 6 starts 13:21:29.
The NS was giving out codebases. A look at a profiler trace showed that the response was giving out 1-2 possible package sources to contact. But the Macintosh client was not receiving the response.
The client was getting a response from the NS but it was not in an encrypted format; therefore it was not trusted and the response was discarded.
ITMS 8.x
The following registry setting (per KB 179874 "Viewing codebases returned to the Altiris Agent through getpackageinfo.aspx request" ), which is used to troubleshoot GetPackageInfo requests, was set to 0 on the SMP Server:
HKLM\Software\Altiris\eXpress\Notification Server\SW Delivery\ EncryptPackageInfo
This was causing the responses to be non encrypted which certain client OS security settings require.
Set the value of EncryptPackageInfo to 1 or delete it from the registry. The SMP Server will default to encrypting GetPackageInfo responses.