How to combine Endpoint Security Mac installer and .fsd into one pkg file
Article ID: 228385
Updated On:
Products
Issue/Introduction
When downloading SEP 16.0 or 14.3 RU9 Mac agent from the Enterprise Console (EC) or Integrated Cyber Defense Manager (ICDm), the resulting .zip file contains multiple files.
You need a single .pkg file that contains all necessary files for Remote Deployment using an MDM.
Environment
- SES 16.0 (ESA)
- SES 14.3 RU9 Mac agent
Resolution
A script is available to combine the installation files created by the cloud console in to a single .pkg file. Please follow the section below according to which version of the SES agent you are deploying. The scripts are different between the two versions.
Table of Contents
Version 16.0 (SES, ESA)
Use the attached script ESARIRemoteTool.command. This script is only applicable to 16.0. Use this script to to combine Endpoint_Security_Agent.pkg and the .fsd folder into one wrapper package, ESAFSDRIRemoteWrapper.<version>.pkg, and use that file for remote deployment, for example with your MDM.
Before you begin
Download the package
Download Endpoint_Security_Agent_Mac.zip from the Endpoint Security Agent portal and unzip it. The unzipped folder Endpoint_Security_Agent contains Endpoint_Security_Agent.pkg and the .fsd folder.
Download script and set permission
Download the attached script and set execute permission:
chmod u+x ESARIRemoteTool.command
Run the script
Run the script on a Mac with System Integrity Protection (SIP) enabled.
Create the wrapper package
Run the script as root and give it the path of the folder that contains Endpoint_Security_Agent.pkg and the .fsd folder:
sudo ./ESARIRemoteTool.command ./Endpoint_Security_Agent
The script creates ESAFSDRIRemoteWrapper.<version>.pkg in the current directory.
Sign the wrapper package (Recommended)
Important: Signing the wrapper package is strongly recommended. A signature helps verify that the package has not been modified. If you do not provide a signing identity, the script produces an unsigned package.
To sign the package, give the script a signing certificate as the second argument:
sudo ./ESARIRemoteTool.command ./Endpoint_Security_Agent "Developer ID Installer: Your Company (TEAMID)"
If the certificate is in a dedicated keychain that is not in your keychain search list, unlock it and give its path as the third argument:
# Unlock the keychain first
sudo security unlock-keychain /path/to/Signing.keychain
sudo ./ESARIRemoteTool.command ./Endpoint_Security_Agent "Developer ID Installer: Your Company (TEAMID)" /path/to/Signing.keychain
| Parameter | Required? | Description |
| <Agent_Folder> | Yes | Path to the folder containing Endpoint_Security_Agent.pkg and the .fsd folder. |
| <Signing_Identity> | No | Name or SHA-1 of the installer signing certificate in your keychain. If omitted, an unsigned package is built and a warning is printed. When provided, the script signs the package and verifies it with pkgutil --check-signature; the script fails if the package is not signed by a certificate that macOS trusts. |
| <Keychain_Path> | No | Path to the keychain that contains the certificate (name.keychain and name.keychain-db are both accepted). Not required if the certificate is in your login keychain or any keychain in your keychain search list. Required for a keychain that is not in the search list, for example a dedicated build keychain. The keychain that holds the certificate must be unlocked. |
Certificate requirements
- Recommended: Use your organization's own Developer ID Installer certificate, issued through your Apple Developer account. It is trusted by default on macOS, so no additional root certificates are needed.
- Other issuers (for example an internal or MDM-issued CA): Your administrator is responsible for making sure that the machine that runs the script trusts the issuing CA system-wide (trust configured only for a single user is not sufficient), and that all managed endpoints trust the CA as well. Whether your MDM and endpoints accept a package signed this way depends on your environment.
Verify the package
You can verify the signature of the generated package at any time:
pkgutil --check-signature ./ESAFSDRIRemoteWrapper.<version>.pkg
Verify the signature before uploading the package and before installing it. If your MDM can verify package signatures, configure it to do so. Generate and upload the package on a trusted administrative machine, and do not modify the package afterwards.
Version 14.3 RU9
Attached to this KB is script SEPRIRemoteTool.command. This script is only applicable to 14.3 RU9.
Note: The SES Mac "Online installation package" is not suitable for repackaging as a remotely-deployable pkg file. Download instead the SES Mac "Full installation package creator" from ICDm. Run that on a Mac and it will download the UniversalESD_RI.pkg and fsdmanifest.js files.
Use the following script to convert "Symantec Endpoint Protection.UniversalESD_RI.pkg" and "fsdmanifest.js" into one pkg file and use that file (SEPRIRemote.pkg) for remote deployment using Jamf, et al. Note: the --identifier and --version options to the pkgbuild command in the script can be arbitrary but it is best practice to choose consistent and meaningful values so that the macOS installer command can determine if a pkg is already installed or is an upgrade.
After downloading the attached script set the u+x permissions to the script file.
While running the script from the terminal provide the path of Symantec Endpoint Protection.UniversalESD_RI.pkg" and "fsdmanifest.js files folder next to the script name
#!/bin/sh
################################################################
# help to generate wrapper PKG for Cloud RI PKG and manifest.js
#
# put RI PKG and fsd js file under same folder
# ls ./ri
# Symantec Endpoint Protection.UniversalESD_RI.pkg fsdmanifest.js
#
# execute following command to generate wrapper PKG
# ./SEPRIRemoteTool.command ./ri
################################################################
RI_FOLDER="$1"
RI_NAME="Symantec Endpoint Protection.UniversalESD_RI.pkg"
JS_NAME="fsdmanifest.js"
RI="${RI_FOLDER}/${RI_NAME}"
JS="${RI_FOLDER}/${JS_NAME}"
echo "check files ..."
if [ ! -d "${RI_FOLDER}" ] ; then
echo "folder ${RI_FOLDER} doesn't exist"
exit -1
fi
if [ ! -f "${RI}" ] ; then
echo "${RI} PKG doesn't exist"
exit -1
fi
if [ ! -f "${JS}" ]; then
echo "${JS} doesn't exist"
exit -1
fi
echo "prepare payload ..."
ROOT="/tmp/RIWrapperRoot"
INSTALL_TMP="${ROOT}/private/tmp/"
if [ -d "${ROOT}" ]; then
rm -rf "${ROOT}"
fi
mkdir -p "${INSTALL_TMP}"
cp "${RI}" "${INSTALL_TMP}"
cp "${JS}" "${INSTALL_TMP}"
ls "${INSTALL_TMP}"
echo "prepare scripts ..."
SCRIPTS="/tmp/Scripts"
POSTINSTALL="${SCRIPTS}/postinstall"
if [ -d "${SCRIPTS}" ]; then
rm -rf "${SCRIPTS}"
fi
mkdir -p "${SCRIPTS}"
echo "#!/bin/sh
## postinstall
sudo installer -pkg /private/tmp/Symantec\\ Endpoint\\ Protection.UniversalESD_RI.pkg -target /
rm -rf /private/tmp/Symantec\\ Endpoint\\ Protection.UniversalESD_RI.pkg
rm -rf /private/tmp/fsdmanifest.js
sleep 5
open -a \"Symantec Endpoint Protection\"
exit 0
" > "${POSTINSTALL}"
chmod 755 "${POSTINSTALL}"
ls -l "${POSTINSTALL}"
cat "${POSTINSTALL}"
echo "generate pkg ..."
pkgbuild --identifier "SEP.AV.Cloud.14.3.PKG" --root "${ROOT}" --scripts "${SCRIPTS}" --version "14.3RU2" --install-location "/" SEPRIRemote.pkg
echo "SEPRIRemote.pkg generated in current folder"
Attached also as "SEPRIRemoteTool.command" to the bottom of this article
Attachments
Feedback
