10.13.2 Supplemental Update Extension Attribute (EA)

[Mhomar]

Hi all, your help is really appreciated!

I am wondering if any of you have built an EA that I can use in on my Jamf Pro server (9.101.0)?

Does this update change the OS10.13.2 build number? If so, is that (17C88)? If the supplemental update does not change the build number is there something in the OS that I can grab in an EA the definitively tells me the OS is running with the 10.13.2 Supplemental Update applied?

Thanks again for your help!

[pruokis · Accepted solution]

17C205 is the build reported here on patched 10.13.2 systems - it might be easier to just use the Operating System Build criterion for this (Advanced Criteria) rather than an EA. You could also use package receipt criteria, searching for the receipt for com.apple.pkg.update.os.10.13.2SupplementalPatch.17C205

[ThijsX]

@Mhomar We are pushing out the Supplemental package to systems that are 10.13.2 and are not system version 17C205.

[pruokis]

That method should cover it as well.

[ThijsX]

Beneath you will find the .pkg of the supplemental update, works like a charm.
You can deploy it to users via Self Service with a deadline/defferal or enforce the way you like.

https://support.apple.com/kb/DL1951?viewlocale=en_AU&locale=en_AU

Cheers,
Thijs - bol.com

[Mhomar]

Thanks that helped!

[mjhersh]

@txhaflaire what build numbers are you seeing besides 17C205? Edit: Never mind, I misread your post.

[donmontalvo]

As per Apple KB, the supported way to determine if the update was applied is to use the Safari version info:

macOS High Sierra 10.13.2 Supplemental Update

Installing macOS High Sierra 10.13.2 Supplemental Update will update Safari to version 11.0.2 (13604.4.7.1.6) or version 11.0.2 (13604.4.7.10.6).

You can get the version build number using CFBundleVersion in an EA:

#!/bin/sh
# Get Safari version build number.

if [ -d /Applications/Safari.app ]; then
    echo "<result>$( defaults read /Applications/Safari.app/Contents/Info.plist CFBundleVersion )</result>"
else
    echo "<result>NotInstalled</result>"
fi

...which gives you:

# defaults read /Applications/Safari.app/Contents/Info.plist CFBundleVersion      
13604.4.7.1.3

Since if you use CFBundleShortVersionString...:

#!/bin/sh
# Get Safari version number.

if [ -d /Applications/Safari.app ]; then
    echo "<result>$( defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString )</result>"
else
    echo "<result>NotInstalled</result>"
fi

...will give you the actual version number:

# defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString
11.0.2

For the above example, my computer does not yet have the 10.13.2 Supplemental Update applied:

# softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
   * macOS High Sierra 10.13.2 Supplemental Update-
    macOS High Sierra 10.13.2 Supplemental Update ( ), 138293K [recommended] [restart]

PS, yea the if/else statement is not really needed for Safari since it is a SIP locked app, but we use it in all our EAs. ¯_(ツ)_/¯