Skip to content

[RELOPS-2214] puppet module disable os updates #1068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rcurranmoz wants to merge 3 commits into
base: master
Choose a base branch
from
Open

[RELOPS-2214] puppet module disable os updates #1068

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f32150f
test module to suppress updates
rcurranmoz Feb 20, 2026
40f3a47
fix
rcurranmoz Feb 20, 2026
767af71
fix
rcurranmoz Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions modules/macos_disable_software_updates/manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Disables automatic macOS software updates by writing directly to the
# com.apple.SoftwareUpdate preferences domain as root. This replaces
# the MDM/mobileconfig profile approach and works on macOS 10.15 and later.
#
# ConfigDataInstall and CriticalUpdateInstall are intentionally left enabled
# so that XProtect / MRT security-data updates continue to be applied.
class macos_disable_software_updates {

$domain = '/Library/Preferences/com.apple.SoftwareUpdate'

macos_utils::defaults { 'softwareupdate_AutomaticCheckEnabled':
domain => $domain,
key => 'AutomaticCheckEnabled',
value => '0',
val_type => 'bool',
}

macos_utils::defaults { 'softwareupdate_AutomaticDownload':
domain => $domain,
key => 'AutomaticDownload',
value => '0',
val_type => 'bool',
}

macos_utils::defaults { 'softwareupdate_AutomaticallyInstallAppUpdates':
domain => $domain,
key => 'AutomaticallyInstallAppUpdates',
value => '0',
val_type => 'bool',
}

macos_utils::defaults { 'softwareupdate_AutomaticallyInstallMacOSUpdates':
domain => $domain,
key => 'AutomaticallyInstallMacOSUpdates',
value => '0',
val_type => 'bool',
}

macos_utils::defaults { 'softwareupdate_AllowPreReleaseInstallation':
domain => $domain,
key => 'AllowPreReleaseInstallation',
value => '0',
val_type => 'bool',
}

macos_utils::defaults { 'softwareupdate_ConfigDataInstall':
domain => $domain,
key => 'ConfigDataInstall',
value => '1',
val_type => 'bool',
}

macos_utils::defaults { 'softwareupdate_CriticalUpdateInstall':
domain => $domain,
key => 'CriticalUpdateInstall',
value => '1',
val_type => 'bool',
}
}
35 changes: 20 additions & 15 deletions modules/macos_utils/manifests/defaults.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,22 +3,27 @@
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

define macos_utils::defaults (
Optional[String] $domain = undef,
Optional[String] $key = undef,
Optional[String] $value = undef,
String $user = 'root',
Enum['string', 'int', 'float', 'bool', 'date', 'array'] $val_type = 'string',
Optional[String] $domain = undef,
Optional[String] $key = undef,
Optional[String] $value = undef,
String $user = 'root',
Enum['string', 'int', 'float', 'bool', 'date', 'array'] $val_type = 'string',
) {

$defaults_cmd = '/usr/bin/defaults'
if ($domain != undef) and ($key != undef) and ($value != undef) {
exec { "osx_defaults write ${domain} ${key}=>${value}" :
command => "${defaults_cmd} write ${domain} ${key} -${val_type} ${value}",
unless => "/bin/test x`${defaults_cmd} read ${domain} ${key}` = x'${value}'",
user => $user,
}
$defaults_cmd = '/usr/bin/defaults'
if ($domain != undef) and ($key != undef) and ($value != undef) {
# macOS defaults write -bool requires 'true'/'false', but defaults read returns '0'/'1'.
# Convert the write value for bool types while keeping the unless comparison as-is.
$write_value = $val_type ? {
'bool' => $value ? { '1' => 'true', '0' => 'false', default => $value },
default => $value,
}
else {
fail('Cannot ensure present without domain, key, and value attributes')
exec { "osx_defaults write ${domain} ${key}=>${value}" :
command => "${defaults_cmd} write ${domain} ${key} -${val_type} ${write_value}",
unless => "/bin/test x`${defaults_cmd} read ${domain} ${key}` = x'${value}'",
user => $user,
}
}
else {
fail('Cannot ensure present without domain, key, and value attributes')
}
}
6 changes: 5 additions & 1 deletion modules/roles_profiles/manifests/profiles/software_updates.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,11 @@
class roles_profiles::profiles::software_updates {
case $facts['os']['name'] {
'Darwin': {
include macos_mobileconfig_profiles::disable_software_updates
mac_profiles_handler::manage { 'com.github.erikberglund.ProfileCreator.7AF6CC8C-EA10-4CD9-B145-77FD3CCFEF35':
ensure => 'absent',
}
include macos_disable_software_updates
Mac_profiles_handler::Manage['com.github.erikberglund.ProfileCreator.7AF6CC8C-EA10-4CD9-B145-77FD3CCFEF35'] -> Class['macos_disable_software_updates']
}
default: {
fail("${facts['os']['name']} not supported")
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/applicationservices_1_b_osx_1015.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
include roles_profiles::profiles::ntp
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/applicationservices_3_b_osx_1015.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
include roles_profiles::profiles::ntp
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/enterprise_1_b_osx_arm64.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/enterprise_3_b_osx_arm64.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015_staging.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_1_b_osx_arm64.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_3_b_osx_1015.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
include roles_profiles::profiles::ntp
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_3_b_osx_arm64.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::safariupdate
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8_staging.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::safariupdate
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::talos
include roles_profiles::profiles::timezone
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8_staging.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::talos
include roles_profiles::profiles::timezone
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::talos
include roles_profiles::profiles::timezone
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_ipv6.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::talos
include roles_profiles::profiles::timezone
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_staging.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::talos
include roles_profiles::profiles::timezone
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m_vms.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
include roles_profiles::profiles::pipconf
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::safaridriver
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::talos
include roles_profiles::profiles::timezone
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mac_v4_signing_adhoc.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::remove_bootstrap_user
include roles_profiles::profiles::signing_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mac_v4_signing_dep.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::remove_bootstrap_user
include roles_profiles::profiles::signing_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mac_v4_signing_ff_ent_prod.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::remove_bootstrap_user
include roles_profiles::profiles::signing_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mac_v4_signing_ff_prod.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::remove_bootstrap_user
include roles_profiles::profiles::signing_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mac_v4_signing_tb_prod.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::remove_bootstrap_user
include roles_profiles::profiles::signing_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mac_v4_signing_vpn_prod.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::remove_bootstrap_user
include roles_profiles::profiles::signing_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mozillavpn_b_1_osx.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
include roles_profiles::profiles::network
include roles_profiles::profiles::ntp
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/mozillavpn_b_3_osx.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
include roles_profiles::profiles::network
include roles_profiles::profiles::ntp
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/nss_1_b_osx_1015.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
include roles_profiles::profiles::ntp
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
1 change: 1 addition & 0 deletions modules/roles_profiles/manifests/roles/nss_3_b_osx_1015.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
include roles_profiles::profiles::ntp
include roles_profiles::profiles::packages_installed
include roles_profiles::profiles::relops_users
include roles_profiles::profiles::software_updates
include roles_profiles::profiles::sudo
include roles_profiles::profiles::timezone
include roles_profiles::profiles::users
Expand Down
Loading