macOS Automating Software Updates with launchd

[viggen9]

Hello. I'm trying to get launchd to act like cron and execute a script on Friday afternoons to install software updates (education environment). My shell script works fine, but I can't get launchd to launch it at a specific time.

I am using:
sudo launchctl load com.sps.autoupdate.plist which runs my script immediately instead of at the time specified within the plist. Any ideas as to how to correctly format the plist? Here it is:

?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN
http://www.apple.com/DTDs/PropertyList-1.0.dtd >
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.sps.autoupdate</string>
<key>ProgramArguments</key>
<array>
<string>/Users/test/SPSupdate</string>
</array>
<key>OnDemand</key>
<false/>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>16</integer>
<key>Minute</key>
<integer>00</integer>
<key>Weekday</key>
<integer>5</integer>
</dict>
</dict>
</plist>

Thanks for your help---

 

[CANEHDN]

And why not just have Apple Updates update automatically?

 

[viggen9]

And why not just have Apple Updates update automatically?

Because this is for hundreds of Macs in an education environment.

 

[Krevnik]

The big thing I see is that you don't actually specify a path to your script.

<key>Program</key>
<string>FULL_PATH_TO_APP</string>

The script also needs to be set executable, owned by root, and have had group/everyone permissions for r/w stripped (launchd doesn't like launching jobs as root that can be writable by a normal user, as it is a security risk).

 

[tjwett]

Deploying Updates...

hey viggen9. i cannot help you with your script but i can tell you how i do it. i maintain about 300 Macs for a large newspaper and i've grown tired of trying to reliably automate the installations on the client machines. this is the method i've settled upon and it's been working great.

we have an XServe running Software Update services and all of the clients are set via Workgroup Manager to use this for updates. so i have the server set to mirror all updates from Apple, but not enable automatically. when i want to deploy an important update i just enable it on the server. i have ARD running the Unix command "softwareupdate -i -a" as root on every machine on the network twice per day and i simply have each machine have a scheduled reboot every night after hours, via Workgroup Manager as well.

 

[aperkins]

ARD Still a great solution in 2012

We were spinning our wheels trying to create client-side solutions as well. tjwett's solution using Apple Remote Desktop (ARD) works flawlessly. Maybe once we've gotten all the Windows updates, deployments, debugging, etc. completed we can try a client side solution again, but until then...