TweetFollow Us on Twitter

MacEnterprise: Managing Software Installs with Munki - Part 2

Volume Number: 26
Issue Number: 11
Column Tag: MacEnterprise

MacEnterprise: Managing Software Installs with Munki - Part 2

Setting up a demonstration Munki Server

By Greg Neagle,

Previously in MacEnterprise...

Last month, we started looking at munki, a set of open-source tools that can manage software installs and removals on Mac OS X machines. Munki consists largely of client-side tools written in Python, and can use virtually any modern web server as its source of packages and data. Munki's source code, as well as installer packages for the tools, are available at Munki supports Mac OS X 10.5 (Leopard) and 10.6 (Snow Leopard).

Munki can install software packaged in Apple's Installer package format, software delivered for "drag-and-drop" installs on disk images, and Adobe CS3, CS4 and CS5 products and updates using Adobe's supported enterprise deployment tools.

As part of last month's introduction, we looked at the data munki uses to determine what to install or remove. Aside from the actual software to be installed (which for the rest of this column we'll refer to as "packages," even for items that aren't strictly Apple packages), munki stores its data in the form of Apple plist files. Munki uses manifest files to keep track of which software is to be installed on which machines, and catalog files to keep track of which packages are available.

Manifests are easy to understand. A bare-bones manifest must contain a list of one or more catalogs to be searched for packages, and a list of packages to install. Here's an example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
<plist version="1.0">

In this example, munki is told to search the production catalog for Firefox and Thunderbird, and ensure the latest versions of these items are installed. The concept of "catalogs" is an important one. It is possible to have different versions of software available in different catalogs. A very common and powerful configuration is to maintain a "testing" catalog and a "production" catalog. New versions of software are first added to the "testing" catalog. Only a subset of managed machines is configured to use the "testing" catalog, and this subset gets the newer versions of software first. Once you are satisfied there are no major issues with a new version of a piece of software, you can add the new version to the "production" catalog, where the rest of your managed machines will find it and install it.

Munki catalogs are lists of items that describe available packages. Munki provides some tools that help you create the catalog information for each package and combine this information into catalogs. In the most common configuration, the information for each package is stored in a corresponding "pkginfo" file. These pkginfo files are combined together to make the catalogs.

We looked at a sample pkginfo file last month, and there's a lot of information crammed into each one. Fortunately, you don't have to create these from scratch - tools provided with munki can create pkginfo files from pkgs. Rather than reviewing the contents and format of pkginfo files, we're going to create some to use with our own munki server.

Setting up a Demonstration Munki Server

Since Munki can use virtually any web server as its server, and since Mac OS X ships with Apache2, accessible as "Web Sharing" in the Sharing System Preferences pane, it's very easy to set up a demonstration munki server on any available Mac. You can even set up a munki server on a single machine that is also a munki client, and that is exactly what we are about to do.

To set up a munki server, we're going to create a directory structure in /Users/Shared, and then configure Apache2 to serve it via HTTP. You can do the next few steps via the Finder or via the Terminal, but it's easier to write them out as Terminal commands:

cd /Users/Shared/
mkdir munki_repo
mkdir munki_repo/catalogs
mkdir munki_repo/manifests
mkdir munki_repo/pkgs
mkdir munki_repo/pkgsinfo

You might be wondering what that last directory is. The pkgsinfo directory holds data that is not used directly by munki clients, but is used by other munki tools to create the catalogs. One more thing: let's make sure the Apache2 can read and traverse all of these directories:

chmod -R a+rX munki_repo

Next, we need to tell Apache2 to serve the munki_repo directory via HTTP. You could edit the /etc/apache2/http.conf file, or one of the other .conf files used by Apache2, but there's a much easier method for this demonstration.

sudo ln -s /Users/Shared/munki_repo /Library/WebServer/Documents/

This creates a symlink inside /Library/WebServer/Documents/ that points to our new munki_repo directory. By default on Mac OS X, /Library/WebServer/Documents/ is Apache2 's DocumentRoot, so it will serve anything in that directory via HTTP.

If you haven't already, turn on Web Sharing in the Sharing preferences pane. Now you can test your work so far. Using your favorite web browser, navigate to http://localhost/munki_repo. If you've done things correctly to this point, it should look like Figure 1.

Figure 1 - Our munki repo via HTTP

We now have a working munki repository ("repo") - but it's completely empty and not useful at all. So let's start to populate the repo.

We're going to use some tools distributed with munki to import packages into our new Muni repo. Download the current munki installation package at For this column, I'll be using a preview of the 0.7.0 release of the munki tools; by the time this reaches print, 0.7.0 (or later) should be in final release. In any case, it's important that you use a 0.7.0 release or later - some of the tools we'll use aren't available in earlier releases, or work differently.

Install the munki tools by mounting the disk image and double-clicking the Installer package and installing like any other package. A restart is required after installation.

The tools you'll use as an administrator are available from the command-line, and are installed in /usr/local/munki. This location is not in the standard search path, so you'll need to either add this directory to your search paths, or be sure to type the full path when invoking these tools.

The tool we will use to import packages into the munki repo is called munkiimport. We need to configure it before we can use it - telling it where to find our repo, among other things.

bash-3.2$ /usr/local/munki/munkiimport —configure
Path to munki repo [None]: /Users/Shared/munki_repo   
Repo fileshare URL [None]: 
pkginfo extension [None]: 
pkginfo editor [None]:

We are first asked for the path to the munki repo, and since we set one up at /Users/Shared/munki_repo, that's what we enter. Next, we are asked for a repo fileshare URL. This is used when the repo is hosted on a remote file server, and this would typically be an afp:// or smb:// URL specifying the share. Since we're hosting the repo on the local machine, we'll leave this blank. We are then asked to specify an extension to append to the name of pkginfo files. Some admins prefer ".plist", some prefer ".pkginfo". Personally, I just leave it blank - munki doesn't care. Finally, you are asked for an editor to use for the pkginfo files. If you like command-line editors, you can specify /usr/bin/vi or /usr/bin/emacs for example. If you, like me, prefer GUI text editors, you can specify GUI apps by name (but be sure to include the ".app" extension). I picked, but you could choose,, or even

Next, let's get a package to import. Firefox is a good example package, and you can download it from As of this writing, the current version is 3.6.12, and when I download it using Safari, a disk image named "Firefox 3.6.12.dmg" is downloaded to my Downloads folder and opened in the Finder. We want to work with the disk image file itself, so eject the mounted "Firefox" volume in the Finder.

We'll return to the command line to import the Firefox package.

/usr/local/munki/munkiimport ~/Downloads/Firefox\ 3.6.12.dmg Item name [Firefox]: Display name []: Mozilla Firefox Description []: Web browser from Mozilla Version []: Catalogs [testing]: Item name: Firefox Display name: Mozilla Firefox Description: Web browser from Mozilla Version: Catalogs: testing Import this item? [y/n] y Upload item to subdirectory path []: apps/mozilla Path /Users/Shared/munki_repo/pkgs/apps/mozilla doesn't exist. Create it? [y/n] y Copying Firefox 3.6.12.dmg to /Users/Shared/munki_repo/pkgs/apps/mozilla/Firefox 3.6.12.dmg... Saving pkginfo to /Users/Shared/munki_repo/pkgsinfo/apps/mozilla/Firefox-

Let's walk through this. We run the munkiimport tool and provide it a path to our downloaded disk image. munkiimport then asks us to confirm or override some basic information about the package. We accept the item name by simply hitting return, but provide a new "Display name" and "Description". We accept the version and the catalogs.

munkiimport then prints back our choices and asks if we want to import the item. (If we made any mistakes, this would be a good time to say "no"!) We agree, and munkiimport asks us if we'd like to upload the package to a subdirectory path. We could just skip this, and upload everything to the top level of the pkgs directory in the munki repo, but as our number of packages grows, that might get hard to navigate. So we're going to upload this into a directory named "Mozilla" inside a directory named "apps". As a sanity check, munkiimport warns us that the subdirectory path we've chosen doesn't yet exist. Since this is a brand new repo, we knew in advance that the directory didn't exist, so we want munkiimport to create it for us. Finally, munkiimport copies the Firefox package to /Users/Shared/munki_repo/pkgs/apps/mozilla/ and saves the pkginfo to /Users/Shared/munki_repo/pkgsinfo/apps/mozilla/Firefox-

Since I chose as my editor when I configured munkiimport earlier, munkiimport next opens the newly created pkginfo file in TextMate. See Figure 2.

Figure 2 - Munki pkginfo for Firefox 3.6.12

This gives you another opportunity to edit the pkginfo using your favorite text editor. We don't need to make any changes, though, so we can just close it. If we return our attention to the terminal window we used to run munkiimport, we'll see it's prompting us for one more bit of information:

Rebuild catalogs? [y/n] 

Remember that munki clients don't use the individual pkginfo files; instead they download and consult munki catalogs to find available software. So to actually make use of the pkginfo we just generated, we need to build new versions of all the defined catalogs. Answering "y" to this prompt causes munkiimport to rebuild the munki catalogs.

Rebuild catalogs? [y/n] y
Adding apps/mozilla/Firefox- to testing...

Since we only have one package (and its corresponding pkginfo) in our munki repo, we see a single item has been added to the testing catalog.

Again we can check our work so far. In your web browser, navigate to http://localhost/munki_repo/catalogs/testing. You should see something similar to Figure 3.

Figure 3 - Munki "testing" catalog

We now have one package in our munki repo. Our next step is to create a manifest so that munki knows what to install on a machine. Create a new text file in your favorite text editor with these contents:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
<plist version="1.0">

Save the file as /Users/Shared/munki_repo/

manifests/test_munki_client. Be sure your editor doesn't add a file extension to the file name (many will try to add ".txt" for you). Again, check your work in your web browser by navigating to http://localhost/munki_repo/

manifests/test_munki_client. You should see the file you just created displayed in your web browser.

Munki Client Configuration

We're done (for now) with the server. Next, we need to configure the munki client so it knows about our server. The munki client stores its configuration in /Library/Preferences/ManagedInstalls.plist. Unless you've run the munki client before, this file won't yet exist. We'll use the defaults command to create it with the data we need. (Watch the line breaks - these are two commands, each on a single line.)

sudo defaults write /Library/Preferences/ManagedInstalls SoftwareRepoURL "http://localhost/munki_repo"
sudo defaults write /Library/Preferences/ManagedInstalls ClientIdentifier "test_munki_client"

We've told the client tools the top-level URL for the munki repo, and the name of the client manifest we'd like to use. That's it for the client configuration. Now the moment of truth: let's run the munki client from the command line.

sudo /usr/local/munki/managedsoftwareupdate 
Managed Software Update Tool
Copyright 2010 The Munki Project
Downloading Firefox 3.6.12.dmg...
Verifying package integrity...
The following items will be installed or upgraded:
    + Firefox-
        Web browser from Mozilla
Run managedsoftwareupdate —installonly to install the downloaded updates.

Success! munki saw that we needed Firefox 3.6.12 and downloaded it. (It did not yet install it - we'll get to that in a bit.) But what if instead when you run managedsoftwareupdate you see this:

sudo /usr/local/munki/managedsoftwareupdate 
Managed Software Update Tool
Copyright 2010 The Munki Project
No changes to managed software are available.

The most likely reason you see this is because you already have Firefox 3.6.12 (or later) installed. If you really want to test munki, delete your copy of Firefox:

sudo rm -r /Applications/

Then try running managedsoftwareupdate again - you should see it being downloaded as in the example above.

Managed Software

We ran managedsoftwareupdate from the command line and verified that the munki tools could talk to our munki server and download the Firefox package. But, as we've noted, managedsoftwareupdate did not actually install Firefox. We could call managedsoftwareupdate again, this time passing it the -installonly flag to make it install what it just downloaded. But instead, we're going to introduce another tool - the one "regular" users would interact with - Managed Software You'll find it in the /Applications/Utilities folder. Double-click it to launch it. You should see a window similar to Figure 4.

Figure 4 - Managed Software

If you click on Update now, you'll be asked if you want to install without logging out, or to log out and install. Choose one and Firefox will be installed, and it will look something like Figure 5.

Figure 5 - Installing Firefox

Wrap up ...for now

Huzzah! We've accomplished a lot. We've set up a munki server, imported a third-party software package, built a catalog, and created a client manifest. We've also configured a munki client and successfully installed software using the munki tools.

There's a lot more we can do with our demo munki server, but we've run out of space for this month, so we'll need to continue next month. Next time, we'll look at updating software and removing software. We'll also examine pkginfo files in more depth to get a sense of the additional capabilities munki can offer a Mac OS X administrator.

Appendix: Cleaning up

Perhaps you have decided you don't want to do anything more with munki. Maybe you intend to explore more, but don't want to leave the munki tools and munki server in place until next month's installment. In any case, if you want to remove the munki tools and server, here's what you need to remove. Watch the line breaks.

Removing the client tools:

sudo launchctl unload /Library/LaunchDaemons/com.googlecode.munki.*
sudo rm -rf "/Applications/Utilities/Managed Software"
sudo rm -f /Library/LaunchDaemons/com.googlecode.munki.*
sudo rm -f /Library/LaunchAgents/com.googlecode.munki.*
sudo rm -rf "/Library/Managed Installs"
sudo rm -rf /usr/local/munki
sudo pkgutil —forget com.googlecode.munki

Removing the server:

sudo rm /Library/WebServer/Documents/munki_repo
rm -r /Users/Shared/munki_repo

If you aren't using Web Sharing for anything else, remember to turn it off using the Sharing preferences pane.

Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project ( and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at


Community Search:
MacTech Search:

Software Updates via MacUpdate

Latest Forum Discussions

See All

Summon your guild and prepare for war in...
Netmarble is making some pretty big moves with their latest update for Seven Knights Idle Adventure, with a bunch of interesting additions. Two new heroes enter the battle, there are events and bosses abound, and perhaps most interesting, a huge... | Read more »
Make the passage of time your plaything...
While some of us are still waiting for a chance to get our hands on Ash Prime - yes, don’t remind me I could currently buy him this month I’m barely hanging on - Digital Extremes has announced its next anticipated Prime Form for Warframe. Starting... | Read more »
If you can find it and fit through the d...
The holy trinity of amazing company names have come together, to release their equally amazing and adorable mobile game, Hamster Inn. Published by HyperBeard Games, and co-developed by Mum Not Proud and Little Sasquatch Studios, it's time to... | Read more »
Amikin Survival opens for pre-orders on...
Join me on the wonderful trip down the inspiration rabbit hole; much as Palworld seemingly “borrowed” many aspects from the hit Pokemon franchise, it is time for the heavily armed animal survival to also spawn some illegitimate children as Helio... | Read more »
PUBG Mobile teams up with global phenome...
Since launching in 2019, SpyxFamily has exploded to damn near catastrophic popularity, so it was only a matter of time before a mobile game snapped up a collaboration. Enter PUBG Mobile. Until May 12th, players will be able to collect a host of... | Read more »
Embark into the frozen tundra of certain...
Chucklefish, developers of hit action-adventure sandbox game Starbound and owner of one of the cutest logos in gaming, has released their roguelike deck-builder Wildfrost. Created alongside developers Gaziter and Deadpan Games, Wildfrost will... | Read more »
MoreFun Studios has announced Season 4,...
Tension has escalated in the ever-volatile world of Arena Breakout, as your old pal Randall Fisher and bosses Fred and Perrero continue to lob insults and explosives at each other, bringing us to a new phase of warfare. Season 4, Into The Fog of... | Read more »
Top Mobile Game Discounts
Every day, we pick out a curated list of the best mobile discounts on the App Store and post them here. This list won't be comprehensive, but it every game on it is recommended. Feel free to check out the coverage we did on them in the links below... | Read more »
Marvel Future Fight celebrates nine year...
Announced alongside an advertising image I can only assume was aimed squarely at myself with the prominent Deadpool and Odin featured on it, Netmarble has revealed their celebrations for the 9th anniversary of Marvel Future Fight. The Countdown... | Read more »
HoYoFair 2024 prepares to showcase over...
To say Genshin Impact took the world by storm when it was released would be an understatement. However, I think the most surprising part of the launch was just how much further it went than gaming. There have been concerts, art shows, massive... | Read more »

Price Scanner via

AT&T has the iPhone 14 on sale for only $...
AT&T has the 128GB Apple iPhone 14 available for only $5.99 per month for new and existing customers when you activate unlimited service and use AT&T’s 36 month installment plan. The fine... Read more
Amazon is offering a $100 discount on every M...
Amazon is offering a $100 instant discount on each configuration of Apple’s new 13″ M3 MacBook Air, in Midnight, this weekend. These are the lowest prices currently available for new 13″ M3 MacBook... Read more
You can save $300-$480 on a 14-inch M3 Pro/Ma...
Apple has 14″ M3 Pro and M3 Max MacBook Pros in stock today and available, Certified Refurbished, starting at $1699 and ranging up to $480 off MSRP. Each model features a new outer case, shipping is... Read more
24-inch M1 iMacs available at Apple starting...
Apple has clearance M1 iMacs available in their Certified Refurbished store starting at $1049 and ranging up to $300 off original MSRP. Each iMac is in like-new condition and comes with Apple’s... Read more
Walmart continues to offer $699 13-inch M1 Ma...
Walmart continues to offer new Apple 13″ M1 MacBook Airs (8GB RAM, 256GB SSD) online for $699, $300 off original MSRP, in Space Gray, Silver, and Gold colors. These are new MacBook for sale by... Read more
B&H has 13-inch M2 MacBook Airs with 16GB...
B&H Photo has 13″ MacBook Airs with M2 CPUs, 16GB of memory, and 256GB of storage in stock and on sale for $1099, $100 off Apple’s MSRP for this configuration. Free 1-2 day delivery is available... Read more
14-inch M3 MacBook Pro with 16GB of RAM avail...
Apple has the 14″ M3 MacBook Pro with 16GB of RAM and 1TB of storage, Certified Refurbished, available for $300 off MSRP. Each MacBook Pro features a new outer case, shipping is free, and an Apple 1-... Read more
Apple M2 Mac minis on sale for up to $150 off...
Amazon has Apple’s M2-powered Mac minis in stock and on sale for $100-$150 off MSRP, each including free delivery: – Mac mini M2/256GB SSD: $499, save $100 – Mac mini M2/512GB SSD: $699, save $100 –... Read more
Amazon is offering a $200 discount on 14-inch...
Amazon has 14-inch M3 MacBook Pros in stock and on sale for $200 off MSRP. Shipping is free. Note that Amazon’s stock tends to come and go: – 14″ M3 MacBook Pro (8GB RAM/512GB SSD): $1399.99, $200... Read more
Sunday Sale: 13-inch M3 MacBook Air for $999,...
Several Apple retailers have the new 13″ MacBook Air with an M3 CPU in stock and on sale today for only $999 in Midnight. These are the lowest prices currently available for new 13″ M3 MacBook Airs... Read more

Jobs Board

Relationship Banker - *Apple* Valley Financ...
Relationship Banker - Apple Valley Financial Center APPLE VALLEY, Minnesota **Job Description:** At Bank of America, we are guided by a common purpose to help Read more
IN6728 Optometrist- *Apple* Valley, CA- Tar...
Date: Apr 9, 2024 Brand: Target Optical Location: Apple Valley, CA, US, 92308 **Requisition ID:** 824398 At Target Optical, we help people see and look great - and Read more
Medical Assistant - Orthopedics *Apple* Hil...
Medical Assistant - Orthopedics Apple Hill York Location: WellSpan Medical Group, York, PA Schedule: Full Time Sign-On Bonus Eligible Remote/Hybrid Regular Apply Now Read more
*Apple* Systems Administrator - JAMF - Activ...
…**Public Trust/Other Required:** None **Job Family:** Systems Administration **Skills:** Apple Platforms,Computer Servers,Jamf Pro **Experience:** 3 + years of Read more
Liquor Stock Clerk - S. *Apple* St. - Idaho...
Liquor Stock Clerk - S. Apple St. Boise Posting Begin Date: 2023/10/10 Posting End Date: 2024/10/14 Category: Retail Sub Category: Customer Service Work Type: Part Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.