Blocking Sonoma

[g003441]

Is there a way to prevent erase-install from pulling down Sonoma as an update when its released? We use mosyle as our MDM and block users from OS updates but I'm afraid erase-install will override any restrictions we place on updating to Sonoma.

After reading the wiki would something like this be used to ensure 13.4.1 is the installer being pulled?

/Library/Management/Erase-install/erase-install.sh --reinstall --current-user --depnotify --os 13.4.1

[grahampugh]

Not quite right. This will ensure erase-install downloads only the latest available version of macOS 13:

/Library/Management/Erase-install/erase-install.sh --reinstall --os 13

If you wanted to specify a certain minor version, then you can use the version flag:

/Library/Management/Erase-install/erase-install.sh --reinstall --version 13.5

(--current-user, --depnotify are no longer valid flags)

[g003441]

Tested this out for fun, got the following when running this. /Library/Management/Erase-install/erase-install.sh --reinstall --version 13.5

Also is there away to simply force the update with out the user prompt?

Identifier │ Name │ Version │ Build │ Size │ Date │ Compatible
───────────┼───────────────┼─────────┼────────┼──────────┼────────────┼───────────
042-01917 │ macOS Ventura │ 13.4.1 │ 22F82 │ 11.80 GB │ 2023-06-28 │ True
032-84910 │ macOS Ventura │ 13.4 │ 22F66 │ 11.80 GB │ 2023-05-18 │ True
002-75541 │ macOS Ventura │ 13.3 │ 22E252 │ 11.79 GB │ 2023-03-27 │ True

2023-07-12 14:03:23 [run_mist] Checking that selected version 13.5 is available

2023-07-12 14:03:23 [run_mist] This command is now being run:

2023-07-12 14:03:23 mist download installer 13.5 application --application-name Install %NAME%.app --output-directory /Applications --compatible --no-ansi
┌──────────────────┐
│ INPUT VALIDATION │
└──────────────────┘
├─ User is 'root'...
├─ Download search string will be '13.5'...
├─ Include betas in search results will be 'false'...
├─ Only include compatible installers will be 'true'...
├─ Cache downloads will be 'false'...
├─ Output directory will be '/Applications'...
├─ Temporary directory will be '/private/tmp/com.ninxsoft.mist'...
├─ Force flag has not been set, existing files will not be overwritten...
├─ Application name will be 'Install %NAME%.app'...
┌────────┐
│ SEARCH │
└────────┘
├─ Searching for macOS download '13.5'...
└─ No macOS Installer found with '13.5', exiting...

[grahampugh]

Working as expected, because there is no 13.5 yet!

No, the user needs to supply their password on Apple Silicon. I am introducing a method to do this in the next version of erase-install but it's insecure and should only be used in a classroom situation after considering the risks - absolutely not for 1:1 computers.

[g003441]

That sounds really cool! Looking forward to it.