Erase-Install v31 script timing out on "startosinstall"

[DesertHawk25]

We've been using the erase-install solution for our Jamf instance quite successfully for a while now, but more recently are seeing an increased number of failures when trying to install an update. It's affecting macOS 12, 13, and 14 systems. In the logs, it appears that the script is timing out after the line: "Sending password to startosinstall".

Here's an example erase-install.log from one of the failures:

2023-10-27 07:42:12 | v31.0 | [log_rotate] Finished rotating logs in /Library/Management/erase-install/log
2023-10-27 07:42:12 | v31.0 | [erase-install] v31.0 script execution started: Fri Oct 27 07:42:12 EDT 2023
2023-10-27 07:42:12 | v31.0 | [erase-install] Arguments provided: / Computer1 User1 --reinstall --current-user --version=13.6.1 --no-fs
2023-10-27 07:42:12 | v31.0 | [erase-install] System version: 13.6 (Build: 22G120)
2023-10-27 07:42:13 | v31.0 | [check_for_swiftdialog_app] swiftDialog v2.2.1.4591 is installed (/Library/Application Support/Dialog/Dialog.app)
2023-10-27 07:42:13 | v31.0 | [check_for_swiftdialog_app] Creating dialog log (/var/tmp/dialog.AuM)...
2023-10-27 07:42:13 | v31.0 | [erase-install] Caffeinating this script (pid=86655)
2023-10-27 07:42:14 | v31.0 | [check_free_space] OK - 158 GB free/purgeable disk space detected
2023-10-27 07:42:14 | v31.0 | [erase-install] Looking for existing installer app or pkg
2023-10-27 07:42:14 | v31.0 | [find_existing_installer] Installer found at /Applications/Install macOS Ventura.app.
2023-10-27 07:42:14 | v31.0 | [check_installer_is_valid] Checking validity of /Applications/Install macOS Ventura.app.
2023-10-27 07:42:14 | v31.0 | [check_installer_is_valid] Mounting /Applications/Install macOS Ventura.app/Contents/SharedSupport/SharedSupport.dmg
2023-10-27 07:42:16 | v31.0 | [check_installer_is_valid] Using Build value from com_apple_MobileAsset_MacSoftwareUpdate.xml
Volume Shared Support on disk4s2 force-unmounted
2023-10-27 07:42:18 | v31.0 | [compare_build_versions] Comparing (1) 22G120 with (2) 22G313
2023-10-27 07:42:18 | v31.0 | [check_installer_is_valid] Installer: 22G313 >= System: 22G120 : valid build.
2023-10-27 07:42:18 | v31.0 | [erase-install] Running on architecture arm64
2023-10-27 07:42:18 | v31.0 | [get_user_details] ask for user credentials (attempt 1/5)
2023-10-27 07:42:18 | v31.0 | [get_default_dialog_args] Invoking utility dialog
Unable to find the user record
2023-10-27 07:42:28 | v31.0 | [get_user_details] DomainUser account cannot be found!
2023-10-27 07:42:28 | v31.0 | [get_user_details] ask for user credentials (attempt 2/5)
2023-10-27 07:42:28 | v31.0 | [get_default_dialog_args] Invoking utility dialog
yes User1 is a member of everyone
2023-10-27 07:42:39 | v31.0 | [get_user_details] User1 is a Volume Owner
2023-10-27 07:42:39 | v31.0 | [check_password] Success: the password entered is the correct login password for User1.
2023-10-27 07:42:39 | v31.0 | [erase-install] Installer is at: /Applications/Install macOS Ventura.app
2023-10-27 07:42:39 | v31.0 | [check_free_space] OK - 158 GB free/purgeable disk space detected
2023-10-27 07:42:39 | v31.0 | [erase-install] WARNING! Running /Applications/Install macOS Ventura.app with reinstall option
2023-10-27 07:42:39 | v31.0 | [erase-install] Sending quit message to dialog log (/var/tmp/dialog.AuM)
curl: (3) URL rejected: Malformed input to a URL function
2023-10-27 07:42:40 | v31.0 | [get_default_dialog_args] Invoking utility dialog
2023-10-27 07:42:40 | v31.0 | [launch_startosinstall] This is the startosinstall command that will be used:
2023-10-27 07:42:40 | v31.0 | [launch_startosinstall] /Applications/Install\ macOS\ Ventura.app/Contents/Resources/startosinstall --pidtosignal 86655 --agreetolicense --nointeraction --allowremoval --forcequitapps --stdinpass --user User1
2023-10-27 07:42:40 | v31.0 | [launch_startosinstall] Launching startosinstall...
File Doesn't Exist, Will Create: /Library/LaunchDaemons/com.github.grahampugh.erase-install.startosinstall.plist
2023-10-27 07:42:40 | v31.0 | [erase-install] Sending password to startosinstall
2023-10-27 08:42:40 | v31.0 | [erase-install] Timeout reached for PID 87048!
2023-10-27 08:42:41 | v31.0 | [erase-install] Reached end of script unexpectedly. This probably means startosinstall failed to complete within 60 minutes.
2023-10-27 08:42:41 | v31.0 | [erase-install] attempting to terminate the 'caffeinate' process - Termination message indicates success
2023-10-27 08:42:41 | v31.0 | [finish] sending quit message to dialog (/var/tmp/dialog.AuM)
2023-10-27 08:42:41 | v31.0 | [finish] Script exit code: 42

For a bit of context, we're deploying minor macOS updates using the erase-install solution in phases using two Jamf policies for each major macOS version (example: macOS 13 endpoints only get macOS 13 updates). The first policy executes the erase-install script to download & cache the target macOS installer into /Applications/. Once complete, and the appropriate macOS installer is detected in the Jamf computer inventory, the systems falls into scope of a self-service policy which runs the erase-install script with the parameters: --reinstall --current-user --version=(appropriate ver.) --no-fs.

We've seen this come up here and there in the past, but it seemed to sort itself out on a retry or an updated release of the erase-install script. However, the affected systems are now routinely failing. So far, I've only been able to get my hands on one of the devices experiencing the issue, and was only able to get the policy to run successfully after re-installing the OS.

Has anyone else encountered a similar issue? I'm thankful for any help that you could provide.

Thanks,

[grahampugh]

I advise taking a tool at any security-related software you may have deployed. Things like Zscaler are coming up again and again for issues similar to this.

[grahampugh]

@shan1784 same answer to you, check your security software. I have had this question hundreds of times now, and it's always security/network filter software.

[shan1784]

Ok thank you. Not too versed on this to be honest. Is there an extension we need to allow? Sorry for all the questions but i'm looking at our crowdstrike Falcon logs and not finding anything.

[grahampugh]

First thing to try is-Does it work when CS is not installed at all?

[shan1784]

That would be impossible for us to test as only our sec group can remove it and if removed we have not network access. All other machines work to upgrade just not to sonoma.

[grahampugh]

Guess you will have to get them involved. I'm sure they will want to help you ensure that computers are updated. Things to check would include access to Apple's domains and any control on bootstrapping LaunchAgents/Daemons.