notes_on_unattended_macos_upgrades.md

Download macOS installer application

Greg Neagle created a Python script titled installinstallmacos.py that downloads macOS installer applications from Apple’s servers. There is a fork by Graham Pugh that adds the ability to search for a matching release using a version string like 10.15.7: https://github.com/grahampugh/macadmin-scripts/blob/main/installinstallmacos.py

The following command will download the necessary package from Apple’s servers and install the macOS Installer application onto a disk image that can be discarded after the upgrade is complete.

installinstallmacos.py --warnings --raw --version 10.15.7

The entire process needs lots of disk space. Make sure you at least have 35 GB available.

Starting with macOS 10.15 Apple’s softwareupdate tool can also download installer applications:

softwareupdate --fetch-full-installer --full-installer-version 10.15.7

Install configuration profiles to silence welcome assistants

To keep macOS from showing welcome assistants after the initial reboot, install the following profiles from Richard Trouton’s repository at https://github.com/rtrouton/profiles:

• SetDiagnosticandUsageReportSettings.mobileconfig
• SkipDarkorLightAppearance.mobileconfig
• SkipDataAndPrivacy.mobileconfig
• SkipiCloudSetup.mobileconfig
• SkipScreenTimeSetup.mobileconfig
• SkipSiriSetup.mobileconfig
• SkipTouchIDSetup.mobileconfig
• SkipTrueToneDisplay.mobileconfig

To install profiles use the following command:

profiles install -path PATH_TO_PROFILE

Perform upgrade

Mount the disk image produced by installinstallmacos.py:

hdiutil attach PATH_TO_IMAGE

Perform upgrade:

PATH_TO_MOUNTED_IMAGE/Applications/Install\ macOS\ RELEASE_NAME.app/Contents/Resources/startosinstall --agreetolicense --rebootdelay 0 --forcequitapps

The necessary parameters are given to startosinstall for the process to finish without further interaction.

Install custom post-upgrade packages

Last demonstrated to be working on macOS High Sierra by Richard Trouton, the startosinstall executable should accept multiple mentions of the --installpackage flag to perform additional installations after an upgrade finished.

It is said that an undocumented --nointeraction flag is necessary to prevent user dialogs and that the packages can be signed or unsigned but need to be flattened using productbuild -–package PATH_TO_INPUT_PACKAGE PATH_TO_FLAT_PACKAGE.

Modifying the above upgrade command to include a package could look like this:

startosinstall --agreetolicense --rebootdelay 0 --forcequitapps --nointeraction --installpackage PATH_TO_FLAT_PACKAGE

Perform updates

The idea is to separate this process into three stages. (1) Scan for available updates and notify administrators. (2) Prepare by downloading updates during off-peak hours. (3) Install updates after backups are completed and time can be reserved for eventual catastrophic failures.

List updates:

softwareupdate --list --recommended --verbose --product-types macOS

Download updates:

softwareupdate --download --recommended --verbose --product-types macOS

Perform updates:

softwareupdate --install --recommended --verbose --restart --product-types macOS

For the Perform upgrade part the Big Sur (11.6.1) installer required me to supply either --passprompt or --stdinpass to startosinstall. I went with --passprompt and it installed and rebooted successfully back to a Screen Sharing available login screen even for a FileVault enabled machine (of course with all the mentioned profiles installed).
Thank you for this guide!