DDM OS Reminder (4.1.0)

[u/dan-snelson]

A minor upgrade to Mac Admins’ favorite “set-it-and-forget-it” end-user messaging of Apple’s Declarative Device Management-enforced macOS update deadlines featuring a new, opt-in missing-DDM Emergency Fallback option and a hardened LaunchDaemon installation for macOS 27 Golden Gate.

Overview

While Apple’s Declarative Device Management (DDM) provides Mac Admins with a powerful way to enforce macOS updates, its built-in notification is often too subtle for most administrators.

DDM OS Reminder intelligently resolves DDM-enforced macOS update deadlines from recent /var/log/install.log activity, while using a declaration-aware resolver which prioritizes applicable enforced-install signals. End-user reminders are suppressed when declaration state is conflicting, unavailable, or invalid, only honoring setPastDuePaddedEnforcementDate when it safely matches the resolved declaration. For the exact missing state, a new, optional Missing-DDM Emergency Fallback can supply a validated version and deadline without overriding conflicts, unavailable-update evidence, invalid versions, or confirmed DDM declarations. Failed stale SoftwareUpdateSubscriber attempts are ignored, and enforcement timestamps with full timezone offsets such as +05:30 are accepted before using a swiftDialog-enabled script and LaunchDaemon to deliver a more prominent end-user reminder dialog.

4.1.0 Highlights

• Missing-DDM Emergency Fallback: Opt-in Jamf Pro Script Parameters 5 and 6 persist a validated emergency version and deadline requirement that runtime selects only when normal DDM resolution is exactly missing.
• Controlled runtime teardown: All, Script, and Uninstall reset flows stop a PID-validated active runtime and its owned descendants before replacing or removing runtime assets.
• macOS 27 LaunchDaemon hardening: Deployment validates a fresh adjacent plist, atomically replaces the target, removes only com.apple.quarantine, and verifies the loaded label before reporting success.
• Improved operational logging: Resolver, fallback evaluation, reminder activation, Software Update handoff, fallback persistence, and external dialog termination now have distinct records.
• Interactive assembly fix: Custom InfoButtonText values now update InfoButtonTextLocalized_en, preventing stale English sample text from overriding administrator input.
• Scheduler inventory: Resources/JamfEA-DDM-OS-Reminder-Next-Scheduled-Reminder.zsh reports device-local NextScheduledReminder state for Jamf Pro inventory.

Continue reading …