Setup Your Mac (1.9.0) via swiftDialog

Complete the following steps on a virtual machine or non-production physical Mac.

1. Open the macOS Terminal.
2. Download the latest production version of Setup Your Mac using the following command. (The script will be saved to your Downloads folder as Setup-Your-Mac-via-Dialog-reference.bash):

curl -o ~/Downloads/Setup-Your-Mac-via-Dialog-reference.bash https://raw.githubusercontent.com/dan-snelson/Setup-Your-Mac/main/Setup-Your-Mac-via-Dialog.bash

3. Execute the Setup Your Mac script using the following command:

bash ~/Downloads/Setup-Your-Mac-via-Dialog-reference.bash

4. Observe the output (i.e., PRE-FLIGHT CHECK: This script must be run as root; exiting.)

tee: /var/log/org.churchofjesuschrist.log: Permission denied
2023-03-29 04:07:00 - 

###
# Setup Your Mac (1.9.0)
# https://snelson.us/sym
###

tee: /var/log/org.churchofjesuschrist.log: Permission denied
2023-03-29 04:07:00 - PRE-FLIGHT CHECK: Initiating …
tee: /var/log/org.churchofjesuschrist.log: Permission denied
2023-03-29 04:07:00 - PRE-FLIGHT CHECK: This script must be run as root; exiting.

5. Execute the Setup Your Mac script with elevated privileges via sudo !!:

sudo !!

sudo bash ~/Downloads/Setup-Your-Mac-via-Dialog-reference.bash
2023-03-29 04:14:29 - 

###
# Setup Your Mac (1.9.0)
# https://snelson.us/sym
###

2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Initiating …
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Setup Assistant is no longer running; proceeding …
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Finder & Dock are running; proceeding …
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: 'requiredMinimumBuild' has been set to disabled; skipping OS validation.
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: macOS 13.2.1 (22D68) installed
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Caffeinating this script (PID: 934)
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Check for Logged-in System Accounts …
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Current Logged-in User: dan
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Current Logged-in User First Name: Dan
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: Current Logged-in User ID: 501
2023-03-29 04:14:29 - QUIT SCRIPT: DEBUG MODE: Normally, 'jamf' binary check-in would be re-enabled
2023-03-29 04:14:29 - PRE-FLIGHT CHECK: # # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. 272 # # #
2023-03-29 04:14:30 - PRE-FLIGHT CHECK: Dialog not found. Installing...
installer: Package name is Dialog
installer: Upgrading at base path /
installer: The upgrade was successful.
2023-03-29 04:14:36 - PRE-FLIGHT CHECK: swiftDialog version 2.1.0.4148 installed; proceeding...
2023-03-29 04:14:36 - PRE-FLIGHT CHECK: Complete

6. Please wait while the latest production version of swiftDialog is automatically installed and the personalized “Welcome” dialog is displayed:

7. After reviewing and interacting with the input fields, click Quit.
8. Observe the output in Terminal (i.e., WELCOME DIALOG: dan clicked Quit at Welcome dialog):

2023-03-29 04:14:36.380 defaults[1070:10382] 
The domain/default pair of (/Library/Preferences/com.jamfsoftware.jamf, self_service_app_path) does not exist
/..namedfork/rsrc: No such file or directory
2023-03-29 04:14:36 - 

###
# VERBOSE DEBUG MODE | Dialog: v2.1.0.4148 • Setup Your Mac: v1.9.0
###

2023-03-29 04:14:36 - # # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. 1979 # # #
2023-03-29 04:14:41 - WELCOME DIALOG: dan clicked Quit at Welcome dialog
2023-03-29 04:14:41 - # # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. 1870 # # #
2023-03-29 04:14:41 - QUIT SCRIPT: Exiting …
2023-03-29 04:14:41 - QUIT SCRIPT: De-caffeinate …
2023-03-29 04:14:41 - Attempting to terminate the 'caffeinate' process …
2023-03-29 04:14:41 - (Termination message indicates success.)
/Users/dan/Downloads/Setup-Your-Mac-via-Dialog-reference.bash: line 1730:   965 Terminated: 15          caffeinate -dimsu -w $$
2023-03-29 04:14:41 - QUIT SCRIPT: DEBUG MODE: Normally, 'jamf' binary check-in would be re-enabled
2023-03-29 04:14:41 - QUIT SCRIPT: Removing /var/tmp/overlayicon.icns …
2023-03-29 04:14:41 - QUIT SCRIPT: Removing /var/tmp/dialogWelcome.e6Q …
2023-03-29 04:14:41 - QUIT SCRIPT: Removing /var/tmp/dialogSetupYourMac.sFC …
2023-03-29 04:14:41 - QUIT SCRIPT: Removing /var/tmp/dialogFailure.sa6 …
2023-03-29 04:14:41 - QUIT SCRIPT: Removing default dialog file …

9. Using Terminal, re-execute the Setup Your Mac script with elevated privileges by pressing the Up Arrow once and then pressing Return.
10. Populate the input fields and modify the drop-down menus, then click Continue:

11. Wait while Setup Your Mac runs in Verbose Debug Mode (displayed in the bottom, left-hand corner) and observe the expected failures (since Custom Triggers for the Jamf Pro policies have not yet been configured):

12. After clicking the default buttons in each of the above dialog boxes, review the client-side Setup Your Mac log file via Console:

open /var/log/org.churchofjesuschrist.log  

Note: When Debug Mode is set to true or verbose, Jamf Pro policies do not execute (which is why the validation checks fail); review the client-side log for the following:

SETUP YOUR MAC DIALOG: Confirm Policy Execution: DEBUG MODE: Skipping 'run_jamf_trigger

Simulating Failures

When testing Setup Your Mac on an enrolled Mac, you may not observe any failures, even though that’s what you want.

Temporarily replacing instances of Info.plist with Info.plist.failed can easily simulate failures.

Completion Actions

While Debug Mode can prove helpful during initial testing, eventually you’ll want to test-drive real-world scenarios (and, as you can imagine, testing forced-restarts includes some inherent inconvenience).

A trick I stumbled on is to first launch Terminal and elevate to root prior to testing. With an elevated Terminal, you’ll first be prompted for confirmation to forcibly quit Terminal, which you can cancel and continue testing.

Note: In Setup Your Mac (1.7.0 or later), the default completion actions now leverage the shutdown binary which negates this trick; toggle code comments as required:

"Restart Attended" )
    updateScriptLog "Restart, requiring user-interaction"
    killProcess "Self Service"
    wait
    # runAsUser osascript -e 'tell app "System Events" to restart'
    # sleep 5 && runAsUser osascript -e 'tell app "System Events" to restart' &
    sleep 5 && shutdown -r now &
    ;;

Unexpected Computer Inventory Delay

While testing via Terminal, you may observe the Computer Inventory step taking longer than expected.

Type Command k to quit the active dialog and you may find Terminal is requesting access to any number of user-specific items.

After responding to each access request, proceed with your testing.

Video

Organizations which do not need to capture any user input can display a video by specifying video for welcomeDialog (Parameter 6).

Note: When welcomeDialog (Parameter 6) is set to video or false, the “catch-all” policyJSON will be used in the Setup Your Mac dialog.

* ) # Catch-all (i.e., used when `welcomeDialog` is set to `video` or `false`)

    policyJSON='
    {
        "steps": [
            {

User Input

Specify userInput for welcomeDialog (Parameter 6) to capture user input.

The input fields in the “Welcome” dialog are controlled by a single welcomeJSON variable (thanks to Bart Reardon) and you can add, modify or remove fields as required.

####################################################################################################
#
# Welcome dialog
#
####################################################################################################

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# "Welcome" dialog Title, Message and Icon
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

welcomeTitle="Happy $( date +'%A' ), ${loggedInUserFirstname} and welcome to your new Mac!"
welcomeMessage="Please enter your Mac's **Asset Tag**, select your preferred **Configuration** then click **Continue** to start applying settings to your new Mac.  \n\nOnce completed, the **Wait** button will be enabled and you'll be able to review the results before restarting your Mac.  \n\nIf you need assistance, please contact the Help Desk: +1 (801) 555-1212.  \n\n---  \n\n#### Configurations  \n- **Required:** Minimum organization apps  \n- **Recommended:** Required apps and Microsoft Office  \n- **Complete:** Recommended apps, Adobe Acrobat Reader and Google Chrome"
welcomeBannerImage="https://img.freepik.com/free-photo/yellow-watercolor-paper_95678-446.jpg"
welcomeBannerText="Happy $( date +'%A' ), ${loggedInUserFirstname} and welcome to your new Mac!"
welcomeCaption="Please review the above video, then click Continue."
welcomeVideoID="vimeoid=803933536"

# Welcome icon set to either light or dark, based on user's Apperance setting (thanks, @mm2270!)
appleInterfaceStyle=$( /usr/bin/defaults read /Users/"${loggedInUser}"/Library/Preferences/.GlobalPreferences.plist AppleInterfaceStyle 2>&1 )
if [[ "${appleInterfaceStyle}" == "Dark" ]]; then
    welcomeIcon="https://cdn-icons-png.flaticon.com/512/740/740878.png"
else
    welcomeIcon="https://cdn-icons-png.flaticon.com/512/979/979585.png"
fi



# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# "Welcome" Video Settings and Features
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

welcomeVideo="--title \"$welcomeTitle\" \
--videocaption \"$welcomeCaption\" \
--video \"$welcomeVideoID\" \
--infotext \"$scriptVersion\" \
--button1text \"Continue …\" \
--autoplay \
--moveable \
--ontop \
--width '800' \
--height '600' \
--commandfile \"$welcomeCommandFile\" "



# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# "Welcome" JSON for Capturing User Input (thanks, @bartreardon!)
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

welcomeJSON='
{
    "bannerimage" : "'"${welcomeBannerImage}"'",
    "bannertext" : "'"${welcomeBannerText}"'",
    "title" : "'"${welcomeTitle}"'",
    "message" : "'"${welcomeMessage}"'",
    "icon" : "'"${welcomeIcon}"'",
    "iconsize" : "198.0",
    "button1text" : "Continue",
    "button2text" : "Quit",
    "infotext" : "'"${scriptVersion}"'",
    "blurscreen" : "true",
    "ontop" : "true",
    "titlefont" : "shadow=true, size=28",
    "messagefont" : "size=14",
    "textfield" : [
        {   "title" : "Computer Name",
            "required" : false,
            "prompt" : "Computer Name"
        },
        {   "title" : "User Name",
            "required" : false,
            "prompt" : "User Name"
        },
        {   "title" : "Asset Tag",
            "required" : true,
            "prompt" : "Please enter the seven-digit Asset Tag",
            "regex" : "^(AP|IP|CD)?[0-9]{7,}$",
            "regexerror" : "Please enter (at least) seven digits for the Asset Tag, optionally preceed by either AP, IP or CD."
        }
    ],
    "selectitems" : [
        {   "title" : "Configuration",
            "default" : "Required",
            "values" : [
                "Required",
                "Recommended",
                "Complete"
            ]
        },  
        {   "title" : "Department",
            "default" : "Please select your department",
            "values" : [
                "Please select your department",
                "Asset Management",
                "Australia Area Office",
                "Board of Directors",
                "Business Development",
                "Corporate Communications",
                "Creative Services",
                "Customer Service / Customer Experience",
                "Engineering",
                "Finance / Accounting",
                "General Management",
                "Human Resources",
                "Information Technology / Technology",
                "Investor Relations",
                "Legal",
                "Marketing",
                "Operations",
                "Product Management",
                "Production",
                "Project Management Office",
                "Purchasing / Sourcing",
                "Quality Assurance",
                "Risk Management",
                "Sales",
                "Strategic Initiatives & Programs",
                "Technology"
            ]
        }
    ],
    "height" : "725"
}
'

The processing of user input is handled later in the script and will most likely require additional customization, which, again, should be thoroughly tested before being deployed in production (i.e., see code comments UNTESTED, UNSUPPORTED "YOYO" EXAMPLE):

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# Display Welcome dialog
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

if [[ "${welcomeDialog}" == "video" ]]; then

    updateScriptLog "WELCOME DIALOG: Displaying "
    eval "${dialogBinary} --args ${welcomeVideo}"

    # Output Line Number in `verbose` Debug Mode
    if [[ "${debugMode}" == "verbose" ]]; then updateScriptLog "WELCOME DIALOG: # # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. ${LINENO} # # #" ; fi
    symConfiguration="Catch-all (video)"
    policyJSONConfiguration

    eval "${dialogSetupYourMacCMD[*]}" & sleep 0.3
    dialogSetupYourMacProcessID=$!
    until pgrep -q -x "Dialog"; do
        # Output Line Number in `verbose` Debug Mode
        if [[ "${debugMode}" == "verbose" ]]; then updateScriptLog "# # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. ${LINENO} # # #" ; fi
        updateScriptLog "WELCOME DIALOG: Waiting to display 'Setup Your Mac' dialog; pausing"
        sleep 0.5
    done
    updateScriptLog "WELCOME DIALOG: 'Setup Your Mac' dialog displayed; ensure it's the front-most app"
    runAsUser osascript -e 'tell application "Dialog" to activate'

elif [[ "${welcomeDialog}" == "userInput" ]]; then

    # Output Line Number in `verbose` Debug Mode
    if [[ "${debugMode}" == "verbose" ]]; then updateScriptLog "# # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. ${LINENO} # # #" ; fi

    # Write Welcome JSON to disk
    echo "$welcomeJSON" > "$welcomeCommandFile"

    welcomeResults=$( eval "${dialogApp} --jsonfile ${welcomeCommandFile} --json" )

    if [[ -z "${welcomeResults}" ]]; then
        welcomeReturnCode="2"
    else
        welcomeReturnCode="0"
    fi

    case "${welcomeReturnCode}" in

        0)  # Process exit code 0 scenario here
            updateScriptLog "WELCOME DIALOG: ${loggedInUser} entered information and clicked Continue"

            ###
            # Extract the various values from the welcomeResults JSON
            ###

            computerName=$(get_json_value_welcomeDialog "$welcomeResults" "Computer Name")
            userName=$(get_json_value_welcomeDialog "$welcomeResults" "User Name")
            assetTag=$(get_json_value_welcomeDialog "$welcomeResults" "Asset Tag")
            symConfiguration=$(get_json_value_welcomeDialog "$welcomeResults" "Configuration" "selectedValue")
            department=$(get_json_value_welcomeDialog "$welcomeResults" "Department" "selectedValue")



            ###
            # Output the various values from the welcomeResults JSON to the log file
            ###

            updateScriptLog "WELCOME DIALOG: • Computer Name: $computerName"
            updateScriptLog "WELCOME DIALOG: • User Name: $userName"
            updateScriptLog "WELCOME DIALOG: • Asset Tag: $assetTag"
            updateScriptLog "WELCOME DIALOG: • Configuration: $symConfiguration"
            updateScriptLog "WELCOME DIALOG: • Department: $department"



            ###
            # Select `policyJSON` based on selected Configuration
            ###

            policyJSONConfiguration



            ###
            # Evaluate Various User Input
            ###

            # Computer Name
            if [[ -n "${computerName}" ]]; then

                # UNTESTED, UNSUPPORTED "YOYO" EXAMPLE
                updateScriptLog "WELCOME DIALOG: Set Computer Name …"
                currentComputerName=$( scutil --get ComputerName )
                currentLocalHostName=$( scutil --get LocalHostName )

                # Sets LocalHostName to a maximum of 15 characters, comprised of first eight characters of the computer's
                # serial number and the last six characters of the client's MAC address
                firstEightSerialNumber=$( system_profiler SPHardwareDataType | awk '/Serial\ Number\ \(system\)/ {print $NF}' | cut -c 1-8 )
                lastSixMAC=$( ifconfig en0 | awk '/ether/ {print $2}' | sed 's/://g' | cut -c 7-12 )
                newLocalHostName=${firstEightSerialNumber}-${lastSixMAC}

                if [[ "${debugMode}" == "true" ]] || [[ "${debugMode}" == "verbose" ]] ; then

                    updateScriptLog "WELCOME DIALOG: DEBUG MODE: Would have renamed computer from: \"${currentComputerName}\" to \"${computerName}\" "
                    updateScriptLog "WELCOME DIALOG: DEBUG MODE: Would have renamed LocalHostName from: \"${currentLocalHostName}\" to \"${newLocalHostName}\" "

                else

                    # Set the Computer Name to the user-entered value
                    scutil --set ComputerName "${computerName}"

                    # Set the LocalHostName to `newLocalHostName`
                    scutil --set LocalHostName "${newLocalHostName}"

                    # Delay required to reflect change …
                    # … side-effect is a delay in the "Setup Your Mac" dialog appearing
                    sleep 5
                    updateScriptLog "WELCOME DIALOG: Renamed computer from: \"${currentComputerName}\" to \"$( scutil --get ComputerName )\" "
                    updateScriptLog "WELCOME DIALOG: Renamed LocalHostName from: \"${currentLocalHostName}\" to \"$( scutil --get LocalHostName )\" "

                fi

            else

                updateScriptLog "WELCOME DIALOG: ${loggedInUser} did NOT specify a new computer name"
                updateScriptLog "WELCOME DIALOG: • Current Computer Name: \"$( scutil --get ComputerName )\" "
                updateScriptLog "WELCOME DIALOG: • Current Local Host Name: \"$( scutil --get LocalHostName )\" "

            fi

            # User Name
            if [[ -n "${userName}" ]]; then
                # UNTESTED, UNSUPPORTED "YOYO" EXAMPLE
                reconOptions+="-endUsername \"${userName}\" "
            fi

            # Asset Tag
            if [[ -n "${assetTag}" ]]; then
                reconOptions+="-assetTag \"${assetTag}\" "
            fi

            # Department
            if [[ -n "${department}" ]]; then
                # UNTESTED, UNSUPPORTED "YOYO" EXAMPLE
                reconOptions+="-department \"${department}\" "
            fi

            # Output `recon` options to log
            updateScriptLog "WELCOME DIALOG: reconOptions: ${reconOptions}"

            ###
            # Display "Setup Your Mac" dialog (and capture Process ID)
            ###

            eval "${dialogSetupYourMacCMD[*]}" & sleep 0.3
            dialogSetupYourMacProcessID=$!
            until pgrep -q -x "Dialog"; do
                # Output Line Number in `verbose` Debug Mode
                if [[ "${debugMode}" == "verbose" ]]; then updateScriptLog "# # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. ${LINENO} # # #" ; fi
                updateScriptLog "WELCOME DIALOG: Waiting to display 'Setup Your Mac' dialog; pausing"
                sleep 0.5
            done
            updateScriptLog "WELCOME DIALOG: 'Setup Your Mac' dialog displayed; ensure it's the front-most app"
            runAsUser osascript -e 'tell application "Dialog" to activate'
            ;;

        2)  # Process exit code 2 scenario here
            updateScriptLog "WELCOME DIALOG: ${loggedInUser} clicked Quit at Welcome dialog"
            completionActionOption="Quit"
            quitScript "1"
            ;;

        3)  # Process exit code 3 scenario here
            updateScriptLog "WELCOME DIALOG: ${loggedInUser} clicked infobutton"
            osascript -e "set Volume 3"
            afplay /System/Library/Sounds/Glass.aiff
            ;;

        4)  # Process exit code 4 scenario here
            updateScriptLog "WELCOME DIALOG: ${loggedInUser} allowed timer to expire"
            quitScript "1"
            ;;

        *)  # Catch all processing
            updateScriptLog "WELCOME DIALOG: Something else happened; Exit code: ${welcomeReturnCode}"
            quitScript "1"
            ;;

    esac

else

    ###
    # Select "Catch-all" policyJSON 
    ###

    # Output Line Number in `verbose` Debug Mode
    if [[ "${debugMode}" == "verbose" ]]; then updateScriptLog "WELCOME DIALOG: # # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. ${LINENO} # # #" ; fi
    symConfiguration="Catch-all ('Welcome' dialog disabled)"
    policyJSONConfiguration



    ###
    # Display "Setup Your Mac" dialog (and capture Process ID)
    ###

    eval "${dialogSetupYourMacCMD[*]}" & sleep 0.3
    dialogSetupYourMacProcessID=$!
    until pgrep -q -x "Dialog"; do
        # Output Line Number in `verbose` Debug Mode
        if [[ "${debugMode}" == "verbose" ]]; then updateScriptLog "# # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. ${LINENO} # # #" ; fi
        updateScriptLog "WELCOME DIALOG: Waiting to display 'Setup Your Mac' dialog; pausing"
        sleep 0.5
    done
    updateScriptLog "WELCOME DIALOG: 'Setup Your Mac' dialog displayed; ensure it's the front-most app"
    runAsUser osascript -e 'tell application "Dialog" to activate'

fi

Review the default Setup Your Mac dialog.

The list of Jamf Pro policies to be executed is controlled by one of four policyJSON variables (with special thanks to smithjw, drtaru and wakco):

• Required
• Recommended
• Complete
• Catch-all

First, configure the setupYourMacPolicyArrayIconPrefixUrl to the fully qualified domain name of the server which hosts your icons, including any required sub-directories. (See Jamf’s Cloud Services Connection: Icon Service.)

Next, for each Configuration-specific policyJSON, specify:

• listitem: The text to be displayed in the list
• icon: The hash of the icon to be displayed
• progresstext: The text to be displayed below the progress bar
• trigger: The Jamf Pro Policy Custom Event Name
  • Note: The Setup Your Mac recon trigger — which must use a validation of None — executes jamf recon and should be included at least once in each policyJSON to perform the actual computer inventory update with your Jamf Pro server for user-provided information (i.e., Computer Name, Asset Tag, Department, etc.)
• validation:
  • {absolute path} (simulates pre-1.6.0 behavior, for example:
    "/Applications/Microsoft Teams.app/Contents/Info.plist")
  • Local (for validation within the Setup Your Mac script, for example: "filevault")
  • Remote (for validation via a single-script Jamf Pro policy, for example: "symvGlobalProtect")
  • None (for triggers which don’t require validation, for example: recon; always evaluates as successful)

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# "Setup Your Mac" policies to execute (Thanks, Obi-@smithjw!)
#
# For each configuration step, specify:
# - listitem: The text to be displayed in the list
# - icon: The hash of the icon to be displayed on the left
#   - See: https://vimeo.com/772998915
# - progresstext: The text to be displayed below the progress bar
# - trigger: The Jamf Pro Policy Custom Event Name
# - validation: [ {absolute path} | Local | Remote | None ]
#   See: https://snelson.us/2023/01/setup-your-mac-validation/
#       - {absolute path} (simulates pre-v1.6.0 behavior, for example: "/Applications/Microsoft Teams.app/Contents/Info.plist")
#       - Local (for validation within this script, for example: "filevault")
#       - Remote (for validation via a single-script Jamf Pro policy, for example: "symvGlobalProtect")
#       - None (for triggers which don't require validation, for example: recon; always evaluates as successful)
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# Thanks, @wakco: If you would prefer to get your policyJSON externally replace it with:
#  - policyJSON="$(cat /path/to/file.json)" # For getting from a file, replacing /path/to/file.json with the path to your file, or
#  - policyJSON="$(curl -sL https://server.name/jsonquery)" # For a URL, replacing https://server.name/jsonquery with the URL of your file.
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# Thanks, @astrugatch: I added this line to global variables:
# jsonURL=${10} # URL Hosting JSON for policy_array
#
# And this line replaces the entirety of the policy_array (~ line 503):
# policy_array=("$(curl -sL $jsonURL)")
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# shellcheck disable=SC1112 # use literal slanted single quotes for typographic reasons
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# The fully qualified domain name of the server which hosts your icons, including any required sub-directories
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

setupYourMacPolicyArrayIconPrefixUrl="https://ics.services.jamfcloud.com/icon/hash_"



# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# Select `policyJSON` based on Configuration selected in "Welcome" dialog (thanks, @drtaru!)
# shellcheck disable=SC1112 # use literal slanted single quotes for typographic reasons
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

function policyJSONConfiguration() {

    # Output Line Number in `verbose` Debug Mode
    if [[ "${debugMode}" == "verbose" ]]; then updateScriptLog "WELCOME DIALOG: # # # SETUP YOUR MAC VERBOSE DEBUG MODE: Line No. ${LINENO} # # #" ; fi

    updateScriptLog "WELCOME DIALOG: PolicyJSON Configuration: $symConfiguration"

    case ${symConfiguration} in

        "Required" )

            policyJSON='
            {
                "steps": [
                    {
                        "listitem": "Rosetta",
                        "icon": "8bac19160fabb0c8e7bac97b37b51d2ac8f38b7100b6357642d9505645d37b52",
                        "progresstext": "Rosetta enables a Mac with Apple silicon to use apps built for a Mac with an Intel processor.",
                        "trigger_list": [
                            {
                                "trigger": "rosettaInstall",
                                "validation": "None"
                            },
                            {
                                "trigger": "rosetta",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "FileVault Disk Encryption",
                        "icon": "f9ba35bd55488783456d64ec73372f029560531ca10dfa0e8154a46d7732b913",
                        "progresstext": "FileVault is built-in to macOS and provides full-disk encryption to help prevent unauthorized access to your Mac.",
                        "trigger_list": [
                            {
                                "trigger": "filevault",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint",
                        "icon": "c70f1acf8c96b99568fec83e165d2a534d111b0510fb561a283d32aa5b01c60c",
                        "progresstext": "You’ll enjoy next-gen protection with Sophos Endpoint which doesn’t rely on signatures to catch malware.",
                        "trigger_list": [
                            {
                                "trigger": "sophosEndpoint",
                                "validation": "/Applications/Sophos/Sophos Endpoint.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint Services (Remote)",
                        "icon": "c05d087189f0b25a94f02eeb43b0c5c928e5e378f2168f603554bce2b5c71209",
                        "progresstext": "Remotely validating Sophos Endpoint services …",
                        "trigger_list": [
                            {
                                "trigger": "symvSophosEndpointRTS",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect",
                        "icon": "ea794c5a1850e735179c7c60919e3b51ed3ed2b301fe3f0f27ad5ebd394a2e4b",
                        "progresstext": "Use Palo Alto GlobalProtect to establish a Virtual Private Network (VPN) connection to Church headquarters.",
                        "trigger_list": [
                            {
                                "trigger": "globalProtect",
                                "validation": "/Applications/GlobalProtect.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect Services (Remote)",
                        "icon": "709e8bdf0019e8faf9df85ec0a68545bfdb8bfa1227ac9bed9bba40a1fa8ff42",
                        "progresstext": "Remotely validating Palo Alto GlobalProtect services …",
                        "trigger_list": [
                            {
                                "trigger": "symvGlobalProtect",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Final Configuration",
                        "icon": "4723e3e341a7e11e6881e418cf91b157fcc081bdb8948697750e5da3562df728",
                        "progresstext": "Finalizing Configuration …",
                        "trigger_list": [
                            {
                                "trigger": "finalConfiguration",
                                "validation": "None"
                            },
                            {
                                "trigger": "reconAtReboot",
                                "validation": "None"
                            }
                        ]
                    },
                    {
                        "listitem": "Computer Inventory",
                        "icon": "ff2147a6c09f5ef73d1c4406d00346811a9c64c0b6b7f36eb52fcb44943d26f9",
                        "progresstext": "A listing of your Mac’s apps and settings — its inventory — is sent automatically to the Jamf Pro server daily.",
                        "trigger_list": [
                            {
                                "trigger": "recon",
                                "validation": "None"
                            }
                        ]
                    }
                ]
            }
            '
            ;;

        "Recommended" )

            policyJSON='
            {
                "steps": [
                    {
                        "listitem": "Rosetta",
                        "icon": "8bac19160fabb0c8e7bac97b37b51d2ac8f38b7100b6357642d9505645d37b52",
                        "progresstext": "Rosetta enables a Mac with Apple silicon to use apps built for a Mac with an Intel processor.",
                        "trigger_list": [
                            {
                                "trigger": "rosettaInstall",
                                "validation": "None"
                            },
                            {
                                "trigger": "rosetta",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "FileVault Disk Encryption",
                        "icon": "f9ba35bd55488783456d64ec73372f029560531ca10dfa0e8154a46d7732b913",
                        "progresstext": "FileVault is built-in to macOS and provides full-disk encryption to help prevent unauthorized access to your Mac.",
                        "trigger_list": [
                            {
                                "trigger": "filevault",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint",
                        "icon": "c70f1acf8c96b99568fec83e165d2a534d111b0510fb561a283d32aa5b01c60c",
                        "progresstext": "You’ll enjoy next-gen protection with Sophos Endpoint which doesn’t rely on signatures to catch malware.",
                        "trigger_list": [
                            {
                                "trigger": "sophosEndpoint",
                                "validation": "/Applications/Sophos/Sophos Endpoint.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint Services (Local)",
                        "icon": "c05d087189f0b25a94f02eeb43b0c5c928e5e378f2168f603554bce2b5c71209",
                        "progresstext": "Locally validating Sophos Endpoint services …",
                        "trigger_list": [
                            {
                                "trigger": "sophosEndpointServices",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect",
                        "icon": "ea794c5a1850e735179c7c60919e3b51ed3ed2b301fe3f0f27ad5ebd394a2e4b",
                        "progresstext": "Use Palo Alto GlobalProtect to establish a Virtual Private Network (VPN) connection to Church headquarters.",
                        "trigger_list": [
                            {
                                "trigger": "globalProtect",
                                "validation": "/Applications/GlobalProtect.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect Services (Local)",
                        "icon": "709e8bdf0019e8faf9df85ec0a68545bfdb8bfa1227ac9bed9bba40a1fa8ff42",
                        "progresstext": "Locally validating Palo Alto GlobalProtect services …",
                        "trigger_list": [
                            {
                                "trigger": "globalProtect",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Microsoft Office 365",
                        "icon": "10e2ebed512e443189badcaf9143293d447f4a3fd8562cd419f6666ca07eb775",
                        "progresstext": "Microsoft Office 365 for Mac gives you the essentials to get it all done with the classic versions of the Office applications.",
                        "trigger_list": [
                            {
                                "trigger": "microsoftOffice365",
                                "validation": "/Applications/Microsoft Outlook.app/Contents/Info.plist"
                            },
                            {
                                "trigger": "symvMicrosoftOffice365",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Microsoft Teams",
                        "icon": "dcb65709dba6cffa90a5eeaa54cb548d5ecc3b051f39feadd39e02744f37c19e",
                        "progresstext": "Microsoft Teams is a hub for teamwork in Office 365. Keep all your team’s chats, meetings and files together in one place.",
                        "trigger_list": [
                            {
                                "trigger": "microsoftTeams",
                                "validation": "/Applications/Microsoft Teams.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Final Configuration",
                        "icon": "4723e3e341a7e11e6881e418cf91b157fcc081bdb8948697750e5da3562df728",
                        "progresstext": "Finalizing Configuration …",
                        "trigger_list": [
                            {
                                "trigger": "finalConfiguration",
                                "validation": "None"
                            },
                            {
                                "trigger": "reconAtReboot",
                                "validation": "None"
                            }
                        ]
                    },
                    {
                        "listitem": "Computer Inventory",
                        "icon": "ff2147a6c09f5ef73d1c4406d00346811a9c64c0b6b7f36eb52fcb44943d26f9",
                        "progresstext": "A listing of your Mac’s apps and settings — its inventory — is sent automatically to the Jamf Pro server daily.",
                        "trigger_list": [
                            {
                                "trigger": "recon",
                                "validation": "None"
                            }
                        ]
                    }
                ]
            }
            '
            ;;

        "Complete" )

            policyJSON='
            {
                "steps": [
                    {
                        "listitem": "Rosetta",
                        "icon": "8bac19160fabb0c8e7bac97b37b51d2ac8f38b7100b6357642d9505645d37b52",
                        "progresstext": "Rosetta enables a Mac with Apple silicon to use apps built for a Mac with an Intel processor.",
                        "trigger_list": [
                            {
                                "trigger": "rosettaInstall",
                                "validation": "None"
                            },
                            {
                                "trigger": "rosetta",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "FileVault Disk Encryption",
                        "icon": "f9ba35bd55488783456d64ec73372f029560531ca10dfa0e8154a46d7732b913",
                        "progresstext": "FileVault is built-in to macOS and provides full-disk encryption to help prevent unauthorized access to your Mac.",
                        "trigger_list": [
                            {
                                "trigger": "filevault",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint",
                        "icon": "c70f1acf8c96b99568fec83e165d2a534d111b0510fb561a283d32aa5b01c60c",
                        "progresstext": "You’ll enjoy next-gen protection with Sophos Endpoint which doesn’t rely on signatures to catch malware.",
                        "trigger_list": [
                            {
                                "trigger": "sophosEndpoint",
                                "validation": "/Applications/Sophos/Sophos Endpoint.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint Services (Local)",
                        "icon": "c05d087189f0b25a94f02eeb43b0c5c928e5e378f2168f603554bce2b5c71209",
                        "progresstext": "Locally validating Sophos Endpoint services …",
                        "trigger_list": [
                            {
                                "trigger": "sophosEndpointServices",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint Services (Remote)",
                        "icon": "c05d087189f0b25a94f02eeb43b0c5c928e5e378f2168f603554bce2b5c71209",
                        "progresstext": "Remotely validating Sophos Endpoint services …",
                        "trigger_list": [
                            {
                                "trigger": "symvSophosEndpointRTS",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect",
                        "icon": "ea794c5a1850e735179c7c60919e3b51ed3ed2b301fe3f0f27ad5ebd394a2e4b",
                        "progresstext": "Use Palo Alto GlobalProtect to establish a Virtual Private Network (VPN) connection to Church headquarters.",
                        "trigger_list": [
                            {
                                "trigger": "globalProtect",
                                "validation": "/Applications/GlobalProtect.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect Services (Local)",
                        "icon": "709e8bdf0019e8faf9df85ec0a68545bfdb8bfa1227ac9bed9bba40a1fa8ff42",
                        "progresstext": "Locally validating Palo Alto GlobalProtect services …",
                        "trigger_list": [
                            {
                                "trigger": "globalProtect",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect Services (Remote)",
                        "icon": "709e8bdf0019e8faf9df85ec0a68545bfdb8bfa1227ac9bed9bba40a1fa8ff42",
                        "progresstext": "Remotely validating Palo Alto GlobalProtect services …",
                        "trigger_list": [
                            {
                                "trigger": "symvGlobalProtect",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Microsoft Office 365",
                        "icon": "10e2ebed512e443189badcaf9143293d447f4a3fd8562cd419f6666ca07eb775",
                        "progresstext": "Microsoft Office 365 for Mac gives you the essentials to get it all done with the classic versions of the Office applications.",
                        "trigger_list": [
                            {
                                "trigger": "microsoftOffice365",
                                "validation": "/Applications/Microsoft Outlook.app/Contents/Info.plist"
                            },
                            {
                                "trigger": "symvMicrosoftOffice365",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Microsoft Teams",
                        "icon": "dcb65709dba6cffa90a5eeaa54cb548d5ecc3b051f39feadd39e02744f37c19e",
                        "progresstext": "Microsoft Teams is a hub for teamwork in Office 365. Keep all your team’s chats, meetings and files together in one place.",
                        "trigger_list": [
                            {
                                "trigger": "microsoftTeams",
                                "validation": "/Applications/Microsoft Teams.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Adobe Acrobat Reader",
                        "icon": "988b669ca27eab93a9bcd53bb7e2873fb98be4eaa95ae8974c14d611bea1d95f",
                        "progresstext": "Views, prints, and comments on PDF documents, and connects to Adobe Document Cloud.",
                        "trigger_list": [
                            {
                                "trigger": "adobeAcrobatReader",
                                "validation": "/Applications/Adobe Acrobat Reader.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Google Chrome",
                        "icon": "12d3d198f40ab2ac237cff3b5cb05b09f7f26966d6dffba780e4d4e5325cc701",
                        "progresstext": "Google Chrome is a browser that combines a minimal design with sophisticated technology to make the Web faster.",
                        "trigger_list": [
                            {
                                "trigger": "googleChrome",
                                "validation": "/Applications/Google Chrome.app/Contents/Info.plist"
                            }
                        ]
                    },
                    {
                        "listitem": "Final Configuration",
                        "icon": "4723e3e341a7e11e6881e418cf91b157fcc081bdb8948697750e5da3562df728",
                        "progresstext": "Finalizing Configuration …",
                        "trigger_list": [
                            {
                                "trigger": "finalConfiguration",
                                "validation": "None"
                            },
                            {
                                "trigger": "reconAtReboot",
                                "validation": "None"
                            }
                        ]
                    },
                    {
                        "listitem": "Computer Inventory",
                        "icon": "ff2147a6c09f5ef73d1c4406d00346811a9c64c0b6b7f36eb52fcb44943d26f9",
                        "progresstext": "A listing of your Mac’s apps and settings — its inventory — is sent automatically to the Jamf Pro server daily.",
                        "trigger_list": [
                            {
                                "trigger": "recon",
                                "validation": "None"
                            }
                        ]
                    }
                ]
            }
            '
            ;;

        * ) # Catch-all (i.e., used when `welcomeDialog` is set to `video` or `false`)

            policyJSON='
            {
                "steps": [
                    {
                        "listitem": "Rosetta",
                        "icon": "8bac19160fabb0c8e7bac97b37b51d2ac8f38b7100b6357642d9505645d37b52",
                        "progresstext": "Rosetta enables a Mac with Apple silicon to use apps built for a Mac with an Intel processor.",
                        "trigger_list": [
                            {
                                "trigger": "rosettaInstall",
                                "validation": "None"
                            },
                            {
                                "trigger": "rosetta",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "FileVault Disk Encryption",
                        "icon": "f9ba35bd55488783456d64ec73372f029560531ca10dfa0e8154a46d7732b913",
                        "progresstext": "FileVault is built-in to macOS and provides full-disk encryption to help prevent unauthorized access to your Mac.",
                        "trigger_list": [
                            {
                                "trigger": "filevault",
                                "validation": "Local"
                            }
                        ]
                    },
                    {
                        "listitem": "Sophos Endpoint",
                        "icon": "c70f1acf8c96b99568fec83e165d2a534d111b0510fb561a283d32aa5b01c60c",
                        "progresstext": "You’ll enjoy next-gen protection with Sophos Endpoint which doesn’t rely on signatures to catch malware.",
                        "trigger_list": [
                            {
                                "trigger": "sophosEndpoint",
                                "validation": "/Applications/Sophos/Sophos Endpoint.app/Contents/Info.plist"
                            },
                            {
                                "trigger": "symvSophosEndpointRTS",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Palo Alto GlobalProtect",
                        "icon": "ea794c5a1850e735179c7c60919e3b51ed3ed2b301fe3f0f27ad5ebd394a2e4b",
                        "progresstext": "Use Palo Alto GlobalProtect to establish a Virtual Private Network (VPN) connection to Church headquarters.",
                        "trigger_list": [
                            {
                                "trigger": "globalProtect",
                                "validation": "/Applications/GlobalProtect.app/Contents/Info.plist"
                            },
                            {
                                "trigger": "symvGlobalProtect",
                                "validation": "Remote"
                            }
                        ]
                    },
                    {
                        "listitem": "Final Configuration",
                        "icon": "4723e3e341a7e11e6881e418cf91b157fcc081bdb8948697750e5da3562df728",
                        "progresstext": "Finalizing Configuration …",
                        "trigger_list": [
                            {
                                "trigger": "finalConfiguration",
                                "validation": "None"
                            },
                            {
                                "trigger": "reconAtReboot",
                                "validation": "None"
                            }
                        ]
                    },
                    {
                        "listitem": "Computer Inventory",
                        "icon": "ff2147a6c09f5ef73d1c4406d00346811a9c64c0b6b7f36eb52fcb44943d26f9",
                        "progresstext": "A listing of your Mac’s apps and settings — its inventory — is sent automatically to the Jamf Pro server daily.",
                        "trigger_list": [
                            {
                                "trigger": "recon",
                                "validation": "None"
                            }
                        ]
                    }
                ]
            }
            '
            ;;

    esac

}

After adding Custom Events to your Jamf Pro Policies as required, use your favorite editor to modify ~/Downloads/Setup-Your-Mac-via-Dialog-reference.bash for your environment:

1. “Welcome” dialog
   1. “Welcome” dialog Title, Message, Banner Image, Banner Text, Caption, Video ID and Icon
   2. “Welcome” JSON
2. “Setup Your Mac” dialog
   1. “Setup Your Mac” dialog Title, Message, Overlay Icon, Banner Image, Banner Text, Help Message, Infobox and Icon
   2. “Setup Your Mac” dialog Settings and Features
   3. “Setup Your Mac” policies to execute
      1. setupYourMacPolicyArrayIconPrefixUrl (i.e., the fully qualified domain name of the server which hosts your icons, including any required sub-directories; see Jamf’s Cloud Services Connection: Icon Service.)
      2. Configuration-specific policyJSON variables (i.e., Required, Recommended, Complete and Catch-all)
         • listitem: The text to be displayed in the list
         • icon: The hash of the icon to be displayed on the left
         • progresstext: The text to be displayed below the progress bar
         • trigger: The Jamf Pro Policy Custom Event Name
           • Note: The Setup Your Mac recon trigger — which must use a validation of None — executes jamf recon and should be included at least once in each policyJSON to perform the actual computer inventory update with your Jamf Pro server for user-provided information (i.e., Computer Name, Asset Tag, Department, etc.)
         • validation: [ {absolute path} | Local | Remote | None ]
         • Note: You can validate the JSON by copying everything between the beginning and ending curly braces { … } and pasting at jsonlint.com
3. “Failure” dialog
   • “Failure” dialog Title, Message and Icon
   • “Failure” dialog Settings and Features

4. finalise function
   • dialogUpdateSetupYourMac "title: Sorry ${loggedInUserFirstname}, something went sideways"
   • dialogUpdateFailure "message: A failure has been detected, ${loggedInUserFirstname}.

1. Add your customized script to your Jamf Pro server
2. Specify the following for Options > Parameter Labels
   • Parameter 4: Script Log Location [ /var/log/org.churchofjesuschrist.log ] (i.e., Your organization's default location for client-side logs)
   • Parameter 5: Debug Mode [ verbose (default) | true | false ]
   • Parameter 6: Welcome dialog [ userInput (default) | video | false ]
   • Parameter 7: Completion Action [ wait | sleep (with seconds) | Shut Down | Shut Down Attended | Shut Down Confirm | Restart | Restart Attended (default) | Restart Confirm | Log Out | Log Out Attended | Log Out Confirm ]
   • Parameter 8: Required Minimum Build [ disabled (default) | 22E ] (i.e., Your organization's required minimum build of macOS to allow users to proceed; use "22E" for macOS 13.3)
   • Parameter 9: Outdated OS Action [ /System/Library/CoreServices/Software Update.app (default) | jamfselfservice://content?entity=policy&id=117&action=view ] (i.e., Jamf Pro Self Service policy ID for operating system ugprades)
3. Click Save

Completion Actions (Parameter 7)

In addition to the previous wait and sleep options, Setup Your Mac (1.4.0) introduced the following Completion Action options:

Dynamic Button Label & Progress Text

Additionally, the label for the default button, button1text, and the message below the progress bar, progresstext, are dynamically updated based on the specified Completion Action:

Required Minimum Build (Parameter 8)

Help mitigate zero-day attacks by specifying a minimum OS build before Setup Your Mac can be completed.

In the following example, the operating system of the testing computer is older than macOS 13.2 (22D49), and the user observes an error message to update:

Use the following table as a guide to determine your organization’s preferred value for Required Minimum Build:

Outdated OS Action (Parameter 9)

Determine what should happen when a user runs your customized Setup Your Mac policy on a computer with an outdated version of macOS (as determined by the value entered for Required Minimum Build):

Jamf Pro Policy

To open Jamf Pro’s Self Service to a specific policy:

1. Navigate to the policy in Jamf Pro
2. Click Self Service
3. Scroll down to the Policy URLs section
4. Copy the desired URL
5. Paste the copied URL in Outdated OS Action (Parameter 9)

Open Software Update

To open Software Update, enter the following for Outdated OS Action (Parameter 9):
/System/Library/CoreServices/Software Update.app

Setup Your Mac (1.7.0 and later) Outdated OS Action (01:00; no audio)

1. Create a new Jamf Pro Policy, using the following as a guide for Options > General:
   • Set Display Name to Enrollment: Setup Your Mac (1.9.0)
   • Set Execution Frequency to Ongoing
2. Select the Scripts payload and add your customized Setup Your Mac (1.9.0) via swiftDialog script, specifying the following Parameter Values
   • Script Log Location: /var/log/com.company.log
   • Debug Mode: verbose
   • Welcome dialog: userInput
   • Completion Action: Restart Attended
   • Required Minimum Build: 22E
   • Outdated OS Action: /System/Library/CoreServices/Software Update.app

3. Specify Scope as desired
   • Targets: All Computers
   • Limitations: No Limitations
   • Exclusions:
     • All Jamf Pro Compliant Computers
     • macOS 10.15.Catalina and earlier
     • Setup Your Mac: Complete
4. Use the following for Self Service
   • Self Service Display Name: Setup Your Mac (1.9.0)
   • Button Name Before Initiation: Setup
   • Button Name After Initiation: Setup
   • Icon: (download)
   • Description:

## Welcome to your new Mac!  
  
Please click **Setup** to apply Church settings to your Mac. (Once completed, your Mac will restart.). 
  
Use this app, the **Workforce App Store**, to install your Church-assigned software and to configure your Mac after inital setup.

---

## Configurations

Select your preferred configuration:

- **Required:** Minimum Church apps
- **Recommended:** Required apps and Microsoft Office
- **Complete:** Recommended apps, Adobe Acrobat Reader and Google Chrome
    
### Required: Minimum Church apps

**FileVault** is built-in to macOS and provides full-disk encryption using XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to the information on your startup disk.  
    
You'll enjoy next-gen protection with **Sophos Endpoint** which doesn’t rely on signatures to catch malware and means it catches zero-day threats without adversely affecting the performance of your device. You'll be protected before exploits even arrive.  
  
Use **Palo Alto GlobalProtect** to establish a Virtual Private Network (VPN) connection to Church headquarters.  
  
**Microsoft Teams** is a hub for teamwork in Office 365. Keep all your team’s chats, meetings, files, and apps together in one place.  
  
**Pro Tip:** By default, the listing of your computer's currently installed apps and system settings — its inventory — is automatically sent to the Jamf Pro server daily.

5. Click Save

1.9.0 (01-Apr-2023)

• Previously installed apps with a filepath validation now display “Previously Installed” (instead of a generic “Installed”; Issue No. 13; thanks for the idea, @Manikandan!)
• Allow “first name” to correctly handle names in “Lastname, Firstname” format (Pull Request No. 11; thanks @meschwartz!)
• Corrected PATH (thanks, @Theile!)
• Configuration no longer displays in SYM’s infobox when welcomeDialog is set to false or video (Addresses Issue No. 12; thanks, @Manikandan!)
• Updated icon hashes
• toggleJamfLaunchDaemon function (Pull Request No. 16; thanks, @robjschroeder!)
• Formatted policyJSON with Erik Lynd’s JSON Tools
• Corrected an issue where inventory would be submitted twice (thanks, @Manikandan!)

1.8.1 (11-Mar-2023)

• Added currentLoggedInUser function to better validate loggedInUser (Addresses Issue No. 2)
• Added new Microsoft Office 365 Remote Validation (Pull Request No. 3)
• Improved logging when welcomeDialog is video or false (Addresses Issue No. 4)
• Create overlayicon from Self Service’s custom icon (thanks, Mike Schwartz!)

1.8.0 (04-Mar-2023)

• Introduces fully customizable “Configurations” (thanks, @drtaru!)
  • Required: Minimum organizational apps (i.e., full disk encryption, endpoint security, VPN, communication tools, etc.)
  • Recommended: Required apps and Microsoft Office
  • Complete: Recommended apps, Adobe Acrobat Reader and Google Chrome
• Play video at Welcome dialog (Script Parameter 6) by specifying video (Addresses Issue No. 36)
  • ? Breaking Change for users of Setup Your Mac prior to 1.8.0 ?
    • To capture user input, welcomeDialog (Script Parameter 6) must be set to userInput
• Addresses Issue No. 39 (thanks big bunches, @wakco!)
• Addresses Issue No. 43 (thanks, @wakco)
• Removed the following from the Welcome dialog
  • Comment
  • Select B
  • Select C
• Dedicated repository

1.7.2 (28-Feb-2023)

• Reordered Pre-Flight Check to not validate OS until AFTER Setup Assistant / Finder & Dock
• Added disabled option for requiredMinimumBuild
• Added Pre-flight Check for Self Service’s brandingimage.png
• Pre-flight Check logging messages now saved client-side
• Addresses Issue No. 41

1.7.1 (07-Feb-2023)

• Addresses Issue No. 35
• Improves user-interaction with helpmessage under certain circumstances (thanks, @bartreardon!)
• Increased debugMode delay (thanks for the heads-up, @Lewis B!)
• Changed Banner Image (to something much, much smaller)

1.7.0 (01-Feb-2023)

• Adds compatibility for and leverages new features of swiftDialog 2.1.0
  • bannertext
  • helpmessage
  • infobox
  • progress-related racing-stripes (which now require swiftDialog 2.1.0+)
• Completion Actions
  • Adjusted default code option (to hopefully help Mac Admins using an Enrollment Complete trigger [i.e., runAsUser doesn’t work too well when _mbsetupuser is the logged-in user])
• Combined listitem steps for installation and validation (thanks, @roiegat!)
  • Addresses Issue No. 30
• Validate Operating System Version, Build and Outdated OS Action
  • Addresses Issue No. 31
  • Introduces the ability to specify a requiredMinimumBuild as Script Parameter 8 (thanks, @SirDrSpiderpig!)
    • For example, to only allow macOS Ventura 13.2 (or later), specify: 22D
  • Introduces Outdated OS Action
    • Open Self Service to your OS update policy: jamfselfservice://content?entity=policy&id=117&action=view
  • Open Software Update (default): /System/Library/CoreServices/Software Update.app
• Temporarily disables jamf binary check-in (thanks, @mactroll and @cube!)
  • Purposely commented-out the code to re-enable the jamf binary; presumes the Mac will be restarted
• Separated “Global Variables” from “Dialog Variables” to allow for additional Script Parameters
• Improved Pre-flight Check messaging
• Introduces verbose as an option for Debug Mode
  • Most useful when first deploying Setup Your Mac

1.6.0 (09-Jan-2023)

• Addresses Issue No. 21
  • ? Breaking Change ? (for users of Setup Your Mac prior to 1.6.0)
    • policy_array‘s path has been replaced with validation
  • ? The confirmPolicyExecution function confirms if the policy needs to be executed
  • ? The validatePolicyResult function validates if the policy succeeded and the related service is running, based on the specified validation option
  • Validation Options:
    • {absolute path} (simulates pre-1.6.0 behavior, for example: "/Applications/Microsoft Teams.app/Contents/Info.plist")
    • Local (for validation within this script, for example: "filevault")
    • Remote (for validation validation via a single-script Jamf Pro policy, for example: "symvGlobalProtect")
    • None (for triggers which don’t require validation, for example: recon; always evaluates as successful)
• Enhanced policy logging options to address Issue No. 25
  • Search for and comment-out the following (shown as Line 782):
    eval "${jamfBinary} policy -trigger ${trigger}"
  • Uncomment the following (shown as Line 783):
    eval "${jamfBinary} policy -trigger ${trigger} -verbose | tee -a ${scriptLog}"
  • Ensure debug mode is set to false
• Added Rosetta 2 policy execution and validation
• Enhanced logging
  • Addresses Issue No. 29

1.5.1 (07-Dec-2022)

• Updates to “Pre-flight Checks”
  • Moved section to start of script
  • Added additional check for Setup Assistant (for Mac Admins using an “Enrollment Complete” trigger)

1.5.0 (28-Nov-2022)

• ? Prompt user for additional fields at Welcome dialog
  • New fields are included in a single welcomeJSON variable (thanks for all your efforts and feedback, @drtaru and @iDrewbs!)
    • See welcomeScreenTesting.bash (thanks, @bartreardon!)
    • In Debug Mode, changes are logged only (thanks, @iDrewbs!)
  • Dynamic reconOptions based on user’s input at Welcome dialog
  • Thanks for your patience, @remusache, @midiman1000, @erikmadams, @colorenz, @benphilware
• ? Breaking Changes ? (for users of Setup Your Mac prior to 1.5.0)
  • Script Parameter Reordering (sorry; I’ll strive not to ever do this again)
    • Parameter 4: Script Log Location [ /var/tmp/org.churchofjesuschrist.log ]
    • Parameter 5: Debug Mode [ true (default) | false ]
    • Parameter 6: Welcome Screen [ true (default) | false ]
    • Parameter 7: Completion Action [ wait | sleep (with seconds) | Shut Down | Shut Down Attended | Shut Down Confirm | Restart | Restart Attended(default) | Restart Confirm | Log Out | Log Out Attended | Log Out Confirm ]
• Miscellaneous Improvements
  • Moved code blocks and variables to better reflect the Welcome > Setup Your Mac > Failure workflow
  • Random code clean-up

1.4.0 (21-Nov-2022)

• Significantly enhanced Completion Action options
  • ✅ Addresses Issue 15 (thanks, @mvught, @riddl0rd, @iDrewbs and @master-vodawagner)
  • ? Dynamically set button1text based on the value of completionActionOption (thanks, @jared-a-young)
  • ? Dynamically set progresstext based on the value of completionActionOption (thanks, @iDrewbs)
  • ? Three new flavors: Shut Down, Restart or Log Out
    • ? Forced: Zero user-interaction
      • Added brute-force killProcess "Self Service"
      • Added hack to allow Policy Logs to be shipped to Jamf Pro server
    • ⚠️ Attended: Forced, but only after user-interaction (thanks, @owainiorwerth)
      • Added hack to allow Policy Logs to be shipped to Jamf Pro server
    • ? Confirm: Displays built-in macOS user-dismissible dialog box
  • Sleep
  • Wait (default)
• Improved Debug Mode behavior
  • ? DEBUG MODE | now only displayed as infotext (i.e., bottom, left-hand corner)
  • completionAction informational-only with simple dialog box (thanks, @_____???)
  • Swapped blurscreen for moveable
  • General peformance increases
• Miscellaneous Improvements
  • Removed jamfDisplayMessage function and reverted dialogCheck function to use osascript (with an enhanced error message)
  • Replaced “Installing …” with “Updating …” for recon-flavored trigger
  • Changed “Updating Inventory” to “Computer Inventory” for recon-flavored listitem
  • Changed exit code to 1 when user quits “Welcome” screen
  • Changed welcomeIcon URLs
  • Changed URL for Harvesting Self Service icons screencast (thanks, @nstrauss)

1.3.0 (09-Nov-2022)

• Script Parameter Changes:
  • ⚠️ Parameter 4: debug mode enabled by default
  • ? Parameter 7: Script Log Location
• ? Embraced drastic speed improvements in ?swiftDialog v2?
• Caffeinated script (thanks, @grahampugh!)
• Enhanced wait exiting logic
• Personalized dialogs
• General script standardization

1.2.10 (05-Oct-2022)

• Modifications for swiftDialog v2 (thanks, @bartreardon!)
  • Added I/O pause to dialog_update_setup_your_mac
  • Added list: show when displaying policy_array
  • Re-ordered Setup Your Mac progress bar commands
• More specific logging for various dialog update functions
• Confirm Setup Assistant complete and user at Desktop (thanks, @ehemmete!)

1.2.9 (03-Oct-2022)

• Added setupYourMacPolicyArrayIconPrefixUrl variable (thanks for the idea, @mani2care!)
• Removed unnecessary listitem icon updates (thanks, @bartreardon!)
• Output swiftDialog version when running in debug mode
• Updated URL for Zoom icon

1.2.8 (19-Sep-2022)

• Replaced “ugly” completionAction if … then … else with “more readabale” case statement (thanks, @pyther!)
• Updated “method for determining laptop/desktop” (thanks, @acodega and @scriptingosx!)
• Additional tweaks discovered during internal production deployment

1.2.7 (10-Sep-2022)

• Added “completionAction” (Script Parameter 6) to address Pull Request No. 5
• Added “Failure” dialog to address Issue No. 6

1.2.6 (29-Aug-2022)

• Adjust I/O timing (for policy_array loop)

1.2.5 (24-Aug-2022)

• Resolves #3 (thanks, @pyther!)

1.2.4 (18-Aug-2022)

• Swap “Installing …” and “Pending …” status indicators (thanks, @joncrain)

1.2.3 (15-Aug-2022)

• Updates for switftDialog v1.11.2
• Report failures in Jamf Pro Policy Triggers

1.2.2 (07-Jun-2022)

• Added “dark mode” for logo (thanks, @mm2270)
• Added “compact” for --liststyle

1.2.1 (01-Jun-2022)

• Made Asset Tag Capture optional (via Jamf Pro Script Paramter 5)

1.2.0 (30-May-2022)

• Changed --infobuttontext to --infotext
• Added regex and regexerror for Asset Tag Capture
• Replaced @adamcodega’s apps with @smithjw’s policy_array
• Added progress update
• Added filepath validation

1.1.0 (19-May-2022)

• Added initial “Welcome Screen” with Asset Tag Capture and Debug Mode

1.0.0 (30-Apr-2022)

• First “official” release