Install checks and pre/post-install scripts

#!/bin/bash
# Reports whether this Mac needs the AgenShield package. Read-only.

MODE="installcheck"
MIN_VERSION=""

APP_PATH="/Applications/AgenShield.app"
INFO_PLIST="$APP_PATH/Contents/Info.plist"
CLI_PATH="/Library/AgenShield/bin/agenshield"
BUNDLE_ID="com.frontegg.AgenShield"
TEAM_ID="3R2X6557U2"

read_app_key() {
    if [ -f "$INFO_PLIST" ]; then
        /usr/libexec/PlistBuddy -c "Print :$1" "$INFO_PLIST" 2>/dev/null
    fi
}

version_at_least() {
    local installed_base="${1%%-*}"
    local minimum_base="${2%%-*}"
    local installed_parts minimum_parts index installed_part minimum_part

    if ! [[ "$installed_base" =~ ^[0-9]+(\.[0-9]+)*$ ]]; then
        return 1
    fi
    IFS=. read -r -a installed_parts <<< "$installed_base"
    IFS=. read -r -a minimum_parts <<< "$minimum_base"
    for index in 0 1 2; do
        installed_part="${installed_parts[index]:-0}"
        minimum_part="${minimum_parts[index]:-0}"
        if [ "$installed_part" -gt "$minimum_part" ]; then
            return 0
        fi
        if [ "$installed_part" -lt "$minimum_part" ]; then
            return 1
        fi
    done
    return 0
}

detect_state() {
    local bundle_id signing_team

    if [ ! -d "$APP_PATH" ]; then
        echo "missing"
        return
    fi
    bundle_id=$(read_app_key CFBundleIdentifier)
    signing_team=$(/usr/bin/codesign -dv "$APP_PATH" 2>&1 | /usr/bin/awk -F= '/^TeamIdentifier=/ {print $2}')
    if [ "$bundle_id" != "$BUNDLE_ID" ] || [ "$signing_team" != "$TEAM_ID" ] || [ ! -x "$CLI_PATH" ]; then
        echo "damaged"
        return
    fi
    if [ -n "$MIN_VERSION" ] && ! version_at_least "$INSTALLED_VERSION" "$MIN_VERSION"; then
        echo "outdated"
        return
    fi
    echo "current"
}

INSTALLED_VERSION=$(read_app_key CFBundleShortVersionString)
STATE=$(detect_state)

case "$MODE" in
    installcheck)
        echo "AgenShield ${INSTALLED_VERSION:-not installed}: $STATE"
        if [ "$STATE" = "current" ]; then
            exit 1
        fi
        exit 0
        ;;
    audit)
        echo "AgenShield ${INSTALLED_VERSION:-not installed}: $STATE"
        if [ "$STATE" = "current" ]; then
            exit 0
        fi
        exit 1
        ;;
    attribute)
        echo "<result>$STATE</result>"
        exit 0
        ;;
    *)
        echo "Unknown MODE '$MODE': use installcheck, audit or attribute"
        exit 2
        ;;
esac

#!/bin/bash
# Refuses a Mac that cannot run AgenShield, before anything is changed. Read-only.

MIN_MACOS_MAJOR=14
MIN_FREE_MB=2048

refuse() {
    echo "AgenShield cannot be installed on this Mac: $1"
    exit 1
}

MACOS_VERSION=$(/usr/bin/sw_vers -productVersion)
if [ "${MACOS_VERSION%%.*}" -lt "$MIN_MACOS_MAJOR" ]; then
    refuse "macOS $MACOS_VERSION is older than macOS $MIN_MACOS_MAJOR"
fi

if [ "$(/usr/sbin/sysctl -n hw.optional.arm64 2>/dev/null)" != "1" ]; then
    refuse "it is not an Apple silicon Mac"
fi

FREE_MB=$(/bin/df -m /Library | /usr/bin/awk 'NR == 2 {print $4}')
if [ "$FREE_MB" -lt "$MIN_FREE_MB" ]; then
    refuse "only $FREE_MB MB free on the startup disk, $MIN_FREE_MB MB needed"
fi

echo "AgenShield can be installed: macOS $MACOS_VERSION, Apple silicon, $FREE_MB MB free"
exit 0

#!/bin/bash
# Confirms the AgenShield package landed and records its status in the MDM log. Changes nothing.

APP_PATH="/Applications/AgenShield.app"
INFO_PLIST="$APP_PATH/Contents/Info.plist"
CLI_PATH="/Library/AgenShield/bin/agenshield"
WAIT_SECONDS=90

if [ ! -f "$INFO_PLIST" ] || [ ! -x "$CLI_PATH" ]; then
    echo "AgenShield files are missing after the install"
    exit 1
fi

read_status_field() {
    local field_value
    if field_value=$(/usr/bin/plutil -extract "$1" raw -o - - <<< "$STATUS_JSON" 2>/dev/null); then
        echo "$field_value"
    fi
}

WAITED=0
while true; do
    STATUS_JSON=$("$CLI_PATH" status --json 2>/dev/null)
    VERDICT=$(read_status_field verdict)
    case "$VERDICT" in
        "" | starting | not-running) ;;
        *) break ;;
    esac
    if [ "$WAITED" -ge "$WAIT_SECONDS" ]; then
        break
    fi
    sleep 5
    WAITED=$((WAITED + 5))
done

INSTALLED_VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$INFO_PLIST" 2>/dev/null)
echo "AgenShield $INSTALLED_VERSION installed, status: ${VERDICT:-no answer}"

STATUS_DETAIL=$(read_status_field enforcement.verdictLine)
if [ -n "$STATUS_DETAIL" ]; then
    echo "$STATUS_DETAIL"
fi

FIRST_REASON=$(read_status_field reasons.0)
if [ -n "$FIRST_REASON" ]; then
    echo "Needs attention: $FIRST_REASON"
fi

case "$(/usr/bin/stat -f %Su /dev/console)" in
    root | _mbsetupuser | loginwindow)
        echo "Nobody is signed in: extension approval completes at the first sign-in"
        ;;
esac
exit 0