Incorrect pkg receipts included in the Recommended_10_4.pkg

[paul-cossey]

Hi, folks

We've been asked by one of our customers to deploy SageMath.

While looking in to it, I've noticed a couple of things that make centralised mass deployment tricky.

The pkg receipts for the bundled Recommended_10_4.pkg installer are all 1.0 and don't get bumped to match the actual release version - 10.4 for example. That makes it difficult for centralised management tools to update software, as there is no way to determine what is installed on a client computer needs an update or not.

Could the the pkg receipt versions get bumped to match the release version when you update your software please? The version should be set in the Distribution file so

    <pkg-ref id="org.computop.SageMath-10.4.bin" version="1.0" auth="Root" onConclusion="none" installKBytes="4" packageIdentifier="org.computop.SageMath.10_4.bin">#SageMath_bin.pkg</pkg-ref>
    <pkg-ref id="org.computop.SageMath-10.4.share" version="1.0" auth="Root" onConclusion="none" installKBytes="73" packageIdentifier="org.computop.SageMath.10_4.share">#SageMath_share.pkg</pkg-ref>
    <pkg-ref id="org.computop.SageMath-10.4.texlive" version="1.0" auth="Root" onConclusion="none" installKBytes="204" packageIdentifier="org.computop.SageMath.10_4.texlive">#SageMath_texlive.pkg</pkg-ref>
    <pkg-ref id="org.computop.SageMath-10.4.bin">

Becomes

    <pkg-ref id="org.computop.SageMath-10.4.bin" version="10.4" auth="Root" onConclusion="none" installKBytes="4" packageIdentifier="org.computop.SageMath.10_4.bin">#SageMath_bin.pkg</pkg-ref>
    <pkg-ref id="org.computop.SageMath-10.4.share" version="10.4" auth="Root" onConclusion="none" installKBytes="73" packageIdentifier="org.computop.SageMath.10_4.share">#SageMath_share.pkg</pkg-ref>
    <pkg-ref id="org.computop.SageMath-10.4.texlive" version="10.4" auth="Root" onConclusion="none" installKBytes="204" packageIdentifier="org.computop.SageMath.10_4.texlive">#SageMath_texlive.pkg</pkg-ref>
    <pkg-ref id="org.computop.SageMath-10.4.bin">

And in the PackageInfo file so this

<?xml version="1.0" encoding="utf-8"?>
<pkg-info overwrite-permissions="true" relocatable="false" identifier="org.computop.SageMath.10_4.bin" postinstall-action="none" version="1.0" format-version="2" generator-version="InstallCmds-834 (23F79)" install-location="/usr/local/bin" auth="root">
    <payload numberOfFiles="6" installKBytes="4"/>
    <bundle-version/>
    <upgrade-bundle/>
    <update-bundle/>
    <atomic-update-bundle/>
    <strict-identifier/>
    <relocate/>
    <scripts>
        <preinstall file="./preinstall"/>
        <postinstall file="./postinstall"/>
    </scripts>
</pkg-info>

Becomes

<?xml version="1.0" encoding="utf-8"?>
<pkg-info overwrite-permissions="true" relocatable="false" identifier="org.computop.SageMath.10_4.bin" postinstall-action="none" version="10.4" format-version="2" generator-version="InstallCmds-834 (23F79)" install-location="/usr/local/bin" auth="root">
    <payload numberOfFiles="6" installKBytes="4"/>
    <bundle-version/>
    <upgrade-bundle/>
    <update-bundle/>
    <atomic-update-bundle/>
    <strict-identifier/>
    <relocate/>
    <scripts>
        <preinstall file="./preinstall"/>
        <postinstall file="./postinstall"/>
    </scripts>
</pkg-info>

Would you also consider making the installer available separately from the dmg file? This will make it much easier and quicker for automation tooling like AutoPkg

Thanks!

[culler]

I think it would not be difficult to use the release version number as the package version number and would be glad to look into that.

We did consider whether to make the package be a separate download and decided that doing so would be an unnecessary burder on users. I have two questions:

1. Would it be an improvement to have the package available separately as well as included in the dmg?
2. Can you explain why putting it in the dmg is problematic?

[paul-cossey]

Hey, @culler

Thanks for getting back to me so quickly and for agreeing to look in to the pkg receipt request.

To answer you questions

Yes, it would be an improvement. Having the pkg available in the dmg is the best option for folks that just want to install themselves, and totally makes sense for it to be there. I don't think you should remove it.

Rather have the pkg available for a direct download as well. The reason this would be beneficial for us (and anyone one else that wants to deploy via central systems) is the size of the dmg compared to the pkg. We need to effectively treat them as separate titles, so less problematic as I can easily download the dmg and grab the pkg, it's just a speed/disk space efficiency we're after.

The pkg receipts are by far the most important thing to us so if it's a real pain to add the pkg separately it would be ok to leave it as it is.

Thanks!

[NathanDunfield]

@paul-cossey I don't know if this helps with mass installs, but SageMath is available in Homebrew as a cask https://formulae.brew.sh/cask/sage

[culler]

@paul-cossey I use pkgbuild to build the package. It was trivial to set the -version option to the SageMath version in my pkgbuild command. I did that and I think it did the first thing you asked for. Maybe it did the second as well, but I can't tell.

I inspected the package with "Suspicous Package.app" and it showed the correct version. I have no idea what application generated the screenshot you attached or the xml snippets, and I do not find any file named PackageInfo when I expand the package. So if you want me to check the "PackageInfo file" you need to tell me how I can find it.

UPDATE: I found the PackageInfo files in the component packages. Indeed, changing the -version option in pkgbuild also updates the version in those files.

Starting with SageMath-10-5 I will use the SageMath version as the package version for those component packages as well as with the main package and I will upload a separate copy of the package as a release asset.

[paul-cossey]

Hi, @culler

Sorry for the slow response.

If the receipt is showing the correct version numbers via suspicious package then I think we're good to go! 🙌

Awesome, thanks for the looking in to this and accommodating my suggestions! Very much appreciated 😄