Overview

The Matrix42 Mac Package Wizard is a tool that allows Empirum administrators to create easy-to-distribute application packages for macOS quickly. Packages are created in a format that can be imported directly into the Empirum Management Console (EMC) via the Software Depot.

The Mac Package Wizard can be found on the Empirum server at:

\\EmpirumServer\Empirum$\AddOns\Mac Package Wizard

Copy it to a Mac with administrator privileges via Finder or by mounting:

smb://EmpriumServer/Empirum$

Functional Scope

• Easy packaging of .app, .pkg, .mpkg, .dmg, and .sh files
• Packages are produced in the Empirum import format, ready for the Software Depot
• Integrated install and uninstall mechanism
• Supports packaging of the Mac OS X Empirum Agent and Mac OS X Inventory
• Creation of macOS images from macOS installers (including macOS 10.13), importable and distributable via Empirum
• PKG creation support via integration with Packages.app

Notes and Restrictions

• Applications purchased from the Apple Mac App Store cannot be packaged. They must be installed via the Mac App Store with an Apple ID.
• Apple provides no standard uninstall procedure. When a package is uninstalled, .app files are deleted based on the product name in the application directory. A sample uninstall script is provided in the Package Wizard for .mpkg, .pkg, and .sh files.
• For self-created DMG images, the names of included files must match the name of the application (e.g., Cyberduck.app must be in Cyberduck.dmg).
• Before installing an .app file, the agent always attempts to delete any existing app with the same name in /Applications.
• After an .app is copied to /Applications, the quarantine flag is removed via xattr -d -r com.apple.quarantine.

Examples of Use

Package a .app File (Example: Mozilla Firefox)

1. Install and launch the Mac Package Wizard on an Apple Mac.
2. Download the Firefox DMG from the official Mozilla website.
3. Mount the DMG and copy Firefox.app to any location (e.g., ~/Desktop). Unmount the DMG.
4. Drag and drop Firefox.app onto the Mac Package Wizard. A success icon and Next button will appear.
5. Review and correct the scanned metadata: product manufacturer, product name, product version, and revision (default: 0).
6. Click Next and select the supported operating systems.
7. Click Create and choose a save location. The package is now ready for import into the EMC Software Depot.

Package a PKG, MPKG, or Shell Script

1. Install and launch the Mac Package Wizard on an Apple Mac.
2. Drag and drop the .pkg, .mpkg, or .sh file onto the Mac Package Wizard. A success icon and Next button will appear.
3. Review and correct the scanned metadata (manufacturer, product name, version, revision).
4. Click Next and select the supported operating systems.
5. Unlike .app packaging, the wizard now presents an uninstall script editor where you can define a Bash-based uninstallation routine.
6. Complete the wizard to produce the importable package.

Package an App with a Custom Settings File (Example: Cyberduck)

This example demonstrates how to package an application together with a pre-configured preferences file, so all users receive predefined settings on installation.

Step 1: Create the Installation Script

Create a script named CyberduckScript.sh (the script name must differ from the app name to prevent conflicts):

#!/bin/sh
# CyberduckScript.sh

syslog -s -l warning "Emprium Agent installing Cyberduck with preferences"
syslog -s -l warning "Step 1"
syslog -s -l warning "Installing Cyberduck.app"

sudo /bin/cp -rf "/Volumes/CyberduckScript/Cyberduck.app" "/Applications/Cyberduck.app"

syslog -s -l warning "Step 2"
syslog -s -l warning "Copy config file .plist to all users ~/Library/Preferences/"

userlist=$(/usr/bin/dscl . list /Users | grep -v '_' | grep -v 'Guest' | grep -v 'daemon' | grep -v 'macports' | grep -v 'nobody' | grep -v 'root')

for user in $userlist
do
    sudo /bin/cp "/Volumes/CyberduckScript/ch.sudo.cyberduck.plist" "/Users/$user/library/preferences/"
    sudo /usr/sbin/chown "/Users/$user/library/preferences/"
done

Step 2: Create the Uninstall Script

#!/bin/sh
# uninstall.sh — Matrix42 AG Mac Package Wizard

syslog -s -l warning "Emprium Agent running uninstall.sh"

if [ -d "/Applications/Cyberduck.app/" ]
then
    /bin/rm -fR "/Applications/Cyberduck.app"
    syslog -s -l warning "/Applications/Cyberduck.app was removed"
else
    syslog -s -l warning "/Applications/Cyberduck.app not found"
fi

userlist=$(/usr/bin/dscl . list /Users | grep -v '_' | grep -v 'Guest' | grep -v 'daemon' | grep -v 'macports' | grep -v 'nobody' | grep -v 'root')

for user in $userlist
do
    if [ -f "/Users/$user/Library/Preferences/ch.sudo.cyberduck.plist" ]
    then
        /bin/rm -fR "/Users/$user/Library/Preferences/ch.sudo.cyberduck.plist"
        syslog -s -l warning "/Users/$user/Library/Preferences/ch.sudo.cyberduck.plist was removed"
    else
        syslog -s -l warning "/Users/$user/Library/Preferences/ch.sudo.cyberduck.plist not found"
    fi
done

Step 3: Build the Package

1. Package CyberduckScript.sh with the Mac Package Wizard and save to Desktop.
2. Delete the auto-generated ~/Desktop/{UUID}/Data/CyberduckScript.dmg.
3. Open Disk Utility and create a new read-write DMG named CyberduckScript, saved to ~/Desktop/{UUID}/Data/. Size the image slightly larger than the total content (e.g., 250 MB for a ~200 MB app). Ensure all name fields use the same name.
4. Copy the following into the new DMG:
   • Cyberduck.app
   • CyberduckScript.sh
   • ch.sudo.cyberduck.plist
   • uninstall.sh
5. Make the scripts executable:

sudo chmod a+x /Volumes/CyberduckScript/CyberduckScript.sh
sudo chmod a+x /Volumes/CyberduckScript/uninstall.sh

6. Unmount the DMG and import the package into the EMC.

Package an App with a License File (Example: Avira Antivirus)

1. Download the latest Avira_Antivirus.pkg for Mac.
2. Drag and drop the PKG onto the Mac Package Wizard. Enter: Vendor: Avira GmbH, Name: Avira Antivirus, Version: 3.5.1, Revision: 0. Create the package.
3. Open the package's {UUID}/Data/ folder and mount the DMG.
4. Rename Avira_Antivirus.pkg to Avira_Antivirus_Installer.pkg inside the mounted image. (This allows the agent to find the .sh script by product name instead.)
5. Drag the license file (hbedv.key) into the mounted image.
6. Create Avira Antivirus.sh with the following content and save it into the image:

#!/bin/sh
# Avira Antivirus.sh — Matrix42 AG Mac Package Wizard

syslog -s -l warning "Emprium Agent running Avira Antivirus.sh"

# Copy the licence file
if [ -d "/Library/Application Support/Avira/" ]
then
    sudo /bin/rm "/Library/Application Support/Avira/pro.key"
else
    sudo /bin/mkdir "/Library/Application Support/Avira/"
fi

sudo /bin/cp "/Volumes/Avira Antivirus/hbedv.key" "/Library/Application Support/Avira/pro.key"

# Install AntiVirus
sudo /usr/sbin/installer -pkg "/Volumes/Avira Antivirus/Avira_Antivirus_Installer.pkg" -target /

7. Edit uninstall.sh with the following content:

#!/bin/sh
# uninstall.sh — Matrix42 AG Mac Package Wizard

syslog -s -l warning "Emprium Agent running uninstall.sh"

if [ -d "/Applications/Utilities/Avira-Uninstall.app/" ]
then
    sudo "/Applications/Utilities/Avira-Uninstall.app/Contents/MacOS/uninstall"
    sudo /bin/rm "/Library/Application Support/Avira/pro.key"
    syslog -s -l warning "/Applications/Avira Antivirus.app was removed"
else
    syslog -s -l warning "/Applications/Avira Antivirus.app not found"
fi

8. Make the scripts executable:

sudo chmod a+x /Volumes/Avira\ Antivirus/Avira\ Antivirus.sh
sudo chmod a+x /Volumes/Avira\ Antivirus/uninstall.sh

9. Unmount the image and import the package into the EMC.

Package and Distribute Microsoft Office 365

1. Assign the appropriate Office 365 license to the target user in your Microsoft admin portal.
2. Download the latest Office 365 installer PKG from Microsoft.
3. Use the Mac Package Wizard to package the PKG.
4. Specify the following script as uninstall.sh during packaging:

#!/bin/sh
# uninstall.sh — Matrix42 AG

syslog -s -l warning "Empirum Agent running uninstall.sh"
syslog -s -l warning "Step 1 — Removing Office Apps from /Applications"

/bin/rm -rf "/Applications/Microsoft Excel.app"
/bin/rm -rf "/Applications/Microsoft PowerPoint.app"
/bin/rm -rf "/Applications/Microsoft Word.app"
/bin/rm -rf "/Applications/Microsoft Outlook.app"
/bin/rm -rf "/Applications/Microsoft OneNote.app"

syslog -s -l warning "Step 2 & 3 — Removing user directories and Dock icons"

userlist=$(/usr/bin/dscl . list /Users | grep -v '_' | grep -v 'Guest' | grep -v 'daemon' | grep -v 'macports' | grep -v 'nobody' | grep -v 'root')

for user in $userlist
do
    /bin/rm -rf "/Users/$user/Library/Containers/com.microsoft.errorreporting"
    /bin/rm -rf "/Users/$user/Library/Containers/com.microsoft.Excel"
    /bin/rm -rf "/Users/$user/Library/Containers/com.microsoft.Outlook"
    /bin/rm -rf "/Users/$user/Library/Containers/com.microsoft.PowerPoint"
    /bin/rm -rf "/Users/$user/Library/Containers/com.microsoft.Word"
    /bin/rm -rf "/Users/$user/Library/Containers/com.microsoft.onenote.mac"
    /bin/rm -rf "/Users/$user/Library/Containers/UBF8T346G9.ms"
    /bin/rm -rf "/Users/$user/Library/Containers/UBF8T346G9.Office"
    /bin/rm -rf "/Users/$user/Library/Group Containers/UBF8T346G9.ms"
    /bin/rm -rf "/Users/$user/Library/Group Containers/UBF8T346G9.Office"

    # Remove Dock icons
    for app in "Microsoft Excel" "Microsoft Outlook" "Microsoft PowerPoint" "Microsoft Word" "Microsoft OneNote"
    do
        dloc=$(defaults read com.apple.dock persistent-apps | grep file-label | awk "/$app/  {printf NR}")
        dloc=$[$dloc-1]
        /usr/libexec/PlistBuddy -c "Delete persistent-apps:$dloc" "/Users/$user/Library/Preferences/com.apple.dock.plist"
    done

    sleep 3
    /usr/bin/killall Dock
done

5. Distribute the package using the macOS Empirum Agent.

Package and Distribute Adobe Creative Cloud Suite

Adobe Creative Cloud packaging requires the Creative Cloud Packager application for Mac. Prerequisites:

• Adobe Creative Cloud license (Enterprise or Teams)
• Administrator account
• Creative Cloud Packager app for Mac
• Mac client
• Matrix42 Mac Package Wizard

Step 1: Create a Package with Creative Cloud Packager

1. Install the Creative Cloud Packager and follow the setup wizard. Sign in with your Creative Cloud Administrator credentials.
2. Choose Package or License Package as the package type.
3. Enter a package name, save path, and your company/organisation name. Select Named License as the license type.
4. Optionally allow end users to download additional software and updates from Adobe Creative Cloud.
5. Select the Adobe products to include. The packager downloads all chosen applications — ensure sufficient disk space.
6. Once complete, a build directory is created containing two PKG files: one for installation, one for uninstallation.

Step 2: Package with Mac Package Wizard

Package the installation PKG using the Mac Package Wizard as usual. For uninstallation, choose one of two options:

• Use Adobe's uninstall PKG (from the build directory): package it separately with the Package Wizard and manage attachment/detachment manually in the EMC.
• Use the embedded uninstall routine (recommended): open the Package Wizard-created package, mount the DMG in the /data folder, drag Adobe's uninstall PKG into the mounted DMG, then edit uninstall.sh to include:

sudo installer -pkg /Volumes/<VolumeName>/NameDer_Uninstall.pkg -target /

Step 3: Upload and Distribute

Import the package into the EMC Software Depot and attach it to the target clients. The Mac Agent recognizes and installs the software automatically.

Package McAfee Agent and Threat Prevention

1. Download the latest McAfee Agent and McAfee Threat Prevention for Mac.
2. Rename McAfee Threat Prevention.pkg to McAfeeThreatPrevention.pkg.
3. Create a script named McAfee Agent.sh:

#!/bin/bash
# McAfeeAgent.sh — (c)2000-2018 Matrix42 AG

echo "[McAfee Agent] - START INSTALLATION PROCESS"
/Volumes/McAfee\ Agent/install.sh -i
echo "[McAfee Agent] - FINISHED INSTALLATION PROCESS"

echo "[McAfee-Threat-Prevention] - START INSTALLATION PROCESS"
installer -pkg /Volumes/McAfee\ Agent/McAfeeThreatPrevention.pkg -target /
echo "[McAfee-Threat-Prevention] - FINISHED INSTALLATION PROCESS"

4. Make the script executable:

chmod a+x {path to McAfee Agent.sh}

5. Drag McAfee Agent.sh onto the Mac Package Wizard, fill in the metadata, and proceed to the uninstall script editor. Enter the following as uninstall.sh:

#!/bin/sh
# uninstall.sh — Matrix42 AG Mac Package Wizard

syslog -s -l warning "Emprium Agent running uninstall.sh"

echo "[McAfee Agent] - Start uninstallation process"
/Library/McAfee/cma/scripts/uninstall.sh
echo "[McAfee Agent] - Finished uninstallation process"

echo "[McAfee-Threat-Prevention] - Start uninstallation process"
/usr/local/McAfee/uninstall ThreatPrevention
echo "[McAfee-Threat-Prevention] - Finished uninstallation process"

6. Create the package and save it to Desktop. Mount the DMG and copy all contents to a separate staging directory. Unmount and delete McAfee Agent.dmg.
7. Open Disk Utility and create a new read-write DMG named McAfee Agent, saved to ~/Desktop/{UUID}/Data/. Use a size of at least 250 MB.
8. Mount the new DMG and copy all staged content into it, including McAfeeThreatPrevention.pkg and install.sh from the McAfee download.
9. Unmount the DMG. The package is ready to import into the EMC.

Package and Distribute Configuration Profiles

This method uses a LaunchAgent to install a .mobileconfig profile for every user who logs in.

Step 1: Create the Profile and Scripts

1. Create your profile using Apple Configurator and save it as {ProfileName}.mobileconfig.
2. Create {ProfileName}_Installation.sh — this installs the profile for the currently logged-in user:

#!/bin/bash
# {ProfileName}_Installation.sh — (c)2000-2018 Matrix42 AG

currentUser=`stat -f "%Su" /dev/console`

if su $currentUser -c "profiles -L" | grep "{ProfileIdentifier}"; then
    syslog -s -l warning "[ProfileInstaller] Profile already installed for: $currentUser"
else
    profiles -I -F "/Library/Profiles/{ProfileName}.mobileconfig"
    syslog -s -l warning "[ProfileInstaller] Installed profile for: $currentUser"
fi

3. Create the LaunchAgent plist com.apple.mdm.{CompanyName}.{ProfileName}.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.mdm.{CompanyName}.{ProfileName}</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Library/Profiles/{ProfileName}.sh</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

4. Create the main packaging script {ProfileName}.sh — this is what the Package Wizard wraps:

#!/bin/bash
# {ProfileName}.sh — (c)2000-2018 Matrix42 AG

# Create Profiles directory if needed
if ! [ -d "/Library/Profiles" ]
then
    mkdir "/Library/Profiles"
    syslog -s -l warning "[ProfileInstaller] Created /Library/Profiles"
fi

# Copy files
cp "/Volumes/{ProfileName}/{ProfileName}.mobileconfig" "/Library/Profiles/{ProfileName}.mobileconfig"
cp "/Volumes/{ProfileName}/{ProfileName}_Installation.sh" "/Library/Profiles/{ProfileName}_Installation.sh"
cp "/Volumes/{ProfileName}/com.apple.mdm.{CompanyName}.{ProfileName}.plist" "/Library/LaunchAgents/com.apple.mdm.{CompanyName}.{ProfileName}.plist"

# Load LaunchAgent
launchctl load -w "/Library/LaunchAgents/com.apple.mdm.{CompanyName}.{ProfileName}.plist"
syslog -s -l warning "[ProfileInstaller] Started LaunchAgent"

# Wait for device portion to complete, then remove it
sleep 5
profiles -R -p {ProfileIdentifier}

5. Create uninstall.sh:

#!/bin/sh
# uninstall.sh — (c)2000-2018 Matrix42 AG

syslog -s -l warning "[ProfileInstaller] Start uninstallation"

rm "/Library/Profiles/{ProfileName}.mobileconfig"
rm "/Library/Profiles/{ProfileName}_Installation.sh"
launchctl unload "/Library/LaunchAgents/com.apple.mdm.{CompanyName}.{ProfileName}.plist"
rm "/Library/LaunchAgents/com.apple.mdm.{CompanyName}.{ProfileName}.plist"

syslog -s -l warning "[ProfileInstaller] Finished uninstallation"

Step 2: Build and Import the Package

1. Drag {ProfileName}.sh onto the Package Wizard and package it as an ordinary shell script.
2. Mount the created DMG and copy the following files into it:
   • com.apple.mdm.{CompanyName}.{ProfileName}.plist
   • {ProfileName}_Installation.sh
   • {ProfileName}.mobileconfig
3. Unmount and import the package into the EMC.

Distribute OS Updates

Create and package the following script to trigger macOS software update installation on target clients:

#!/bin/bash
# SoftwareUpdate.sh — (c)2000-2019 Matrix42 AG
# Installs all appropriate updates

softwareupdate -i -a

PKG Creation Using the Package Wizard and Packages.app

The Package Wizard integrates with Packages.app (by Stéphane Sudre, BSD License) to support creation of more complex PKG installers — including PKGs that copy files to specific locations or run pre/post-install scripts.

The Package Wizard does not execute PKG creation itself; it launches Packages.app to handle the build.

Steps

1. On the Package Wizard start page, click Start PKG Creation. If Packages.app is not yet installed, the wizard starts the appropriate installer — follow the prompts.
2. A new window with step-by-step instructions opens.
3. Follow the instructions and create your PKG using Packages.app.

Using Variables from ComputerName.ini in setup.sh

Since Empirum Agent for macOS version 1711, variables from the ComputerName.ini file can be accessed during software installation. This is useful for making package-specific configurations based on computer context.

Use the GetVariable tool, located at:

/Library/Application Support/matrix42/EmpirumAgent/EmpirumAgent.app/Contents/Resources/GetVariable

The tool accepts two parameters:

Examples:

# Read the FQDN variable
/Library/Application\ Support/matrix42/EmpirumAgent/EmpirumAgent.app/Contents/Resources/GetVariable -v FQDN | tail -n1

# Read a SYNC-encrypted password
/Library/Application\ Support/matrix42/EmpirumAgent/EmpirumAgent.app/Contents/Resources/GetVariable -p SUBDEPOT.PASSWORD_1_SYNC | tail -n1

Troubleshooting

Application metadata (manufacturer, product name, version) is extracted automatically by analyzing the .app bundle. If the detected information is incorrect, it can be edited manually within the wizard before finalizing the package.

To diagnose how metadata is interpreted for a folder of applications, use the Package Wizard's debug scan mode from Terminal:

open -n ./Mac\ Package\ Wizard.app --args DEBUG -SRCFOLDER /Applications -DESTFOLDER /Users/administrator/Desktop/M42Debug.csv

The scan result CSV shows exactly how each application's metadata is interpreted and processed, making it easy to identify and correct any discrepancies before packaging.