Jamf Pro patch source

App Auto-Patch publishes an external patch source for Jamf Pro. Add it to your Jamf Pro server and App Auto-Patch appears as a software title under Patch Management, so Jamf can report which Macs run the newest build and you can patch the rest with a normal patch policy.

Use it to keep App Auto-Patch itself current with Jamf Pro. It is separate from the preference settings you deploy with a profile.

Scope. The source has one title: App Auto-Patch. It does not describe the apps that App Auto-Patch updates for your users (Installomator handles those).

Add the source to Jamf Pro

In Jamf Pro, open Settings and find Patch Management (under Computer Management, or Global in older versions). Add an external patch source with these values:

Setting	Value
Name	App Auto-Patch
Server	appautopatch.app/jamf/v1
Port	leave blank (or 443)
Use SSL	on
Enabled	on
Validate Software Title Definitions	off

Type the server without https://. Press Test: Jamf Pro asks the source for its list of software and should report success.

The definitions are not signed, which is why Validate Software Title Definitions stays off. The definitions are plain JSON that you can read in a browser: https://appautopatch.app/jamf/v1/software.

Subscribe to the title

1. In Jamf Pro open Computers, then Patch Management, and add a new software title.
2. Choose the App Auto-Patch source, then the App Auto-Patch title.
3. Jamf Pro shows an extension attribute that the title needs. Read it (it is listed below) and accept it. Jamf Pro creates it on your server and fills it in on each Mac at the next inventory.
4. Save. Jamf Pro lists every build of App Auto-Patch 4 as a version, newest first, and counts the Macs on each one after their next inventory update.

Patch with a policy

A patch policy installs one package per version. Download the package for the build you want from the Download page, or by its address, and upload it to Jamf Pro like any other package. The address of a build is its version and build number:

https://downloads.appautopatch.app/AppAutoPatch-4.0.0-89.pkg

Then create a patch policy for the title and, on its Definition tab, pick the package for each version you want to install. AppAutoPatch-latest.pkg always points at the newest build, but a patch policy needs the package for a specific version.

Deploy your configuration profiles first or together with the package, as for any other deployment.

Why an extension attribute

Every build of App Auto-Patch 4 has the same marketing version (4.0.0); only the build number changes. Jamf Pro’s built-in Application Version reads the marketing version, so it cannot tell build 88 from build 89.

The title therefore uses an extension attribute, App Auto-Patch version, that reports the version and the build number together, for example 4.0.0.89. That is the same pair that App Auto-Patch’s Settings, About shows as Version 4.0.0 (89). Each version in Jamf Pro is matched against it, together with the bundle ID xyz.techitout.appAutoPatch.

The extension attribute

Jamf Pro runs this script as root on each Mac when it collects inventory, so read it before you accept it. It only reads the version and build number from the app’s Info.plist:

AAPVersion.ea.sh

#!/bin/bash
#
#  Jamf Pro extension attribute: "App Auto-Patch version".
#
#  Prints the installed app's version and build joined by a dot, for example 4.0.0.89, so that
#  Jamf Pro patch management can tell builds apart. Every App Auto-Patch 4 build has the same
#  marketing version (4.0.0), and Jamf's built-in "Application Version" only reads that.
#
#  Prints an empty result when the app is not installed.
#
#  This script is published inside the App Auto-Patch patch source
#  (https://appautopatch.app/jamf/v1) and Jamf Pro runs it as root during inventory. It only reads
#  the app's Info.plist. Admins must accept it in Jamf Pro before using the title. Changes to it are
#  reviewed like any other code in the repository.
#

APP="/Applications/App Auto-Patch.app"
PLIST="${APP}/Contents/Info.plist"

result=""
if [ -f "${PLIST}" ]; then
    version="$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "${PLIST}" 2>/dev/null)"
    build="$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "${PLIST}" 2>/dev/null)"
    if [ -n "${version}" ] && [ -n "${build}" ]; then
        result="${version}.${build}"
    fi
fi

echo "<result>${result}</result>"

The script lives in the project at Scripts/patch-source/AAPVersion.ea.sh. The patch source always carries exactly this script. A Mac without the app reports an empty value.

What the source provides

• One title, App Auto-Patch, with every build of App Auto-Patch 4 as a version, so Macs on an older build are counted correctly.
• Updated on each release. A new build appears in the source within minutes of its release. The title’s last modified date is the date of the newest release.
• Requires macOS 14 or later, which is what App Auto-Patch itself requires.
• No restart is needed after an install, and the title lists App Auto-Patch as an app to quit before the package installs.
• Unsigned definitions, as described above.

Troubleshooting

The Test button fails. Check that the server is appautopatch.app/jamf/v1 with no https:// and no trailing slash, that Use SSL is on, and that the port is blank or 443. Open https://appautopatch.app/jamf/v1/software in a browser: you should see a short list with one entry. If you see an error with the number 502, the files are not published yet or are being refreshed; try again in a few minutes.

Jamf Pro rejects the definitions. Turn Validate Software Title Definitions off. The definitions are not signed.

Every Mac shows an unknown version, or none are counted. The extension attribute fills in at the next inventory. Run sudo jamf recon on a test Mac and look at the App Auto-Patch version attribute in its inventory record. It should read something like 4.0.0.89. If it is empty, the app is not in /Applications under the name App Auto-Patch.app, or you have not accepted the extension attribute on the title.

A build is missing from the list. Only published releases are listed; drafts and pre-releases are not. A new release usually appears within a few minutes. If a published release is still missing after an hour, tell us in an issue.

The patch policy cannot find a package for a version. A patch policy needs a package uploaded for each version it installs. See Patch with a policy.