Companion scripts

Small scripts that run next to App Auto-Patch and report on it to your MDM. They only read; they change nothing on the Mac.

Script	For	What it does
AAPCompliance.jamf.ea.sh	Jamf Pro extension attribute	Reports one value from App Auto-Patch’s patch status
AAPCompliance.intune.sh	Microsoft Intune custom attribute	The same, for Intune

With them you can build a smart group of Macs that are overdue, chart how many updates are pending across the fleet, or find Macs where App Auto-Patch has not checked for updates. To keep App Auto-Patch itself current with Jamf Pro, see the Jamf Pro patch source.

Where the data comes from

The root helper keeps /Library/Application Support/AppAutoPatch/compliance.json current, readable by every user (build 105 and later). It checks once a minute and rewrites the file when something changes, and at least every hour. The scripts read one field from that file each; they do not run App Auto-Patch or Installomator, and they send nothing anywhere.

Field	Meaning
status	Not checked (no update check yet), No applicable applications discovered (the last discovery found no app to patch), Compliant (nothing pending), Pending, Deadline approaching (hard deadline within 2 days) or Overdue (hard deadline passed)
pendingCount, pendingLabels	Apps with an update, as Installomator labels. An app App Auto-Patch installed since the last check is not counted
oldestPendingSince, oldestPendingDays	When the oldest pending update was first seen, and how many whole days ago
hardDeadline, daysUntilHardDeadline	The hard deadline while updates are pending, and the days left (negative once it has passed)
brokenLabels	Labels whose check is skipped because they keep reporting no latest version
lastDiscovery, lastSuccessfulPatch	When updates were last checked, and when App Auto-Patch last installed an app or found it already current
appVersion	App Auto-Patch version and build

A value that is not set is left out of the file. Dates are ISO 8601 text.

Without a hard deadline, status never goes past Pending. Set DeadlineDaysHard to get Deadline approaching and Overdue.

Jamf Pro

Download AAPCompliance.jamf.ea.sh or copy the script below, then:

1. In Jamf Pro open Settings, then Computer management, then Extension attributes, and add a new one.
2. Name it, for example, App Auto-Patch status. Set Data type to String (use Integer for pendingCount, oldestPendingDays and daysUntilHardDeadline) and Input type to Script.
3. Paste the script, check the FIELD line, and save. Jamf Pro collects the value at the next inventory update.

The script reports one field, named on the FIELD line at the top. Make one extension attribute per value you want, each with its own FIELD. Use String for the date fields: Jamf’s Date type expects a different format.

AAPCompliance.jamf.ea.sh

#!/bin/bash
#
#  Jamf Pro extension attribute: App Auto-Patch patch status.
#
#  Reads /Library/Application Support/AppAutoPatch/compliance.json, which App Auto-Patch's root
#  helper writes after each discovery and patch run, and prints one value from it. Nothing else is
#  run. Set FIELD to the value this extension attribute reports; make one extension attribute per
#  value you want:
#
#    status                  Not checked, No applicable applications discovered, Compliant, Pending,
#                            Deadline approaching or Overdue (default)
#    pendingCount            Number of pending updates
#    pendingLabels           Pending Installomator labels, separated by spaces
#    oldestPendingDays       Days since the oldest pending update was first seen
#    daysUntilHardDeadline   Days left before the hard deadline (negative once passed)
#    brokenLabels            Labels that report no latest version, separated by spaces
#    lastDiscovery           When updates were last checked (ISO 8601)
#    lastSuccessfulPatch     When App Auto-Patch last installed or confirmed an app (ISO 8601)
#
#  Prints "Not reported" when the file is missing, and an empty result when the value is not set.
#

FIELD="status"
FILE="/Library/Application Support/AppAutoPatch/compliance.json"

if [ ! -f "${FILE}" ]; then
    echo "<result>Not reported</result>"
    exit 0
fi

case "${FIELD}" in
    pendingLabels|brokenLabels)
        value="$(/usr/bin/plutil -extract "${FIELD}" json -o - "${FILE}" 2>/dev/null \
            | /usr/bin/tr -d '[]"' | /usr/bin/tr ',' ' ')"
        ;;
    *)
        value="$(/usr/bin/plutil -extract "${FIELD}" raw -o - "${FILE}" 2>/dev/null)"
        ;;
esac

echo "<result>${value}</result>"

A Mac that has no compliance.json reports Not reported. That means App Auto-Patch is not installed, is older than build 105, or its root helper has not run yet.

For example, a smart group of Macs that need attention uses the criteria App Auto-Patch status is Overdue, and one for early warning uses is Deadline approaching.

Microsoft Intune

Download AAPCompliance.intune.sh or copy the script below, then:

1. In the Intune admin center open Devices, then macOS, then Custom attributes, and add one.
2. Give it a name and choose the data type String (or Integer for pendingCount, oldestPendingDays and daysUntilHardDeadline).
3. Upload the script with the FIELD line set to the value to report, and assign it to your Macs. Add one custom attribute per value.

AAPCompliance.intune.sh

#!/bin/bash
#
#  Microsoft Intune custom attribute: App Auto-Patch patch status.
#
#  Reads /Library/Application Support/AppAutoPatch/compliance.json, which App Auto-Patch's root
#  helper writes after each discovery and patch run, and prints one value from it. Nothing else is
#  run. Add it in Intune under Devices > macOS > Custom attributes, with the data type String
#  (or Integer for the counts and day values). Set FIELD to the value to report; add one custom
#  attribute per value:
#
#    status                  Not checked, No applicable applications discovered, Compliant, Pending,
#                            Deadline approaching or Overdue (default)
#    pendingCount            Number of pending updates
#    pendingLabels           Pending Installomator labels, separated by spaces
#    oldestPendingDays       Days since the oldest pending update was first seen
#    daysUntilHardDeadline   Days left before the hard deadline (negative once passed)
#    brokenLabels            Labels that report no latest version, separated by spaces
#    lastDiscovery           When updates were last checked (ISO 8601)
#    lastSuccessfulPatch     When App Auto-Patch last installed or confirmed an app (ISO 8601)
#
#  Prints "Not reported" when the file is missing, and nothing when the value is not set.
#

FIELD="status"
FILE="/Library/Application Support/AppAutoPatch/compliance.json"

if [ ! -f "${FILE}" ]; then
    echo "Not reported"
    exit 0
fi

case "${FIELD}" in
    pendingLabels|brokenLabels)
        /usr/bin/plutil -extract "${FIELD}" json -o - "${FILE}" 2>/dev/null \
            | /usr/bin/tr -d '[]"' | /usr/bin/tr ',' ' '
        echo
        ;;
    *)
        /usr/bin/plutil -extract "${FIELD}" raw -o - "${FILE}" 2>/dev/null
        ;;
esac

This script prints the bare value, with no <result> tags. A Mac with no compliance.json reports Not reported.

Other tools

The Intune script prints just the value, so it also fits another tool that reports the output of a script. The file is plain JSON that any tool or script can read.

Check it on a Mac

To see exactly what the scripts see:

cat "/Library/Application Support/AppAutoPatch/compliance.json"

and to run a script by hand, which prints the value your MDM would receive:

bash AAPCompliance.jamf.ea.sh

If the file does not exist, check that App Auto-Patch is installed, is build 105 or later, and that its root helper is approved (see Approving the helper).