Setting up and using AutoPkg .munki recipes

Install AutoPkg

You can find and install the latest release from the AutoPkg GitHub page.

Set up AutoPkg for Munki

Because of how GitHub has made it so you have to log into GitHub to search it, there’s a website you can use to search AutoPkg recipes: autopkgweb.com.

You can search for a recipe, and you’ll see what the recipe is and what the recipe repo is that it belongs to.

So, in this example, you can see a munkitools6-signed.munki.recipe recipe in the recipes repo.

You should add that repo to have access to the recipes in it:

autopkg repo-add recipes

Then you can make an override for the munkitools6-signed.munki.recipe recipe, so you can use it properly.

autopkg make-override munkitools6-signed.munki.recipe
Override file saved to /Users/username/Library/AutoPkg/RecipeOverrides/munkitools6-signed.munki.recipe

You’ll also want to make an override for the MakeCatalogs recipe as well:

autopkg make-override MakeCatalogs.munki
Override file saved to /Users/username/Library/AutoPkg/RecipeOverrides/MakeCatalogs.munki.recipe

The MakeCatalogs recipe will see if anything new is imported into your Munki repo, and then will run makecatalogs if necessary, so your clients can see the changes.

Make sure you fail recipes that don’t have trust info:

defaults write com.github.autopkg FAIL_RECIPES_WITHOUT_TRUST_INFO -bool YES

One final thing you want to do is tell AutoPkg where you Munki repo is:

defaults write com.github.autopkg MUNKI_REPO /Users/Shared/munki_repo

Now, you’re ready to run your first .munki AutoPkg recipe.

Using AutoPkg

Try running one .munki recipe:

autopkg run -v munkitools6-signed.munki.recipe MakeCatalogs.munki.recipe

The -v flag just gives you some more verbose output. You can run it without -v for less verbose output, or you can run it with several (-vvv) for even more verbose output.

Make a bunch more overrides for recipes:


autopkg make-override GoogleChrome.munki
autopkg make-override Firefox.munki
autopkg make-override Spotify.munki
autopkg make-override VLC.munki

You should then be able to run a series of .munki recipes all together:

autopkg run -v GoogleChrome.munki Firefox.munki Spotify.munki VLC.munki munkitools6-signed.munki MakeCatalogs.munki

Now if you go back to MunkiAdmin and Reload your repo, you should see a bunch of new things that AutoPkg fetched.

If you’re confused a bit about overrides and trust info, you should really read AutoPkg and recipe parent trust info

I’ve also written up a script that will prompt you to approve changes in recipes that have been updated.

You may also want to check out a project called AutoPkgr, which provides a point-and-click GUI for managing AutoPkg repositories and recipes. Just keep in mind that the project is good, but it’s also hasn’t been actively developed in a while.