In-Browser macOS MDM PKG Builder

This tool runs the same flow as the manual build guide -- it injects a bootstrap-token postinstall script into the canonical Pult Agent .pkg and produces a wrapper you can upload to any macOS MDM. Everything happens locally in your browser; your .pkg and bootstrap token are never uploaded.

Requires Pult Agent 0.2.10 or later. Earlier .pkg builds use a different payload layout and cannot be wrapped. The .dmg artifact is also not a valid input. Use the canonical .pkg download from the Pult Dashboard.

The wrapper .pkg produced here is unsigned, but the Pult Agent.app it contains is signed and notarized by Pult. MDMs install packages as root via installer, which bypasses Gatekeeper, so an unsigned wrapper is acceptable for MDM-only distribution. Don't redistribute the wrapper outside your MDM.

Usage

Select the canonical .pkg downloaded from the Pult Dashboard.
Paste the bootstrap token generated in the Pult Dashboard. The token is substituted into the postinstall script below.
Review (and optionally edit) the postinstall script. The default mirrors the script documented in the manual guide. Customizations are preserved across token changes -- use Reset to default to roll back.
Generate the .pkg. Your browser downloads the wrapper as pult-agent-mdm.pkg, equivalent to running the manual pkgbuild flow on a Mac.

Builder

Pult Agent canonical .pkg

The signed canonical installer downloaded from Pult (0.2.10 or later). The file is processed entirely in your browser; nothing is uploaded.

Bootstrap token

Generated in the Pult Dashboard. Pasted into the postinstall script below.

Postinstall script

Auto-rendered from the bootstrap token. Edits are preserved unless you reset.

#!/bin/bash
set -euo pipefail

# Bootstrap token from the Pult Dashboard. Replace before building the package.
BOOTSTRAP_TOKEN="your-bootstrap-token-here"

# Where the postinstall drops the bootstrap token file. The Pult Agent watches
# this location and consumes the file on first launch.
#   - "user":   the console user's ~/Library/Application Support/com.pult.agent/.
#               Compatible with all Pult Agent versions.
#   - "system": /Library/Application Support/com.pult.agent/, with an ACL that
#               lets the user-context agent delete the file after consumption.
#               Reserved for future Pult Agent versions; keep "user" today.
#   - "both":   write to both locations during a transition window.
DROP_MODE="user"

SYSTEM_DIR="/Library/Application Support/com.pult.agent"

drop_user_context() {
    local console_user
    console_user="$(/usr/bin/stat -f%Su /dev/console)"
    if [[ -z "${console_user}" || "${console_user}" == "root" ]]; then
        echo "[user mode] no interactive console user; skipping user-context drop"
        return 1
    fi

local user_home
    user_home="$(/usr/bin/dscl . -read "/Users/${console_user}" NFSHomeDirectory \
        | /usr/bin/awk '{print $2}')"

local dir="${user_home}/Library/Application Support/com.pult.agent"
    local file="${dir}/BOOTSTRAP_TOKEN"

/usr/bin/sudo -u "${console_user}" /bin/mkdir -p "${dir}"
    /usr/bin/sudo -u "${console_user}" /usr/bin/tee "${file}" >/dev/null <<<"${BOOTSTRAP_TOKEN}"
    /bin/chmod 0600 "${file}"

echo "[user mode] token written to ${file}"
}

drop_system_context() {
    /bin/mkdir -p "${SYSTEM_DIR}"
    /usr/sbin/chown root:wheel "${SYSTEM_DIR}"
    /bin/chmod 0755 "${SYSTEM_DIR}"
    /bin/chmod +a "group:everyone allow add_file,delete_child" "${SYSTEM_DIR}"

local file="${SYSTEM_DIR}/BOOTSTRAP_TOKEN"
    /usr/bin/printf '%s' "${BOOTSTRAP_TOKEN}" > "${file}"
    /bin/chmod 0644 "${file}"

echo "[system mode] token written to ${file}"
}

case "${DROP_MODE}" in
    user)   drop_user_context ;;
    system) drop_system_context ;;
    both)
        drop_system_context
        drop_user_context || true
        ;;
    *)
        echo "unknown DROP_MODE: ${DROP_MODE}"
        exit 1
        ;;
esac

# Best-effort: (re)start the agent in the console user's context so the token
# is consumed immediately. If no user is logged in, the agent will pick up
# the token at next login via the system-wide LaunchAgent.
#
# If a previous Pult Agent version was already running, `installer` has
# already replaced the bundle at /Applications/Pult Agent.app, but the old
# process is still resident in memory. We kill it, wait briefly for the
# process to exit cleanly, and then launch the freshly installed version.
#
# Note: `sudo -H` is required, not just `-u`. On recent macOS,
# `sudo -u <user> env` reports HOME=/var/root -- sudo switches the UID to the
# target user but preserves root's HOME across the switch. The Pult Agent
# reads HOME on startup to resolve its config dir, so without -H it tries to
# create `/var/root/Library/Application Support/...` and panics with
# "Permission denied". -H forces HOME to the target user's home.
console_user="$(/usr/bin/stat -f%Su /dev/console)"
if [[ -n "${console_user}" && "${console_user}" != "root" ]]; then
    console_uid="$(/usr/bin/id -u "${console_user}")"

/usr/bin/pkill -x pult-agent 2>/dev/null || true
    /bin/sleep 3

/bin/launchctl asuser "${console_uid}" \
        /usr/bin/sudo -Hu "${console_user}" /usr/bin/open -a "Pult Agent" || true
fi

exit 0

Tip: the script still contains your-bootstrap-token-here. The build will succeed but the installed agent won't enroll until you replace it.

Select a Pult Agent .pkg to enable building.

Next steps

Upload the downloaded pult-agent-mdm.pkg to your MDM the same way you would the manually-built wrapper -- see Jamf Pro or the overview for other macOS MDMs. Also configure Managed Login Items so the agent auto-starts at login.

In-Browser macOS MDM PKG Builder

Usage

Builder

Next steps

On this page