geerlingguy / ansible-role-mas

Ansible Role - Mac App Store CLI (MOVED to geerlingguy.mac collection)

Ansible Role: Mac App Store CLI (mas) (MOVED)

MOVED: This role has been moved into the geerlingguy.mac collection. Please see this issue for a migration guide and more information.

Installs mas on macOS, and installs macOS apps from the Mac App Store.

Requirements

• Homebrew: Requires homebrew already installed (you can use geerlingguy.homebrew to install it on your Mac).
• Mac App Store account: You can either sign into the Mac App Store via the GUI before running this role, or you can set the mas_email and mas_password prior to running the role. For security reasons, if you're going to use this role to sign in, you should use vars_prompt for at least the password; don't store unencrypted passwords with your playbooks!

Role Variables

Available variables are listed below, along with default values (see defaults/main.yml):

mas_email: ""
mas_password: ""

The credentials for your Mac App Store account. The Apps you install should already be purchased by/registered to this account.

If setting these variables statically (e.g. in an included vars file), you should encrypt the inventory using Ansible Vault. Otherwise you can use vars_prompt to prompt for the password at playbook runtime.

If you leave both blank, and don't prompt for them, the role assumes you've already signed in via other means (e.g. via GUI or mas signin [email]), and will not attempt to sign in again.

mas_signin_dialog: false

Fallback to the built-in Mac App Store dialog to complete sign in. If set to yes, you must specify the aforementioned mas_email variable which will be autofilled in the dialog and prompt you to enter your password, followed by the 2FA authorization code if enabled on the account.

mas_installed_apps:
  - { id: 425264550, name: "Blackmagic Disk Speed Test (3.0)" }
  - { id: 411643860, name: "DaisyDisk (4.3.2)" }
  - { id: 498486288, name: "Quick Resizer (1.9)" }
  - { id: 497799835, name: "Xcode (8.1)" }

A list of apps to ensure are installed on the computer. You can get IDs for all your existing installed apps with mas list, and you can search for IDs with mas search [App Name]. The name attribute is not authoritative and only used to provide better information in the playbook output.

mas_upgrade_all_apps: false

Whether to run mas upgrade, which will upgrade all installed Mac App Store apps.

Dependencies

• (Soft dependency) geerlingguy.homebrew

Example Playbook

- hosts: localhost
  vars:
    mas_installed_apps:
      - { id: 497799835, name: "Xcode (8.1)" }
  roles:
    - geerlingguy.homebrew
    - geerlingguy.mas

See the Mac Development Ansible Playbook for an example of this role's usage.

License

MIT / BSD

Author Information

This role was created in 2016 by Jeff Geerling, author of Ansible for DevOps.

ansible-role-mas's Issues

Apps from this role are installed instead of the ones declared locally

So I have a .sh script which generates my yml

#!/bin/bash
read -p "Mac App Store username: " name
name=${name}

read -p "Mac App Store password: " password
password=${password}

echo "mas_email: $name
mas_password: $password
mas_installed_apps:
  - { id: 497799835, name: \"Xcode (8.x.x)\" }" | tee mas.yml

So My final yml is:

mas_email: app store username
mas_password: app store password
mas_installed_apps:
  - { id: 497799835, name: \"Xcode (8.x.x)\" }

And I call it from:

---
- hosts: all
  connection: local

  vars_files:
    - mas.yml

  roles:
    - geerlingguy.homebrew
    - geerlingguy.mas

as

ansible-playbook -i inventory --ask-become-pass xcode_req.yml

But the issue is when it installs, it installs all 4 mas apps from this example: xcode, blackmagic speed test, etc.

Any idea why?

always_run is deprecated

[DEPRECATION WARNING]: always_run is deprecated. Use check_mode = no instead..
This feature will be removed in version 2.4.

This is what I get on Ansible 2.2.0.0

CI tests started failing; Travis CI 10.14 environment doesn't have pip

Failed build: https://travis-ci.org/github/geerlingguy/ansible-role-mas/jobs/668826103

$ sudo -H pip install -U virtualenv
sudo: pip: command not found
The command "sudo -H pip install -U virtualenv" failed and exited with 1 during .

It's strange—this seems to be in Travis CI's setup, not in my .travis.yml file, so it's probably an upstream bug in the xcode11.2 environment. I'm going to try bumping to xcode11.3 to see if it goes away.

install homebrew

Hello

i have previously installed homebrew manually. If i were touse your role , do i need to uninstall my version ?

Please add 'mas lucky' to Readme.md

Please add documentation on how to use mas lucky command to the Readme.md

For example: mas lucky slack will install slack without an app ID

mas no longer seems to support 10.12, so drop 10.12 support

From this build: https://travis-ci.org/geerlingguy/ansible-role-mas/jobs/446257647#L904

TASK [ansible-role-mas : Ensure MAS is installed.] *****************************
fatal: [localhost]: FAILED! => {"changed": false, "msg": "mas: A full installation of Xcode.app 10.0 is required to compile this software.\nInstalling just the Command Line Tools is not sufficient.\nXcode 10.0 cannot be installed on macOS 10.12.\nYou must upgrade your version of macOS.\nError: An unsatisfied requirement failed this build."}

Indeed, the docs now say 10.13 is a minimum requirement. Older OSes can be supported by using a more customized older tap, I think.

"Get MAS account status" fails, mas command not found

I'm building a playbook for setting up some headless Mac Mini build servers at the office. It is run from my workstation over SSH to each build server simultaneously, rather than locally on each individually.

The first task in this role, "Ensure MAS is installed", works just fine (the mas command is indeed present on the servers afterwards, if I go and check). But "Get MAS account status" fails like so:

FAILED! => {"changed": false, "cmd": "mas account", "failed_when_result": true, "msg": "[Errno 2] No such file or directory", "rc": 2}

This looks like a path issue. mas is present in /usr/local/bin. /usr/local/bin is in /etc/paths and also present in the $PATH variable for the user who I'm connecting over SSH with, when I'm in the interactive shell of the target server.

However, it seems that Ansible is using a different path that doesn't include /usr/local/bin. Doing - debug: msg="{{ ansible_env.PATH }}", the result is /usr/bin:/bin:/usr/sbin:/sbin.

I think it would be nice if this role had the full path to the mas executable in the tasks so that it wouldn't rely on Ansible's PATH determination logic.

Since mas is installed via Homebrew, perhaps you could introduce the following defaults from geerlingguy/ansible-role-homebrew into this role as well:

homebrew_prefix: /usr/local
homebrew_brew_bin_path: "{{ homebrew_prefix }}/bin"

...and then have the task look like this:

command: "{{ homebrew_brew_bin_path }}/mas account"

As far as I can tell, this should work both for homebrew installed via geerlingguy.homebrew and homebrew installed via other means, allowing the user to set a custom homebrew path in both cases.

An alternative method is to document this environment trick in the playbook (seems to work globally, per role or per task):

- role: geerlingguy.mas
  environment:
    PATH: "/usr/local/bin:{{ ansible_env.PATH }}"

This is what I'm using currently, but I feel like this issue would be better handled at the role level rather than requiring every user of the role to alter the environment at the playbook level.

"command: mas account" vs $PATH

This task assume the command mas is in the $PATH

- name: Get MAS account status
  command: mas account
  register: mas_account_result
  failed_when: mas_account_result.rc > 1
  check_mode: false
  changed_when: false

Using the role like below

- hosts: localhost
  roles:
    - geerlingguy.homebrew
    - geerlingguy.mas

throws an exception, if I replace mas with /usr/local/bin/mas the error goes away.

The full traceback is:
  File "/var/folders/tv/cdwkzld92t5bh0x4_y47mbyr0000gn/T/ansible_command_payload_502ytqym/ansible_command_payload.zip/ansible/module_utils/basic.py", line 2680, in run_command
    cmd = subprocess.Popen(args, **kwargs)
  File "/usr/local/Cellar/[email protected]/3.9.1_5/Frameworks/Python.framework/Versions/3.9/lib/python3.9/subprocess.py", line 947, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
  File "/usr/local/Cellar/[email protected]/3.9.1_5/Frameworks/Python.framework/Versions/3.9/lib/python3.9/subprocess.py", line 1819, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
fatal: [macos-ansible.cf.real-time.com]: FAILED! => {
    "changed": false,
    "cmd": "mas account",
    "failed_when_result": true,
    "invocation": {
        "module_args": {
            "_raw_params": "mas account",
            "_uses_shell": false,
            "argv": null,
            "chdir": null,
            "creates": null,
            "executable": null,
            "removes": null,
            "stdin": null,
            "stdin_add_newline": true,
            "strip_empty_ends": true,
            "warn": true
        }
    },
    "msg": "[Errno 2] No such file or directory: b'mas'",
    "rc": 2
}

I believe the command module does some sort of restricted shell?

Travis CI tests failing on homebrew task 'Ensure proper ownership on homebrew_install_path subdirs'

For some reason:

TASK [geerlingguy.homebrew : Ensure proper ownership on homebrew_install_path subdirs.] ***
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: OSError: [Errno 2] No such file or directory: '/usr/local/lib/pkgconfig/fuse.pc'
fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n  File \"/tmp/ansible_9dVyoX/ansible_module_file.py\", line 473, in <module>\n    main()\n  File \"/tmp/ansible_9dVyoX/ansible_module_file.py\", line 350, in main\n    changed |= recursive_set_attributes(module, to_bytes(file_args['path'], errors='surrogate_or_strict'), follow, file_args)\n  File \"/tmp/ansible_9dVyoX/ansible_module_file.py\", line 172, in recursive_set_attributes\n    changed |= module.set_fs_attributes_if_different(tmp_file_args, changed, expand=False)\n  File \"/tmp/ansible_9dVyoX/ansible_modlib.zip/ansible/module_utils/basic.py\", line 1507, in set_fs_attributes_if_different\n  File \"/tmp/ansible_9dVyoX/ansible_modlib.zip/ansible/module_utils/basic.py\", line 1164, in set_owner_if_different\n  File \"/tmp/ansible_9dVyoX/ansible_modlib.zip/ansible/module_utils/basic.py\", line 1059, in user_and_group\nOSError: [Errno 2] No such file or directory: '/usr/local/lib/pkgconfig/fuse.pc'\n", "module_stdout": "", "msg": "MODULE FAILURE", "rc": 1}

Specifically:

OSError: [Errno 2] No such file or directory: '/usr/local/lib/pkgconfig/fuse.pc'

I'm using the same setup and OS versions in these tests as the geerlingguy.homebrew role, but these builds are failing for some reason, on at least 10.13 and 10.12 :/

Example: https://travis-ci.org/geerlingguy/ansible-role-mas/builds/372237849

"Sign in to MAS" task fails with Ansible 2.8

I've specified mas_email and mas_password in my configuration as follows:

mas_email: [email protected]
mas_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256 (...etc...)

This causes the "Sign in to MAS when email and password are provided" task to be run, but fail. Two things happen:

First, we get this:

[DEPRECATION WARNING]: evaluating [email protected] as a bare variable, this behaviour will go away and you might need to add |bool to the 
expression in the future. Also see CONDITIONAL_BARE_VARS configuration toggle.. This feature will be removed in version 2.12. Deprecation 
warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.

This is a result of the task doing when checks against mas_email and mas_password without the |bool cast, obviously. But more seriously, this happens:

FAILED! => {"msg": "The conditional check 'mas_email' failed. The error was: template error while templating string: unexpected char '@' at 14. String: {% if [email protected] %} True {% else %} False {% endif %}

The error appears to be in '/path/to/playbookdir/roles/geerlingguy.mas/tasks/main.yml': line 11, column 3, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:


- name: Sign in to MAS when email and password are provided.
  ^ here
"}

So, despite Ansible 2.8 saying it has merely deprecated the old behavior, it seems to have also changed enough to actually break in this case.

xcode10.1 build fails - Xcode 10.2 cannot be installed on macOS 10.13.

From failed build: https://travis-ci.org/github/geerlingguy/ansible-role-mas/jobs/691345212

mas: A full installation of Xcode.app 10.2 is required to compile this software. Installing just the Command Line Tools is not sufficient.

Xcode 10.2 cannot be installed on macOS 10.13.
You must upgrade your version of macOS.
Error: An unsatisfied requirement failed this build.

mas install over ssh

Hi,

I'm trying to install apps through ssh and I encountered a problem in mas cli project. Only if I use sudo the app is installed, I don't know if I'm doing anything wrong but putting "become: true" in every task except the homebrew one solved the problem.

I don't know if this is the correct communication channel but I can't see any email in your info to contact you directly.

Thanks in advanced and sorry for the inconveniences.

Deprecate this role in favor of the new geerlingguy.mac collection

I have consolidated my macOS-related roles into the new geerlingguy.mac collection.

This collection contains the exact same copy of this role at version 3.2.0 in its 1.1.1 release.

All future work will go into the collection role.

Migration steps:

1. Make sure you're running at least Ansible 2.9 (Ansible Core 2.10 or Ansible 3.0.0 or later recommended).
2. Install the collection: ansible-galaxy collection install geerlingguy.mac (you can also specify collections: inside your requirements.yml file separately from roles:).
3. Change all references to the geerlingguy.mas role to geerlingguy.mac.mas.

If you have any migration issues, please consider opening an issue on the geerlingguy.mac collection repository, a this repository will be archived, and the role on Galaxy will be marked as 'deprecated'.

TODO:

• Add a deprecation note to the README of this role and release a new tag so it appears on Galaxy.
• Add a deprecation note to the role's repository description.
• Archive the repository.

`mas_uninstalled_apps`, like homebrew equivalent

Similar to the equivalent functionality in the homebrew role, it would be nice to be able to specify a list of apps to explicitly exclude from the system.

I make this feature request as a happy user of the homebrew role :)

async install

Hi, thanks for all the work on this. I was able to successfully install apps with this role but I've noticed with some huge apps (such as xcode) this task can run for a really long time depending on connection speed. Eventually, once the installation completes the play stops with a connection error: Failed to connect to the host via ssh .... Operation timed out.

Would it be possible to add async and poll to the Ensure configured MAS apps are installed task? Or, is there another way I can setup my playbook/tasks to avoid the connection issue? Thanks

"when statements should not include jinja2 templating delimiters"

I'm using Ansible 2.3.1.0 and I encountered this warning:

TASK [ansible-role-mas : Ensure configured MAS apps are installed.] ****************************************************************
[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: '{{ item.id|default(item) }}' not in mas_list.stdout

This role doesn't work correctly when run on macOS 10.13+ versions

Due to the problem described here, the signin seems to have been disabled when run on macOS 10,13+ versions.

This is the output of the mas signing <AppleID> <password> command:
Error: The 'signin' command has been disabled on this macOS version. Please sign into the Mac App Store app manually.

The same message shows up when trying to use the --dialog flag.

deprecated bare variable use

Getting the following warning:

[DEPRECATION WARNING]: evaluating [{'id': 123, 'name': 'Foo'}] as a
bare variable, this behaviour will go away and you might need to add |bool to the expression in the future. Also see
CONDITIONAL_BARE_VARS configuration toggle.. This feature will be removed in version 2.12. Deprecation warnings can be disabled by
setting deprecation_warnings=False in ansible.cfg.