Filter Munki deployments for specific hardware with installable_condition

I recently encountered a software update that offered high-resolution support for MacBook Pro Retina models. However, in internal testing, it also produced problems with MacBook Air systems — but there were no reports of problems on any other models.

Based on experience with conditional_items in Munki manifests, I decided to look for an equivalent in pkginfo files. The installable_condition key let me embed an NSPredicate condition based on the machine_model attribute. As long as the expression evaluates as “true,” the payload is considered installable. Note that this will increase the the number of warnings you see from your managed clients if you watch such things through MunkiWebAdmin or other methods.

My first attempt filtered on “MacBookAir,” matching all systems that were not MacBook Airs. I tested it with an extremely handy NSPredicate test script from Greg Neagle.

<key>installable_condition</key>
<string>NOT machine_model BEGINSWITH "MacBookAir"</string>

That was fine and it worked. However, I was convinced that more specifically matching this update with MacBook Pro Retina models (MacBookPro10,1 and MacBookPro10,2) made sense. So, I tried out another condition:

<key>installable_condition</key>
<string>machine_model BEGINSWITH "MacBookPro10,"</string>

I had slight concern that there might be future non-Retina models whose identifiers might start with the same “MacBookPro10” string. The 1 and 2 revisions might not be the end of the MacBookPro10 lineup. Any future rMBP revisions might not work with this particular software update, so I narrowed down the filter further.

<key>installable_condition</key>
<string>machine_model MATCHES "MacBookPro10,[12]"</string>

This, again, tested out successfully for. The trick with this last variant was that “MATCHES” allowed the use ICU regular expressions in the filter. I chose the “[12]” pattern to match on either “1” or “2.”