Using AutoPkg to build a Cisco AnyConnect installer

HCS Technology Group posted a white paper recently, showing how to deploy Cisco AnyConnect using Jamf Pro. As part of that documentation, HCS described how to create an installer choices XML file and then use it to create a custom Cisco AnyConnect installer package.

It’s possible to replicate this packaging workflow, including generating an installer choices XML file, using AutoPkg. For more details, please see below the jump.

In this example, there are going to be multiple AutoPkg recipes and support files referenced:

• CiscoAnyConnect.download.recipe – Download recipe for the vendor-supplied Cisco AnyConnect disk image with the vendor-supplied installer package stored inside.
• CiscoAnyConnect.pkg.recipe – Package recipe for Cisco AnyConnect, which generates an installer choices XML file and wraps both the installer choices XML file and the vendor-supplied installer package inside a separate installer package generated by AutoPkg
• Example.xml – Sample VPN profile for Cisco AnyConnect’s VPN module
• Cisco AnyConnect package recipe override – This is the AutoPkg recipe override where you’re defining how the installer choices file is configured and other information being supplied to the Cisco AnyConnect installer by the AutoPkg package creation process.

Important information:

A. You absolutely must create an AutoPkg override to work with these recipes. The download location, configuration for the installer choices XML file and other settings are not included in the AutoPkg recipes themselves and must be defined in the override.

B. The example recipes as written include the following assumptions:

• You’re using the Cisco AnyConnect Umbrella module.
• You’re adding the necessary configuration information for the Cisco AnyConnect Umbrella module to the AutoPkg recipe override.
• You may be using the Cisco AnyConnect VPN module.

C. The Cisco AnyConnect disk image does not have a set address for downloading it, so you will need to do one of the following:

• Download the disk image from Cisco and host it yourself somewhere.
• Change the download URL in the AutoPkg recipe override to match wherever you can currently download the Cisco AnyConnect disk image from.

D. To configure the installer choices XML file, you must designate what modules you want to include using ones and zeros in the AutoPkg override. By default, the .pkg recipe is configured to install all modules:

To change this, change one to zero for the modules you don’t want to install. For example, the configuration below will configure the AnyConnect installer to only install the AnyConnect Umbrella module:

E. If you do not want to have the VPN module installed or enabled, you will need to set the CHOICE_VPN and DISABLE_VPN settings in the recipe override. Please see below for an example:

In this example, the CHOICE_VPN setting is set to zero and the DISABLE_VPN setting is set to true.

F. These recipes allow you to hide the Cisco-provided AnyConnect installers, so that your users will not be able to see them in the Finder. (They will still be visible via the Terminal.) Like the installer choices selection, this can be set using ones and zeros in the AutoPkg override.

To hide, set the HIDE_UNINSTALLERS setting to one:

To not hide the uninstallers, set the HIDE_UNINSTALLERS setting to zero:

G. It’s possible to disable the customer feedback functionality through the installer. To set this to be disabled, set the DISABLE_CUSTOMER_EXPERIENCE_FEEDBACK setting to true.

To leave the customer feedback functionality enabled, set the DISABLE_CUSTOMER_EXPERIENCE_FEEDBACK setting to false.

Please see below for the example .download and .pkg recipes, example VPN XML file and example .pkg recipe override:

Download recipe:

Package recipe:

Example VPN XML file:

Example .pkg recipe override: