Including rootscript in IA package will break if url is present, but empty

[kbotnen]

Stumbled upon this issue. It is only a problem if you bundle stuff into a package.

If you are downloading resources from an URL this does not apply!

if you bundle a rootscript in the package you have to do the following:

a: Remove the "url" parameter, even if it is empty

or

b: Include the "url" AND the "hash" parameter

This will not work

  "preflight": [
    {
      "file": "/Library/installapplications/scripts/root/05-preflight.py",
      "name": "Preflight",
      "type": "rootscript",
      "url": ""
    }
  ]

This will work

  "preflight": [
    {
      "file": "/Library/installapplications/scripts/root/05-preflight.py",
      "name": "Preflight",
      "type": "rootscript"
    }
  ]

This will also work

  "preflight": [
    {
      "file": "/Library/installapplications/scripts/root/05-preflight.py",
      "name": "Preflight",
      "type": "rootscript",
      "url": "",
      "hash": "a_generated_256_hash_value"
    }
  ]

The issue is easily solved by removing empty hashes from your json, which probably is a good habit anyway.

The confusion arrives since sometimes its allow with an empty hash, like this: which also will work:

"setupassistant": [`
    {
      "file": "/Library/installapplications/packages/DEPNotify-1.1.5.signed.pkg",
      "hash": "a_generated_256_hash_value",
      "name": "DEPNotify",
      "packageid": "menu.nomad.DEPNotify",
      "type": "package",
      "url": "",
      "version": "1.1.5"
    }
  ]

It might also be that the use of generatejson.py does avoid this issue, but if you handcraft your json you have to be careful.

I think this issue is best solved by archiving this issue as part of documentation of a cornercase. I will also try to make a general addition to the documentation (as a PR) about avoiding empty hashes in your jsonfile, in case of handcrafting or copy/paste from other sources.

K