cyber.hendryadrian.com
Security News · jamf.com

Jamf Details ALME Mac App Deployment and Integrity Checks

· Original article ↗

Summary

Jamf says its ALME engine deploys and updates catalogued Mac apps through blueprints, checking checksums and developer signatures before installation. Jamf also describes its Full Disk Access requirement and related compatibility limits.

Key points

  • ALME delivers catalogued non–App Store Mac apps through blueprints and automatically installs and updates selected apps.
  • Jamf says apps download directly from vendors over TLS; ALME checks each download's checksum and developer signature and skips installs that fail verification.
  • Maintenance windows let administrators control when downloads occur; users are notified when an app must close for an update.
  • Self Service+ 2.33.0 bundles the ALME binary, which Jamf identifies as ALME.app with processes named ALME and alme-agent.
  • Jamf Pro 11.33.0 provides Full Disk Access through a PPPC profile; without it, updates to apps in Desktop, Documents, or Downloads fail, while updates in /Applications still work.
  • Jamf says ALME remains idle and installs nothing until an App Catalog app is added to a blueprint.

Article Details

Event Type
Jamf announced the App Lifecycle Management Engine (ALME), a system for deploying and updating third-party Mac apps through blueprints.
Impact
ALME automates vendor-direct app downloads, installation, and updates, with checksum and developer-signature verification before installation. It is bundled with Self Service+ 2.33.0. Jamf Pro 11.33.0 provides Full Disk Access through a PPPC profile; without that permission, updates to apps in Desktop, Documents, or Downloads fail, while updates in /Applications still work.

Vendors

AppleApple’s declarative device management (DDM) changes who does the work. Instead of sending a command and waiting to see if the device follows through, you declare the state you want. The device works to reach that stateJamfJamf takes a different approach.

Products

App Lifecycle Management Engine (ALME)The next generation of app deployments is the App Lifecycle Management Engine (ALME). It delivers a curated catalog of non-App Store Mac apps through blueprints, and the catalog keeps growing.Jamf ProJamf Pro 11.33.0 delivers that permission automatically through a Privacy Preferences Policy Control (PPPC) profile for Self Service+. MacOS gives an embedded app the permissions of its host app, so the profile coversmacOSApp: ALME.app, at /Applications/Self Service+.app/Contents/MacOS/ALME.app (bundle ID com.jamf.alme)Self Service+Self Service+ 2.33.0 bundles the ALME binary, a lightweight background daemon that handles vendor downloads, installs and checksum and signature verification.

Related Articles