Escrow Buddy Deployment

To deploy Escrow Buddy using Applivery, you will need to upload the compressed App package (.zip) to your App Distribution section and configure it with a post-installation script.

First, download the Escrow Buddy .pkg installer from the GitHub repo.

Once downloaded, compress the .pkg file by right-clicking on it and selecting Compress, which will generate a .zip file.

Next, log in to the Applivery Dashboard and navigate to the App Distribution section. From there, follow the steps outlined in our documentation:

1. Create your first App.

2. Upload your first Build.

Next, head to the Device Management section and select Resources (1). Select the Scripts (2) section from the left-hand menu and click on the + Create Script button (3).

Copy the provided bash script, and Create (4) it as Rotation FileVault Key Script.

#!/bin/bash
defaults write /Library/Preferences/com.netflix.Escrow-Buddy.plist GenerateNewKey -bool true
exit 0

Now, head to any of your Policies (1) or create a new one. From the left-hand menu, select the Apps (2) section and click the + Add App (3) button.

In the modal view, navigate to the Applivery tab. Set the platform to macOS, choose Your Workspace as the App origin, and search for the Escrow Buddy App you previously created. For the Build selection, choose Last to ensure the latest version is always deployed.

Continue to the next step and select Force Install as the install mode. In the Configuration section, select Post-install and paste your script.

#!/bin/bash

APP_NAME="Escrow Buddy.app"
APP_BUNDLE_ID="com.netflix.Escrow-Buddy"
APP_PATH="/Applications/${APP_NAME}"

# Create the app structure with appropriate permissions
sudo mkdir -p "${APP_PATH}/Contents/MacOS"
sudo mkdir -p "${APP_PATH}/Contents/Resources"

# Verify if the structure was created successfully
if [[ ! -d "${APP_PATH}/Contents/MacOS" ]]; then
    echo "Error: Could not create the application structure"
    exit 1
fi

# Create Info.plist file
sudo tee "${APP_PATH}/Contents/Info.plist" > /dev/null <


	CFBundleIdentifier
	${APP_BUNDLE_ID}
	CFBundleName
	Escrow Buddy
	CFBundleVersion
	1.0.0
	CFBundleShortVersionString
	1.0.0
	CFBundleExecutable
	EscrowSecurityAlert
EOF

# Create an empty executable with appropriate permissions
sudo touch "${APP_PATH}/Contents/MacOS/${APP_NAME}"
sudo chmod +x "${APP_PATH}/Contents/MacOS/${APP_NAME}"

# Verify that the app exists
ls -ld "${APP_PATH}"

Next, we need to configure the Policy to enable FileVault on the Devices. To do this, follow the steps outlined in our documentation under the Recovery Key Management – Auto section.

Once FileVault is properly enabled, it’s important to add the Rotation FileVault Key Script to ensure that any invalid or missing FileVault recovery keys are automatically detected and remediated. This guarantees that Applivery always retains a valid, escrowed key for each device.

To add the script, navigate to Scripts from the left-hand menu and click on the + Add Script button. Then search for and select the Rotation FileVault Key Script that was previously uploaded to the Resources section. For the Execution method, we recommend choosing Loop and setting the repetition interval according to your organizational needs (e.g., every 7 days).

Finally, click Add to include the script in the Policy and Save changes to deploy it..