ogb912/micromdm
1
0
Fork 0
mirror of https://github.com/micromdm/micromdm/ synced 2026-08-07 01:55:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'temp/master' into v2dev

Browse Source
This commit is contained in:
Victor Vrantchan
2020-06-26 23:15:53 -04:00
parent 9c82771e0e 069f890f46
commit 5da90f36a3
49 changed files with 1772 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
website/LICENSE Normal file
View File

@@ -0,0 +1,21 @@
MIT License
Copyright (c) 2017 Victor Vrantchan
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

2
website/Makefile Normal file
View File

@@ -0,0 +1,2 @@
serve:
hugo serve

19
website/README.md Normal file
View File

@@ -0,0 +1,19 @@
This is the repository for https://micromdm.io
The website is built with [hugo](https://gohugo.io/). You're welcome to add to it.
# Adding a new blog post
1. Install [hugo](https://gohugo.io/)
2. Fork this repo and create a new branch (`git checkout -b my_post`)
3. Create a new blog post: `hugo new blog/my-post-title.md`
4. Open content/blog/my-post-title.md in your text editor and write an awesome blog post. You can use Markdown syntax for formatting.
5. Use `hugo serve` or `make serve` to view and edit this repo. Your local copy of the website will be visible at `http://localhost:1313`
6. Commit your changes (`git commit -m 'added my-post-title'`) and `git push` your branch.
7. Open a Pull Request.
# Making changes to the site
The templates for the site are all located in the `themes/micromdm` folder. You can view your changes instantly by running
`hugo serve` or `make serve` and opening `http://localhost:1313` in your browser.

7
website/archetypes/blog.md Normal file
View File

@@ -0,0 +1,7 @@
+++
title = "an awesome blog post"
date = "2015-08-24T13:04:37+02:00"
tags = ["mdm"]
author = ""
frontpage = true
+++

5
website/config.toml Normal file
View File

@@ -0,0 +1,5 @@
languageCode = "en-us"
title = "MicroMDM"
baseurl = "https://micromdm.io/"
theme = "micromdm"
canonifyUrls = false

61
website/content/blog/accounts.md Normal file
View File

@@ -0,0 +1,61 @@
+++
frontpage = true
author = "Victor Vrantchan"
tags = ["mdm", "dep","enterprise", "account", "apple"]
date = "2017-05-06T13:04:37+02:00"
title = "The business side of MDM - Do you know your DUNS Number?"
+++
Getting started with MDM is hard enough, but the toughest part is not technical, it's getting approval to create all the accounts with Apple in order to begin. I recently went through the whole process for my company and thought it would be useful to others if I blogged about it. Below is infromation about what accounts you might need, and how you might go about acquiring them.
<!--more-->
# Have your company's trust
When you sign up on behalf of your organization with Apple, the form will ask wether you're trusted to make such a decision on behalf of your company. The form will also ask for the contact person of your superior to verify. Apple will most surely call you and the contact you've specified during sign up to verify. I was contacted both during DEP approval and when opening an Enterprise Developer account.
My advice is to coordinate with the person whose name you write down, and make sure they're available that week. It will really help expedite the approval process if both you and your superior are around and able to take phone calls. In both cases, my conversation with Apple only took a few minutes.
# Have a DUNS number
The Developer program as well as DEP and VPP accounts require that you register with a DUNS Number. While many organizations already have one, not everyone does, and it might take a while to register for one.
Apple publishes a [help document](https://developer.apple.com/support/D-U-N-S/) and [lookup tool](https://developer.apple.com/enroll/duns-lookup/) in case you don't know yours.
If you're just applying now, keep this timeline in mind:
> While expediting your D-U-N-S Number creation process may enable you to receive your number sooner, it will still take up to 14 business days for D&B to provide updated information to Apple. You will not be able to use your number to enroll until this step has been completed.
# Create your Apple IDs
Apple will require you to create an AppleID for each account you create. If you're creating accounts on behalf of a company, it's important to remember you might not be the only one accessing it, and that one day you might leave and someone else will inherit that account. With that in mind, I went the route of creating a group in Gmail which has several aliases -- one for each administrative Apple ID.
# Sign up for an Enterprise Developer Account
An organizational developer account with Apple is important for any Mac Administrator. If you manage macs in your enterprise, you likely create and distribute scripts and internal applications. And when you do that, the software should always be signed. Beyond the ability to sign software, you also gain access to documentation which is not otherwise acccessible.
If you're looking to either develop an MDM, or manage one yourself (as opposed to signing up with a vendor), you will need an enterpise developer to get access to the MDM vendor certificate. It is called the `MDM CSR` option. Curiously, this certificate option is only available under iOS certificates, not macOS.
If you already have an enterprise account, but don't see the the `MDM CSR` option, it's because Apple requires special approval. The main administrator of your enterprise account must email Apple to ask for the option to be enabled.
If you're creating your enterprise account today, Apple will ask you if you're an MDM vendor. Select yes, even if you don't intend to use MDM beyond your own company's needs. During the phone call for approval, Apple inquired about our intended use, and I specified that it was for internal use. They did not object to this use.
{{<figure src="/images/mdm_vendor.png" class="screenshot" >}}
You can begin your enterprise developer enrollment [here](https://developer.apple.com/programs/enterprise/). This account also comes with a yearly cost of $299.
# Purchase your devices direct from Apple or through an authorized reseller
If you'd like to take advantage of the Device Enrollment Program(DEP), you must first buy your devices through an approved channel, like an authorized reseller or direct from Apple.
https://ecommerce.apple.com
# Sign up for DEP and VPP
Just like the developer account, DEP registration requires a DUNS Number and a phonecall from Apple for approval. The AppleID you sign up with must also be new/not associated with other accounts. You'll also be required to enable 2FA for each of these iCloud accounts.
You can begin the process at [deploy.apple.com](https://deploy.apple.com), unless you're an EDU organization, in which case sign up with Apple School Manager at [school.apple.com](https://school.apple.com/). Apple School Manager is a version of DEP reserved for educational institutions.

154
website/content/blog/certificates.md Normal file
View File

@@ -0,0 +1,154 @@
+++
frontpage = true
author = "Jesse Peterson"
tags = ["mdm", "certificate", "apple"]
date = "2017-05-11T13:04:37+02:00"
title = "Understanding MDM Certificates"
lastmod = "2019-12-19T13:03:00+08:00"
+++
Apple Mobile Device Management (MDM) requires the use of various digital certificates for its operation. But exactly which certificates and the various ways in which they are generated, acquired, signed, used, exported, imported, and managed within an MDM product may not be so clear. Generally speaking a commercial MDM product or service manages most of the complexity related to these certificates for you but in the case of an open source MDM much of that responsibility will land on you. In this post I hope to bring a better understanding of these certificates with the aim that you'll be managing at least a few of them yourself.
<!--more-->
This post assumes you have at least a basic familiarity of working with certificates, private keys, certificate authorities and the like. To learn more about these and the TLS/SSL protocols have a look at this [TLS & Certificate Survival Guide](http://www.zytrax.com/tech/survival/ssl.html).
# Apple Push Notification service certificate
Perhaps the most important certificate is the Apple Push Notification service (APNs) certificate (or just "push certificate"). Without going into too much detail about the how the [MDM protocol works](https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf) exactly suffice it to say that the [Apple Push Notification service](https://developer.apple.com/library/content/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/APNSOverview.html) (APNs for short) is crucial to how MDM operates. Push notifications are the only way to have a device talk to your MDM after initial enrollment.
However not just anybody can send these push notifications to Apple (and in turn to your devices). Only services that have acquired a special Apple-signed certificate for sending these push notifications are allowed. While APNs push notifications for MDM are *similar* to "normal" app-based APNs push notifications they are slightly different and are acquired in different vastly ways.
## Getting an MDM APNs certificate
There are a few different options for acquiring an MDM push certificate and each has its own pros and cons.
### Method A: Roll your own using an MDM Vendor Certificate
An *MDM Vendor Certificate* (or MDM CSR certificate) is a special certificate that can sign *other MDM APNs certificate requests*. These requests can then be submitted to Apple for signing to get the MDM push certificate. This certificate option is only available to members of the [Apple Developer Enterprise Program](https://developer.apple.com/programs/enterprise/) which has a cost of US$300/year. Victor Vrantchan talks about signing up for this account (and this specific certificate option) in [this blog post](/blog/accounts/).
This method is probably the most complicated option (due to the two-step nature of the certificates) and certainly the most expensive. However a developer account is a good resource for any Mac admin anyway, as Victor mentions, and this is probably the most Apple-supported option for hosting your own MDM as you're not beholden to any other entity or software than Apple for your certificates. This is the same method a commercial MDM vendor uses to generate certificates for their customers (and hence explains the two-step signing process — typically an actual MDM user/admin wouldn't be doing the "Vendor" steps).
The high-level overview of getting and using an MDM push certificate with a Vendor certificate is similar to this:
{{<figure src="/certificates/mdm_csr_process.png" title="Diagram showing certificate signing workflow for MDM Vendor Certificates" class="graphic" >}}
1. Sign up for an Enterprise account and request the *MDM CSR* certificate on the account (see [this blog post](/blog/accounts/))
2. Create a private key and an MDM CSR Vendor Certificate in the Apple portal
3. Once you have the MDM CSR Vendor certificate now generate another, separate "customer" or "end-user" certificate request.
4. This "customer" certificate request needs to be wrapped up and signed into a special format by the MDM Vendor certificate.
5. This signed request must then be uploaded to [identity.apple.com](https://identity.apple.com/) where Apple will issue the final actual push certificate that is used in conjunction with the private key for sending APNs MDM push notifications.
To see a walk-through on this process take a look at [this presentation on MicroMDM](https://www.youtube.com/watch?v=WGKT-PyHz6I&t=26m55s) starting at 26m55s. This process is also covered here in [Pepijn Bruienne's blog post](http://enterprisemac.bruienne.com/2015/06/06/mdm-azing-setting-up-your-own-mdm-server/). As well for actually working with these certificates [micromdm's mdmctl mdmcert tool](https://github.com/micromdm/micromdm/wiki/Generating-MicroMDM-MDM-Certificates) has documentation on getting started once all the Apple account details have been taken care of.
Once the final "customer" push certificates are created and downloaded from Apple (with e.g. *mdmctl mdmcert* & [identity.apple.com](https://identity.apple.com/)) they can be used directly with MicroMDM.
### Method B: Export a Profile Manager certificate
*Profile Manager* is Apple's reference MDM product (or proof-of-concept, depending on how jaded you are about it). It's bundled with [macOS Server.app](https://itunes.apple.com/us/app/macos-server/id883878097?mt=12) for US$20 and requires macOS (or a VM running it). It has a neat feature where with only an Apple ID it can submit a certificate request to Apple, have an MDM certificate signed, and returned back to it in one step. This skips over a bunch of the rigmarole in getting a push certificate.
This technique was probably first documented in 2011 as a part of [David Shuetz Black Hat 2011 presentation "Inside Apple’s MDM Black Box."](https://www.youtube.com/watch?v=OifARLlRMyU). [Page seven of his PDF](https://media.blackhat.com/bh-us-11/Schuetz/BH_US_11_Schuetz_InsideAppleMDM_WP.pdf) documents exporting the PKCS#12 certificate & key from Keychain Access.app once you've [turned on Profile Manager](https://help.apple.com/serverapp/mac/5.3/#/apd05B9B761-D390-4A75-9251-E9AD29A61D0C). The [MicroMDM Quickstart guide](https://github.com/micromdm/micromdm/wiki/Quickstart#getting-an-mdm-push-certificate) also has some documentation on getting at this certificate.
If you just want to try out MicroMDM (or another Open Source MDM solution) this is likely the easiest and quickest way to get an APNs push certificate. The downside is that it is an Apple-proprietary method of getting this certificate that's embedded inside Profile Manager. This probably makes it of questionable legality to use with anything other than Profile Manager. As well there is a nominal cost associated.
Once the Profile Manager certificate is exported as a `.p12` file it can be used directly with MicroMDM.
### Method C: Sign up for mdmcert.download
[mdmcert.download](https://mdmcert.download/) is a service created to issue MDM push certificates to organizations wishing to run open-source MDM solutions. The certificates are free of cost but per Apple, only *organizations* (and not individuals) may agree to request a certificate. Apple also requires gathering some information like business name, email addresses, etc. That may not be something you're willing to share or legally able to do for your organization.
That said it offers a method to get push certificates that's easier than method A, above, but isn't quite as easy as the Server.app method. As mentioned above it's free, too.
MicroMDM's [mdmctl mdmcert.download option](https://github.com/micromdm/micromdm/wiki/mdmcert.download) can be used to request an mdmcert.download APNs certificate when following the [mdmcert.download instructions](https://mdmcert.download/instructions). Once mdmctl decrypts the encrypted CSR request (which is then subsequently uploaded to [identity.apple.com](https://identity.apple.com/) in order to retrieve the certificate) the push certificates you download can be directly used with MicroMDM.
## Push certificate gotchas
Once you have an MDM APNs certificate you have the ability to send push notifications to devices that are enrolled in your MDM. But there are a couple of caveats that you want to keep in mind:
* MDM APNs certificates **expire yearly.** This of course means you'll need to renew the certificate with a similar process you followed to get the original certificate. Note that it **must be a renewal** and not a *new* APNs push certificate for a very important reason:
* The APNs Push "topic" (which is embedded in the push certificate and has a `com.apple.mgmt.` prefix for MDM) **can never change during the life of a device's enrollment.** Basically, this means a couple things:
* You can't just use *any* MDM APNs certificate; they're not interchangeable. When devices enroll into an MDM they are tied to that particular APNs certificate push topic.
* This is why a *new* certificate can't be used as a renewal — said new certificate would have a different Push topic and would not be able to be used for sending push notifications to your existing enrolled devices. When you renew the certificate on [identity.apple.com](https://identity.apple.com/) it must be submitted as a Renewal to a previously created certificate. This doesn't mean you have to use the same private key (which is bad practice), just that it is submitted as a renewal to Apple.
* If you're using the Server.app extraction method you'll want to keep that instance of Server.app (computer/VM) around so that you can fire it up to get the push certificate with the same topic renewed and exracted again. But hopefully you're only using that method as a test and not necessarily as your production MDM certificate.
* MDM APNs certificates are tied to an Apple ID — the account that is used to issue the APNs Push certificate on [identity.apple.com](https://identity.apple.com/). Because this is the only account that can issue renewals for your existing enrollments you'll want to keep track of its login credentials. Gentle reminder to always use 2FA as well.
* As with any certificate take note of what format the APNs certificate & key are in. Is it two separate PEM-encoded certificate and key files? Is it a single PKCS#12 file encrypted with a password? Knowing these details will be crucial to getting MicroMDM (or any MDM) up and running with them.
# Device Identity certificate
An MDM device enrolls into MDM with an identity certificate & key pair. This certificate and private key can either be a) outright *given* to the device or b) the device can request that a new certificate be signed on its behalf.
The former is done by embedding a PKCS#12 profile payload in the enrollment profile. This will become the device's identity certificate. The latter is done by the device by itself using the SCEP protocol to request a certificate to be signed. Using the SCEP protocol, for all its faults, is much more secure for a few reasons:
1. The private key is not transferred over the network. Using the 'embedded' method it is.
2. The private key is not in an enrollment profile on disk in a Download folder which may be inadvertantly exported, shared, or lost. If the identity is compromised you can essentially spoof the device connecting to the MDM server.
3. Each device has a unique certificate and private key generated for it to use.
The primary use of this device identity certificate is to authenticate the device to the MDM server whenever an HTTPS connection is made. Depending on how the MDM software and enrollment profile are configured the device either performs [TLS/SSL client authentication](https://en.wikipedia.org/wiki/Client_certificate) or it provides a [CMS](https://en.wikipedia.org/wiki/Cryptographic_Message_Syntax) detached signature of the MDM request using its identity key pair. In either case, this cryptographically "proves" that the device is using a certificate that *should* be already known to the MDM server and only belonging to that device.
In the case of SCEP you likely will never have to touch the identity certificate manually. It automatically enrolls and references the correct certificate. Older versions of MicroMDM and e.g. Project-iMAS required manually providing the device identity certificate & key pair in the enrollment profile but that's no longer needed, or recommended.
It is also possible to use this certificate to encrypt profiles to a device (and only that specific device in the case of unique per-device certificates). More on that later.
## Device Identity Certificate Authority
When using SCEP the device will be issued a certificate from a Certificate Authority (CA). While embedded-profile device identity certificates can also be issued from a CA (this is what [Commandment MDM](https://github.com/jessepeterson/commandment) does for example) they're likely just self-signed. Having a CA implies a certificate chain and associated trust concerns they bring. While not something you may be hands-on managing for MDM these are a few questions and concerns you'll want to think about when deploying your MDM:
* Where are your device identity certificates getting issued from, which CA?
* How do you trust this CA? Who owns/operates it?
* How do you *revoke* certificates for compromised devices or lost certificate & private key pairs?
* How is the MDM trusting the provided device certificate? Is it merely trusting that the *issuer* issued this certificate? Or is it verifying the contents of the device identity certificate itself?
In MicroMDM the SCEP CA is built-in using the [micromdm/scep](https://github.com/micromdm/scep) project. On each MDM check-in and MDM command it verifies that the certificate was issued by the built-in SCEP CA. Even with the aid of well-designed and straightforward SCEP systems that work with minimal configuration, it is good to understand where device certificates are issued from, how they actually get issued, and how to verify they are trusted. MicroMDM also [validates that the enrolled certificate matches the UDID of the device](https://github.com/micromdm/micromdm/pull/429) so that devices can only access their own command queue.
# Configuration Profile signing & encrypting certificates
Apple's [Configuration Profiles](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf) can be CMS signed and/or encrypted. To do that, you must encrypt them with a public key or sign them with a certificate, respectively.
Encrypting a Configuration Profile requires using a public key that the device has the private key to. This can be known through sending a SCEP profile, a certificate profile payload, or just using the device's enrollment identity already on the device once it's enrolled. When the device has the corresponding private key, it can decrypt the encrypted profile and install it. In this way, you can use a device's specific identify certificate to encrypt a profile so that *only the target device* can decrypt them.
Signing a Configuration Profile is also possible. For profile signing to be effective the profile should be signed by a certificate that the device trusts. This can be a certificate in the device's [trusted root store](https://en.wikipedia.org/wiki/Public_key_certificate#Root_programs) (similar to a browser's trusted root store) or it can be a certificate that the device is separately configured to trust. In the case of MDM we likely already have a few certificates that are necessarily trusted that we can use. For example the HTTPS web certificate of the MDM may either be trusted in the system root store or be configured as a part of the enrollment profile (say, for a self-signed certificate, more on that later). This may be used to sign profiles (or packages). Often folks will simply sign profiles with their Apple Developer certificate because the signer of those certificates exists in the trusted root store of the device and will just work without further changes or trust management.
Seeing as the trusted certificates on a device may be known to the MDM system (e.g. coming through in the enrollment profile) the possibility exists for the MDM system to sign profiles either on command or in an on-the-fly fashion. MicroMDM now has support profile for [signing a profile](https://github.com/micromdm/micromdm/releases/tag/v1.6.0) but not encrypting.. Pre-encrypted or signed profiles should also work.
# Configuration Profile trusted certificates
Configuration Profiles are able to add certificates to the trusted store of certificates of a device by using Configuration Profile payloads for certificates. Not only is this valuable in-and-of-itself for normal system administration tasks but also importantly for MDM these certificates can be embedded in the *enrollment profile* such that those certificates will be trusted by the system when the device is enrolled.
This has implications for MDM operation *especially* in the case of using [self-signed certificates](https://en.wikipedia.org/wiki/Self-signed_certificate) for the HTTPS server. By default a self-signed certificate on a normal website would simply not be trusted by a device and it's no different for an MDM server. However if we place the MDM server's self-signed HTTPS certificate inside the enrollment profile then the system will trust it and MDM operation can commence after enrollment. The same goes for profile signing mentioned above. However, this may not work on iOS devices.
# HTTPS certificate
The web server portion of MDM requires HTTPS. This of course implies [TLS/SSL](https://en.wikipedia.org/wiki/Transport_Layer_Security) certificates and the related trust issues they bring. That said an MDM server's use of TLS/SSL certificates isn't all that different from your typical web server's TLS/SSL configuration.
This means that the types of a certificates you can use are pretty much the same as you can use for a website. These include:
* A purchased TLS/SSL certificate from a reputable Certificate Authority provider like e.g. [Comodo](https://www.comodo.com/), [GlobalSign](https://www.globalsign.com/en/), [Entrust](https://www.entrust.com/), etc.
* MicroMDM supports [LetsEncrypt](https://letsencrypt.org/) (LE) certificate acquisition for automatic SSL configuration
* Note per usual LE operation this requires public internet inbound TCP port 443 access to your MDM server and properly working public DNS
* MicroMDM's use of Let's Encrypt is currently broken, but there are [workarounds](https://github.com/micromdm/micromdm/wiki/Generating-LetsEncrypt-Certs-with-the-Lego-Client)
* Using a [self-signed](https://en.wikipedia.org/wiki/Self-signed_certificate) (or private CA-signed) certificate
If self-signed or private CA-signed certificates are used then we must add those certificates to our enrollment profile using the appropriate configuration profile payloads as mentioned above. MicroMDM does this for us.
MDM is intended for mobile devices and as such there's a reasonable assumption it will be running in a place that is accessible from the public internet. While this is not a technical requirement — an MDM server can run behind a firewall or in a private network as long as APNs push notifications can be sent and received — a lot of the more interesting features of MDM like, say, Remote Wipe lose a lot of their luster without it.
So by far the easiest TLS/SSL configuration is done with LetsEncrypt. Just make sure your server is publicly accessible on port 443 at a domain name you control. MicroMDM should take care of the rest. That said self-signed & purchased SSL options are supported as well in MicroMDM.
# DEP token certificate
Your MDM server talks to Apple's [Device Enrollment Program](https://www.apple.com/business/dep/) API using OAuth tokens. However before you gain access to these tokens you have to complete a [PKI](https://en.wikipedia.org/wiki/Public_key_infrastructure) process where you upload a certificate (which contains a public key) that Apple will use to encrypt the tokens with. Once you've given Apple your public key you can download the encrypted tokens and subsequently decrypt them and start using them to connect to the DEP API (to e.g. fetch & sync devices, configure a DEP profile, etc.). This process is managed via the [Apple Business Manager](https://support.apple.com/guide/apple-business-manager/welcome/web) (ABM) interface once your organization has enrolled in ABM and of course have purchased devices that are registered in your ABM account. If you're a school there is the very similar Apple School Manager (ASM).
Like with the APNs certificate these DEP tokens (like the VPP tokens) expire yearly and this process must be done again to renew them.
# DEP anchor certificates
Remember how we said we could use self-signed HTTPS web certificates? And that we need to embed the trust information for the HTTPS certificate in the enrollment profile? For a manual enrollment (that is where to say where you visit the profile website manually) this is usually not a problem because the *initial* certificate prompt that one will get (like with any self-signed website) can be simply overridden by the admin doing the enrollment. However, what about a DEP MDM enrollment where there is no user doing the enrollment?
That's what the DEP anchor certificates are for. There's a special property on the DEP profile just for this scenario. Note that DEP profiles should not be confused with Configuration Profiles — DEP profiles are a completely separate JSON structure. This property is called `anchor_certs` in the DEP profile and it allows you to specify trusted certificates to Apple's DEP API. This property will instruct a device at DEP enrollment time to trust the given certificates when connecting to the MDM server over TLS/SSL.
# Conclusion
My hope is this overview has been helpful in untangling the various certificates used in the MDM protocol and perhaps sheds some light on some of the nuances and gotchas surrounding them.
But even so if you've still got questions or are having trouble working with any of these certificates come join us in the MDM-related [MacAdmins Slack channels](/) where we discuss topics like this.

57
website/content/blog/kext-whitelist.md Normal file
View File

@@ -0,0 +1,57 @@
+++
author = "Victor Vrantchan"
tags = ["mdm", "kext"]
date = "2017-11-13T13:04:37+02:00"
title = "Surviving the Kextpocalyse, Round 0"
frontpage = true
+++
There's an understandable sense of urgency in the MacAdmin community around MDM and Kernel extensions these days. If you've been [paying attention](http://www.richard-purves.com/2017/11/09/mdm-and-the-kextpocalypse-2/) you know that in order to be able to reliably deploy kernel extensions in an enterprise environment, DEP and MDM are becoming a requirement. Apple is likely not going to stop there, and both MDM and DEP will become a requirement for Mac management over the next year or two. But it all feels extremely rushed, and not every enterprise will be ready. Even Apple is not ready yet -- I recently came back from a vacation abroad, where I noticed I couldn't even log in to the DEP portal, because DEP was not available in the country.
If there's one thing we sysadmins are good at, it's thinking on our feet under pressure and coming up with _alternative_ solutions to problems in our path. Sure, MicroMDM might be a good solution longterm, but you're not ready to deal with the certificates, and deploy it yet. But you need a solution for your upcoming kext problems as early as today. I have one!
# The New Kext Rules
- User will be prompted to approve a kernel extension if the Mac is not enrolled in MDM.
- If there's an MDM, all kext installs are whitelisted.
- You'll be grandfathered in to new rules if the enrollment profile is already there.
With the above rules in mind, we can start working on an MDM, but short term our only problem is that we need the Mac to be considered enrolled. Turns out, this is actually somewhat trivial. Allow me to explain.
# MDM Enrollment Rules
Rolling out a new MDM might be hard, but enrolling into one isn't. When I was [just starting to play with MDM](https://groob.io/posts/mdm-experiments/), there was no public documentation of the spec, yet I was able to have a test device enrolled into an nginx server in just a few minutes. There's only two things you need to enroll into MDM before 10.13.2 rolls out: An HTTP Server that responds with HTTP `200 OK` to any request coming from the MDM. You won't be able to use that to install profiles, or do other things MDMs allow, but you'll be considered enrolled, which is what we're aiming for here.
# Hackery
So far we've established that we want enroll our entire Mac fleet into an MDM for the purpose of being grandfathered in to the default Kernel Extension whitelisting rule. Later, when 10.13.2+ ships with new Macs, or when we re-image(is that still a thing???) we'll remove the MDM enrollment and enroll in a proper MDM.
Now we need an enrollment profile. We'll use Profile Manager to create and export it, then a text editor to tweak it, and finally Munki/Puppet/Chef/ARD/Custom Pkg to deploy it to our Mac fleet.
1) Configure Profile Manger and export the default enrollment profile.
2) Create a Device Identity Certificate
By default the Profile Manger Enrollment Profile uses SCEP, but we'll get rid of that, and add a .p12 file instead. Export the certificate you created as a P12 file.
3) Use Apple Configurator to tweak the Enrollment Profile.
- Remove SCEP
- Remove any existing entries from Certificates
- Add your .p12 file as an entry to Certificates
Now open the enrollment profile in a text editor. There's a few more changes to do there.
- Find ServerURL and CheckinURL keys and change those to a URL that returns 200 OK no matter the request. An `nginx` or `caddy` instance with Let's Encrypt certs will do. `facebook.com` also works, although I don't recommend/endorse that.
- Find the `IdentityCertificateUUID` key, and make sure that the UUID there is identitical to the `PayloadUUID` for the .p12 payload. if it's not put the `IdentityCertificateUUID` uuid in that field.
Your Enrollment Profile is now ready. Feel free to deploy it to your fleet of <= 10.13.1 devices and you should be ready to survive the 10.13.2 rollout... for now.
I added a sample enrollment profile which should work for anyone who wants to try the above steps or double check their own: https://gist.github.com/groob/c54b3907498de18221f5c93d56083a54
# Conclusion
I wrote up the above workflow because I found it amusing that the requirement to be considered "Enrolled" are so light, but Apple is enforcing it everywhere.
Long term, I _do not endorse_, anything I've described above. If you're not yet using an MDM, take a look at setting one up. And set a DEP account as well. The days where you could ignore MDM are long gone, and any enterprise that does not have these services enabled over the next couple months will suffer.

259
website/content/blog/os_update.md Normal file
View File

@@ -0,0 +1,259 @@
+++
title = "Updating to Mojave?"
date = "2018-10-16T13:04:37+02:00"
tags = ["mdm", "dep", "os_update"]
author = "Victor Vrantchan"
frontpage = true
+++
Earlier this year Apple updated the [MDM Protocol Reference](https://developer.apple.com/enterprise/documentation/MDM-Protocol-Reference.pdf) document to add a previously undocumented key to the `AvailableOSUpdates` command.
| Key | Content |
| ------------------- | ----------------------------------------------------------------------------- |
| **IsMajorOSUpdate** | Set to true if this is a major OS update (e.g. 10.13.x to 10.14). macOS only. |
This got a few of us in the `#mdmdev` channel on MacAdmins Slack talking. We've tried scheduling OS Updates in the past, and MicroMDM has had support for all these commands for years. The user experience around them is not as great as it could be (more on this some time) so the feature doesn't get much use. But this update was intriguing. The documentation clearly stated that this would be for a _major_ os upgrade, but every time we ran the command, even on older systems, the only available options were point releases (10.13.5 to 10.13.6 for example). No matter what, the update was not listed.
Mojave was released, but we still didn't see anything. Someone speculated that Apple might have forgotten to add the necessary update to the catalog, and that's why we weren't seeing it. I ended up filing a bug report in early October asking for clarification on the documentation. Was I doing something wrong? Was the documentation mistaken?
Nothing really worked despite me trying this on 10.12, 10.13 and 10.14 betas. Until today...
{{<figure src="/os_update/os_update.png" title="" class="screenshot" >}}
Today, a new product key was added to the macOS Software Update catalog.
```
<key>041-14451</key>
<dict>
<key>ServerMetadataURL</key>
<string>http://swcdn.apple.com/[...]/macOSInstallerNotification_GM.smd</string>
<key>Packages</key>
<array>
<dict>
<key>Digest</key>
<string>f11446026976c362a451b89d354c2313af19a1a3</string>
<key>Size</key>
<integer>1821971</integer>
<key>MetadataURL</key>
<string>https://swdist.apple.com/[...]/macOSInstallerNotification_GM.pkm</string>
<key>URL</key>
<string>http://swcdn.apple.com/[...]/macOSInstallerNotification_GM.pkg</string>
</dict>
</array>
<key>PostDate</key>
<date>2018-10-16T20:05:00Z</date>
```
The `.pkg` file includes signed `OSXNotification.bundle` with Info.plist keys like this:
```
<key>FreeSpaceRequired</key>
<integer>12000000000</integer>
<key>HumanReadableName</key>
<string>macOS Mojave</string>
<key>ItemID</key>
<integer>1398502828</integer>
<key>ProductBuildVersion</key>
<string>18A391</string>
```
So this is a configuration update which includes information about the Mojave installer, with both the product version and the Mac App Store ItemID. Neat. Normally you don't see the full OS installer when running `softwareupdate`. It's in the App store and you have to download it like you would download an app. This must be a shim Apple is using to enable a MDM only feature.
A curious side effect of having the notification bundle come from the Software Update catalog, is that it's repsonsible for this notification, which shows up on user machines regardless of whether you have devices enrolled in MDM:
{{<figure src="/os_update/os_update_prompt.png" title="" class="screenshot" >}}
Let's see what happens when we follow the update steps via MDM.
Note, to spare you a lot of XML, I'll be referencing a few shorthand commands for interacting with the MDM. These are some simple wrappers that create cURL requests to the MicroMDM API, and map directly to the documented commands in the spec. You can [find them in the repo](https://github.com/micromdm/micromdm/tree/a230831725f173f779cf7e030a93a71b32e8ab13/tools/api), and combined wth [ngrok](https://github.com/micromdm/micromdm/tree/a230831725f173f779cf7e030a93a71b32e8ab13/tools/ngrok), you can test everything yourself without a production MDM setup.
1. ScheduleOSUpdateScan -- initiates a software update check.
```
./tools/api/commands/schedule_os_update_scan $udid true
```
2. AvailableOSUpdates -- once the scan is completed, we can see available updates.
```
./tools/api/commands/available_os_updates $udid
```
On a 10.12.6 laptop we see the following:
```
<dict>
<key>AllowsInstallLater</key>
<true/>
<key>AppIdentifiersToClose</key>
<array/>
<key>HumanReadableName</key>
<string>macOS Installer Notification</string>
<key>HumanReadableNameLocale</key>
<string>en</string>
<key>IsConfigDataUpdate</key>
<true/>
<key>IsCritical</key>
<false/>
<key>IsFirmwareUpdate</key>
<false/>
<key>MetadataURL</key>
<string>http://swcdn.apple.com/[...]/macOSInstallerNotification_GM.smd</string>
<key>ProductKey</key>
<string>041-14451</string>
<key>RestartRequired</key>
<false/>
<key>Version</key>
<string>2.0</string>
</dict>
```
Bingo!
Now we can schedule a OS Update
3. ScheduleOSUpdate for a product key, InstallASAP is the most aggressive install type.
```
./tools/api/commands/schedule_os_update $udid 041-14451 InstallASAP
```
4. Issue another Scan, followed by AvailableOSUpdates
```
./tools/api/commands/schedule_os_update_scan $udid true
./tools/api/commands/available_os_updates $udid
```
Now we see a new item.
```
<dict>
<key>DownloadSize</key>
<real>12000000000</real>
<key>HumanReadableName</key>
<string>macOS Mojave</string>
<key>HumanReadableNameLocale</key>
<string>en</string>
<key>IsConfigDataUpdate</key>
<false/>
<key>IsCritical</key>
<false/>
<key>IsFirmwareUpdate</key>
<false/>
<key>IsMajorOSUpdate</key>
<true/>
<key>ProductKey</key>
<string>_OSX_18A391</string>
<key>RestartRequired</key>
<true/>
<key>Version</key>
<string>18A391</string>
</dict>
```
Very strange ProductKey but I'll take it.
```
./tools/api/commands/schedule_os_update $udid _OSX_18A391 InstallASAP
```
```
<key>ErrorChain</key>
<array>
<dict>
<key>ErrorCode</key>
<integer>74</integer>
<key>ErrorDomain</key>
<string>MDMClientError</string>
<key>LocalizedDescription</key>
<string>Command requires DEP enrollment: ScheduleOSUpdate &lt;MDMClientError:74&gt;</string>
</dict>
</array>
<key>Status</key>
<string>Error</string>
```
Did you catch that? User Approved MDM is not enough. We need a [DEP enrollment](https://bugreport.apple.com/web/). No problem... a few seconds later.
```
./tools/api/commands/schedule_os_update $udid _OSX_18A391 NotifyOnly
```
```
<key>ErrorChain</key>
<array>
<dict>
<key>ErrorCode</key>
<integer>12008</integer>
<key>ErrorDomain</key>
<string>MCMDMErrorDomain</string>
<key>LocalizedDescription</key>
<string>Unsupported InstallAction for this ProductKey</string>
</dict>
</array>
```
Ah sorry for that detour. I wanted to see if `DownloadOnly` and `NotifyOnly` or `InstallLater` are supported actions. Nope!
But it's ok:
```
./tools/api/commands/schedule_os_update $udid _OSX_18A391 InstallASAP
<key>UpdateResults</key>
<array>
<dict>
<key>InstallAction</key>
<string>InstallASAP</string>
<key>ProductKey</key>
<string>_OSX_18A391</string>
<key>Status</key>
<string>Installing</string>
</dict>
</array>
```
Except nothing happens. I can confirm on the Mac there is no network activity. `AvailableOSUpdates` again. We get:
```
<dict>
<key>DownloadPercentComplete</key>
<real>0.0</real>
<key>IsDownloaded</key>
<false/>
<key>ProductKey</key>
<string>_OSX_18A391</string>
<key>Status</key>
<string>Idle</string>
</dict>
```
I tried this routine about 20 times and nothing was happening. Absolute madness. And then it occured to me. What if this works like iOS and you need to be plugged in. Sure enough. As soon as I plugged the power adapter in, `softwareupdated` began downloading _something_. `<real>12000000000</real>` bytes later I was prompted with a notification:
> Update Requested
> A new update was requested to be installed by an administrator.
And a single availabe option `Restart`. I clicked it, but nothing happened. So I checked `AvailableOSUpdates`:
```
<dict>
<key>DownloadPercentComplete</key>
<real>1</real>
<key>IsDownloaded</key>
<true/>
<key>ProductKey</key>
<string>_OSX_18A391</string>
<key>Status</key>
<string>Idle</string>
</dict>
```
Another `ScheduleOSUPdate _OSX_18A391`. Another notification to Restart. Clicking the button does nothing. I decided to look at logs:
```
2018-10-16 21:09:29.624110-0400 0x51e4 Default 0x8000000000002f1f 112 authd: Succeeded authorizing right 'com.apple.ServiceManagement.daemons.modify' by client '/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeinstalld' [596] for authorization created by '/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeinstalld' [596] (12,0)
2018-10-16 21:09:29.624497-0400 0x51f5 Default 0x8000000000002f1f 596 storeinstalld: (StoreFoundation) [com.apple.commerce.CKLegacy] MajorOSInstallDaemonDelegate: Non-interactive authorization for software install was successful
2018-10-16 21:09:29.624836-0400 0x51f5 Default 0x8000000000002f1f 596 storeinstalld: (StoreFoundation) [com.apple.commerce.CKLegacy] MajorOSInstallDaemonDelegate: Triggering OS installation via worker connection <NSXPCConnection: 0x7fb93ef11300> connection from pid 448 (uid: 0, gid: 0)
2018-10-16 21:09:29.625272-0400 0x4e80 Default 0x8000000000002f1f 719 storeinstallagent: (StoreFoundation) [com.apple.commerce.CKLegacy] MajorOSInstallController: Initialized with IA path: /Applications/Install macOS Mojave.app
2018-10-16 21:09:29.625356-0400 0x4e80 Default 0x8000000000002f1f 719 storeinstallagent: (StoreFoundation) [com.apple.commerce.CKLegacy] MajorOSInstallController: Starting configure
2018-10-16 21:09:29.625902-0400 0x4f83 Default 0x8000000000002f1f 719 storeinstallagent: (StoreFoundation) [com.apple.commerce.CKLegacy] MajorOSInstallController: Setting OSISTarget
2018-10-16 21:09:29.629410-0400 0x4e80 Default 0x0 719 storeinstallagent: (StoreFoundation) [com.apple.commerce.CKLegacy] MajorOSInstallController: helperToolDied
```
And then, just as I was about to copy these logs to my other computer, my mac rebooted. This was about 2 minutes after clicking on the Restart button.
I expected to get prompted with a install wizard, similar to going through the `Install macOS Mojave.app` process and having to click next a few times. To my surprise, I got the standard black screen with the Apple logo and a 37 minute progress indicator. 18 minutes after that I was staring at a Mojave login prompt. Hello Dark Mode.

114
website/content/blog/troubleshoot-dep.md Normal file
View File

@@ -0,0 +1,114 @@
+++
frontpage = true
author = "Victor Vrantchan"
date = "2017-11-06T13:04:37+02:00"
title = "How to troubleshoot your DEP/MDM Enrollments"
tags = ["mdm", "dep"]
+++
The [Device Enrollment Program](https://www.apple.com/business/dep/)(DEP) allows enterprises to configure their Macs to auto-enroll into a Mobile Device Management(MDM) server of their choice. DEP makes it possible to ensure that a new Mac [becomes managed during the unboxing process](https://blog.kolide.com/macos-on-boarding-at-kolide-fab71345986e), reducing the need for Netboot and complex imaging workflows. Of course, as any workflow that depends on the network, this enrollment process can fail, and it's important for an administrator to know how to troubleshoot it. This article has a few concrete steps that will help a macadmin using any MDM to debug why their enrollment process isn't working.
# DEP, in brief
To make the DEP process work, Apple maintains a list of your serial numbers in a server side database. During first boot, the Mac will contact a remote server(`iprofiles.apple.com`) to get an "Activation Record". This record contains the MDM enrollment URL and a few fields that specify Setup Assistant configuration.
{{<figure src="/troubleshoot-mdm/dep_enroll.gif" title="DEP Enrollment Screen" class="screenshot" >}}
In the WWDC session where DEP was introduced, Apple called it an _enrollment optimization_, and to this day, it lives to that characterization. If the setup assistant proceeds past the above screen, the DEP process is done, and the MDM is managing the Mac. At the very least, the enrollment profile should be installed.
Anyone can view what the current activation record for any mac looks like by running `sudo /usr/libexec/mdmclient dep nag`.
How does the activation record hold the enrollment URL for _your_ MDM? That part is configured by your MDM, by [talking to the API](https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/4-Profile_Management/ProfileManagement.html#//apple_ref/doc/uid/TP40017387-CH7-SW6) server at `mdmenrollment.apple.com`. The record that the MDM configures for your device looks roughly like the JSON structure below, which is almost identical in contents to the record your device receives.
```
{
"profile_name": "(Required) Human readable name.",
"url": "https://mdm.acme.co/mdm/enroll",
"allow_pairing": true,
"is_supervised": false,
"is_mandatory": false,
"await_device_configured": false,
"is_mdm_removable": true,
"anchor_certs": [],
"supervising_host_certs": [],
"skip_setup_items": ["AppleID", "Android", "TOS"],
"devices": ["SERIAL1","SERIAL2"]
}
```
As you can see, the Device Enrollment Program is nothing more than a matchmaking API to connect your device to its designated MDM server. I've attempted to summarize the DEP flow in the diagram below.
{{<figure src="/troubleshoot-mdm/dep_process.png" title="DEP Process" class="screenshot" >}}
# Troubleshooting Steps
While developing MicroMDM, we ran the enrollment steps many times, and often needed a way to find out why things weren't happening as we expected them to. Over time a common list of troubleshooting steps emerged. [Owen Pragel](https://twitter.com/opragel) wrote up the most common techniques to debug DEP and MDM on the [micromdm wiki](https://github.com/micromdm/micromdm/wiki/Troubleshooting).
### Debug Logging
To enable debug logging for the MDM processes on your Mac, [install this configuration profile](https://gist.github.com/opragel/2b9c518f9a27dce787ed45da832708e2). If you have a VM you're using to test a DEP workflow, it might be a good idea to add this profile to the VM image.
The `log` utility on macOS 10.12+ allows streaming very detailed logs with the `stream --info --debug` subcommand.
To filter out MDM specific log message, start by adding the following predicates.
```
log stream --info --debug --predicate 'subsystem contains "com.apple.ManagedClient.cloudconfigurationd"'
log stream --info --debug --predicate 'processImagePath contains "mdmclient" OR processImagePath contains "storedownloadd"
```
As you're watching the log stream, you might want to adjust the predicates to add or remove new conditions. [This blog](https://eclecticlight.co/2016/10/01/using-the-logs-in-sierra-some-practical-tips/) is a good primer on the log command. `man log` has some additional usage examples as well.
### Build a VM Image
The way I recommend you test your MDM workflows is by creating a VMWware Fusion VM using [AutoDMG](https://github.com/MagerValp/AutoDMG) and Joseph Chilcote's [vfuse](https://github.com/chilcote/vfuse). If you snapshot the VM before first boot, you'll be able to reset to the snapshot and re-enroll.
My `vfuse` template, which sets the serial number to DEP enabled Mac and uses an AutoDMG image:
```
{
"fusion_path": "",
"source_dmg": "/Users/groob/Desktop/osx-10.13.1-17B48.apfs.dmg",
"output_dir": "/Users/groob/Desktop",
"output_name": "dep-hs-groob",
"cache": false,
"mem_size": 4096,
"disk_type": 0,
"bridged": false,
"mac_address": "",
"enable3d": false,
"vnc_port": 5901,
"vnc_passwd": "",
"hw_model": "MacBookAir7,2",
"serial_number": "C02T9ZI1CXC4"
}
```
Build it with `sudo /usr/local/vfuse/vfuse -t dep-hs-groob.json --snapshot`.
_Note_ I really want to stress out that you must snapshot your VM before first boot. Otherwise the activation record is cached, and any changes you make to it on the MDM side, will not be reflected in your VM.
### Reset an enrollment
Thanks to Owen, we have one more useful [script to share](https://gist.github.com/opragel/12555098f5894267c3aba2a7c023a823) which can be used to trigger your test mac to an un-enrolled state. This is good for testing, although it's becoming clearer that over time VM or APFS snapshots are going to be the recommended way to reset your image.
If you're still using 10.12 or earlier, you can run these steps instead:
```
# Remove indicator that setup assistant has already run
sudo rm /var/db/.AppleSetupDone
# Clear all configuration profiles off machine (not entirely clean)
sudo rm -rf /var/db/ConfigurationProfiles/
# Remove Apple Push Notification service daemon keychain
sudo rm /Library/Keychains/apsd.keychain
# Reboot the machine. It should bring you back to setup assistant
# where you can re-enroll using DEP.
```
# Share your tips
You can find the above and more on the MicroMDM [wiki](https://github.com/micromdm/micromdm/wiki/Troubleshooting).
If you have a new tip to share, don't hesitate to edit the page and add it.

23
website/content/blog/welcome.md Normal file
View File

@@ -0,0 +1,23 @@
+++
author = "Victor Vrantchan"
tags = ["mdm"]
date = "2015-08-24T13:04:37+02:00"
title = "What's next for MicroMDM"
frontpage = true
+++
I first [wrote](https://groob.io/posts/mdm-experiments/) about experimenting with MDM at the end of 2015. Since then, Apple has made the MDM specification [public](https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html), many administrators are looking to swap imaging devices for a DEP workflow, and even commercial vendors [are taking notice](https://simplemdm.com/2017/03/07/deploy-munki-apple-dep-mdm/) of the [needs](http://blog.eriknicolasgomez.com/2017/03/08/Custom-DEP-Part-1-An-Introduction/) of our community. One thing has become increasingly clear — MDM will play a critical role in the future of managing Apple devices in the enterprise. And with the renewed interest in MDM from the macadmin community, it's only fair to be asked — What is the future of the MicroMDM project? <!--more-->
# Growing the community
Last summer I met Jesse Peterson at the Penn State Macadmins conference. Jesse is one of the [pioneers](https://github.com/jessepeterson/commandment) in developing an open source MDM project, and has helped me figure out a lot of the initial hurdles to get MicroMDM up and running. We've had a lot of opportunities to chat about [what features we'd like to see](https://github.com/micromdm/micromdm/issues/110) in an MDM server, and how to make the project easy to get started for new users.
Jesse and I will be speaking about MDM and DEP at a number of Mac conferences this year, starting with [macdevops::YVR](https://www.macdevops.ca/speakers/) in June.
If you're interested in the project, follow [@micromdm_io](https://twitter.com/micromdm_io) on Twitter or join the discussion on the [MacAdmins Slack](https://macadmins.herokuapp.com/) in the `#micromdm` channel.
# Focus on user needs
Long term, we're looking to make MicroMDM the solution of choice for Apple device management, focusing on usability, extensibility and security. To achieve this goal, MicroMDM development will focus on actual user needs. The immediate focus will be building our integration with [DEP](https://deploy.apple.com) and allowing administrators to provision macOS devices. We're looking at what to build next. If you have a specific need that would help you adopt MicroMDM, consider opening an [issue](https://github.com/micromdm/micromdm/issues/new) or sending an email to [hello@micromdm.io](mailto:hello@micromdm.io).

26
website/content/blog/wwdc20-v2.md Normal file
View File

@@ -0,0 +1,26 @@
+++
title = "Five years behind, Five years ahead"
date = "2020-06-22T00:00:00+05:00"
tags = ["mdm", "wwdc", "v2"]
author = "Victor Vrantchan"
frontpage = true
+++
Apple MDM is over 10 years old today. Initially, MDM was a protocol to manage iPhones, but later expanded to the growing range of Apple devices. MicroMDM started about five years ago, when a few of us in the MacAdmin community became curious about what the MDM could do. We were intrigued by the "zero touch" deployment, which was brand new at the time. Lots of things were different. Almost nobody was using MDM and Apple Business Manager for the Mac. There were some vendors (notably JAMF) that had support, but the rest of us, including commercial vendors were making do with our own agents/scripts and imaging. [DeployStudio](https://www.deploystudio.com), [Imagr](https://github.com/imagr) and [Restor](http://github.com/google/restor) were the common tools for setting up a new Mac. The MDM documentation itself was not accessible, except to registered vendors. I [wrote](https://groob.io/posts/mdm-experiments/) a quick post in 2015 about experimenting with MDM. About six months later, the MicroMDM project was officially announced.
Over the years, MicroMDM attracted some interest from different areas of the industry, which shows the project filling use-cases that aren't otherwise filled by other solutions.
- A few organizations with larger fleets adopted MicroMDM to manage their Mac devices.
- MicroMDM is the backend for multiple commercial startups. These are not necessarily the commercial products you use to manage your devices. Instead, custom workflows in education, healthcare and hospitality are being deferred to dedicated MDM services, and MicroMDM is a part of that story.
- MicroMDM's [SCEP server](https://github.com/micromdm/scep), a project created to support PKI in configuration profiles, became one of the more popular open source SCEP implementations, with many users unrelated to Apple MDM.
- As a lightweight project, un-encumbered by the usual business logic, it's the project of choice for many to validate the Apple protocol and try out new features. Every year after WWDC, MicroMDM is one of the first projects out there to implement any newly announced features.
- The project has over 1k stars on GitHub. More importantly, every release for the last few years has new, external contributors, most of whom are new to both Go and Apple MDM.
While I'm proud of the achievements highlighted above, and more, I have to also dwell on some things which give me anxiety as a maintainer.
- The project is still difficult to approach. A large motivation for building the project for me was to learn Go programming, and it shows. There's a general lack of documentation for developers, and some choices for writing code that haven't aged well.
- The project [is not recommended](https://github.com/micromdm/micromdm/blob/main/docs/user-guide/introduction.md#not-a-product) for many who'd like to use it. It remains one of the few maintained open source MDM solutions, but it's not what I'd recommend as a low-cost replacement of Profile Manager. I can't tell someone to use MicroMDM without also telling them they'll eventually have to write a bunch of code on their own to make it useful.
When I reflect on MicroMDM up to now, the aspect I'm most excited by, is the pedagogical one. MicroMDM inspired at least a few people to look at Go as an option. It also made the MDM features more accessible to those who wanted to see exactly how each feature works under the hood. So if I plan on maintaining MicroMDM going forward, and remain happy doing it, that's the area I should be spending more time on.
Todays is the first day of WWDC 2020. Today is also the day we begin working on the eventual v2 of MicroMDM. With the next version, I want to keep what makes MicroMDM so unique, but also make it a Mac management solution I could recommend to any organization, large or small. I also want to focus on expanding the number of contributors and power users by keeping a development blog, regular office hours and finding new opportunities to teach.
Let's [see](https://developer.apple.com/wwdc20/) what's new in managing Apple devices this year, then come together to build something new.

BIN
website/static/certificates/mdm_csr_process.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 318 KiB

BIN
website/static/images/mdm_vendor.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 52 KiB

BIN
website/static/os_update/os_update.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.9 MiB

BIN
website/static/os_update/os_update_prompt.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 25 KiB

BIN
website/static/troubleshoot-mdm/dep_enroll.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 962 KiB

BIN
website/static/troubleshoot-mdm/dep_process.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 66 KiB

20
website/themes/micromdm/LICENSE.md Normal file
View File

@@ -0,0 +1,20 @@
The MIT License (MIT)
Copyright (c) 2017 Victor Vrantchan
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

2
website/themes/micromdm/archetypes/default.md Normal file
View File

@@ -0,0 +1,2 @@
+++
+++

0
website/themes/micromdm/layouts/404.html Normal file
View File

20
website/themes/micromdm/layouts/_default/list.html Normal file
View File

@@ -0,0 +1,20 @@
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"{{with .Site.LanguageCode}} xml:lang="{{.}}" lang="{{.}}"{{end}}>
{{ partial "head.html" . }}
<body>
<main>
{{ partial "navigation.html" . }}
<div class="blog-post-list">
{{ range .Data.Pages }}
<div class="blog-post-list-box">
<a href="{{ .Permalink }}">{{ .Title }}</a>
<br />
<span class="post-date">{{ .Date.Format "Mon, Jan 2, 2006" }}</span>
<br />
</div>
{{ end}}
</div>
</main>
{{ partial "footer.html" . }}
</body>
</html>

25
website/themes/micromdm/layouts/_default/single.html Normal file
View File

@@ -0,0 +1,25 @@
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"{{with .Site.LanguageCode}} xml:lang="{{.}}" lang="{{.}}"{{end}}>
{{ partial "head.html" . }}
<body>
<main>
{{ partial "navigation.html" . }}
<div class="post">
<h1>{{ .Title }}</h1>
{{ if eq .Type "blog" }}
<span class="post-author">Author: {{ .Params.author }}</span>
<br />
<span class="post-date">Date: {{ .Date.Format "Mon, Jan 2, 2006" }}</span>
<br />
{{ if not (eq .Date .Lastmod) }}
<span class="post-date">Updated: {{ .Lastmod.Format "Mon, Jan 2, 2006" }}</span>
<br />
{{ end }}
<span class="reading-time">Reading Time: {{ .ReadingTime }} minutes</span>
{{ end }}
{{ .Content }}
</div>
</main>
{{ partial "footer.html" . }}
</body>
</html>

11
website/themes/micromdm/layouts/index.html Normal file
View File

@@ -0,0 +1,11 @@
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"{{with .Site.LanguageCode}} xml:lang="{{.}}" lang="{{.}}"{{end}}>
{{ partial "head.html" . }}
<body>
<main>
{{ partial "navigation.html" . }}
{{ partial "home.html" . }}
</main>
{{ partial "footer.html" . }}
</body>
</html>

31
website/themes/micromdm/layouts/partials/footer.html Normal file
View File

@@ -0,0 +1,31 @@
<footer class="primary-footer">
<div class="primary-footer__container">
<div class="primary-footer__logo">
<a href="/">
<img class="primary-footer__logo-image" src="/images/logo-inverted.svg" />
<span class="primary-footer__logo-text">MicroMDM</span>
</a>
</div>
<nav class="primary-footer__navigation">
<ul class="primary-footer__navigation-items">
<h1 class="primary-footer__navigation-header">Open Source</h1>
<li class="primary-footer__navigation-item"><a href="https://github.com/micromdm/micromdm/">View the Code on Github</a></li>
</ul>
<ul class="primary-footer__navigation-items">
<h1 class="primary-footer__navigation-header">Resources</h1>
<li class="primary-footer__navigation-item"><a href="/blog">Blog</a></li>
<li class="primary-footer__navigation-item"><a href="https://github.com/micromdm/micromdm/wiki">Docs</a></li>
<li class="primary-footer__navigation-item"><a href="https://github.com/micromdm/micromdm/releases">Releases</a></li>
</ul>
</nav>
</div>
</footer>
<script>
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-111323862-1', 'auto');
ga('send', 'pageview');
</script>

25
website/themes/micromdm/layouts/partials/head.html Normal file
View File

@@ -0,0 +1,25 @@
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
{{ .Hugo.Generator }}
{{ if .IsHome }}
<title>{{ .Site.Title }}</title>
{{ else }}
<title>{{ .Title }} &middot; {{ .Site.Title }}</title>
{{ end }}
<!-- Favicons -->
<link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon.png">
<link rel="icon" type="image/png" href="/images/favicon-32x32.png" sizes="32x32">
<link rel="icon" type="image/png" href="/images/favicon-16x16.png" sizes="16x16">
<link rel="manifest" href="/images/manifest.json">
<link rel="mask-icon" href="/images/safari-pinned-tab.svg" color="#5bbad5">
<meta name="theme-color" content="#ffffff">
<!-- CSS -->
<link rel="stylesheet" href="/css/normalize.css">
<link rel="stylesheet" href="/css/micromdm.css">
<!-- RSS -->
<link href="{{ .RSSLink }}" rel="alternate" type="application/rss+xml" title="{{ .Site.Title }}" />
</head>

113
website/themes/micromdm/layouts/partials/home.html Normal file
View File

@@ -0,0 +1,113 @@
<section class="hero">
<h1 class="hero__title">MicroMDM</h1>
<h2 class="hero__subtitle">bootstrap your mac deployment</h2>
<div class="hero__logo">
<img class="hero__logo-image" src="/images/logo.svg" />
</div>
<p class="hero__text">
MicroMDM is a project which provides an open source <a target="_blank" href="https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html">Mobile Device Management</a>
server for Apple devices. Our goal is to create a performant and extensible
device management solution for enterprise and education.
</p>
<a class="hero__cta" href="https://github.com/micromdm/micromdm/blob/master/docs/user-guide/quickstart.md">Get Started with MicroMDM</a>
</section>
<section class="documentation">
<h1 class="documentation__header">Documentation</h1>
<ul class="documentation__items">
<li class="documentation__item">
<header class="documentation__item-header">
<h1 class="documentation__item-title">Get started easily</h1>
<img class="documentation__item-image" src="/images/micromdm-docs.svg" />
</header>
<p class="documentation__item-description">
Read the quickstart tutorial for getting up and running with MicroMDM. The steps in this guide are intended to get you up and running as quickly as possible.
</p>
<a class="documentation__item-cta" href="https://github.com/micromdm/micromdm/blob/master/docs/user-guide/quickstart.md">View the Quickstart Guide</a>
</li>
<li class="documentation__item">
<header class="documentation__item-header">
<h1 class="documentation__item-title">Join the Community</h1>
<img class="documentation__item-image" src="/images/slack-logo.svg" />
</header>
<p class="documentation__item-description">
The best place to get help is the #micromdm channel on the MacAdmins Slack team. Join us there by getting an invitation at the link below.
</p>
<a class="documentation__item-cta" href="https://macadmins.org/">Join Us On Slack</a>
</li>
<li class="documentation__item">
<header class="documentation__item-header">
<h1 class="documentation__item-title">Contribute to MicroMDM</h1>
<img class="documentation__item-image" src="/images/wiki-logo.svg" />
</header>
<p class="documentation__item-description">
MicroMDM is open source and the core developers are eager to help you make your first Pull Request. Check out the contributing guide for more details.
</p>
<a class="documentation__item-cta" href="https://github.com/micromdm/micromdm/blob/master/CONTRIBUTING.md">Read the Contributing Guide</a>
</li>
</ul>
</section>
<section class="blog-teaser">
<h1 class="blog-teaser__header">What's new with MicroMDM?</h1>
{{ range first 1 .Data.Pages }}
<article class="blog-post">
<h1 class="blog-post__title">{{ .Title }}</h1>
<p class="blog-post__preview">
{{ .Summary }}
</p>
{{ if .Truncated }}
<div class="blog-post__actions">
<span class="blog-post__action blog-post__read-more-link">
<a href="{{ .RelPermalink }}">Read More…</a>
</span>
<div class="blog-post__additional-actions">
<span class="blog-post__action blog-post__view-all-link">
<a href="/blog">View All Articles</a>
</span>
<span class="blog-post__action blog-post__contribute-link">
<a href="https://github.com/micromdm/website">Contribute An Article</a>
</span>
</div>
</div>
{{ end }}
</article>
{{ end }}
</section>
<section class="do-more">
<h1 class="do-more__header">Do more with MicroMDM</h1>
<ul class="do-more__items">
<li class="do-more__item">
<header class="do-more__item-header">
<img class="do-more__item-image" src="/images/api.svg" />
<h1 class="do-more__item-title">Check out the API</h1>
</header>
<p class="do-more__item-description">
MicroMDM has a robust set of APIs for scheduling commands, reading device data and managing the server itself.
</p>
<a class="do-more__item-cta" href="https://github.com/micromdm/micromdm/issues/361">Explore the API</a>
</li>
<li class="do-more__item">
<header class="do-more__item-header">
<img class="do-more__item-image" src="/images/octocat.svg" />
<h1 class="do-more__item-title">Review the Code</h1>
</header>
<p class="do-more__item-description">
MicroMDM is free, open source, and permissively licensed! Read the code, contribute features, and offer feedback.
</p>
<a class="do-more__item-cta" href="https://github.com/micromdm/micromdm/">View the Source Code</a>
</li>
<li class="do-more__item">
<header class="do-more__item-header">
<img class="do-more__item-image" src="/images/branch.svg" />
<h1 class="do-more__item-title">Contribute your ideas</h1>
</header>
<p class="do-more__item-description">
The MicroMDM developers are eager to make a solution that works for everyone. Let us know what you need to use MicroMDM at your organization.
</p>
<a class="do-more__item-cta" href="https://github.com/micromdm/micromdm/issues/new">Create a GitHub issue</a>
</li>
</ul>
</section>

24
website/themes/micromdm/layouts/partials/navigation.html Normal file
View File

@@ -0,0 +1,24 @@
<header class="primary-header">
<div class="primary-header__logo">
<a href="/"><img class="primary-header__logo-image" src="/images/logo.svg" /></a>
</div>
<nav class="primary-nav">
<ul class="primary-nav__items" >
<li class="primary-nav__item">
<a href="/">Home</a>
</li>
<li class="primary-nav__item">
<a href="/blog">Blog</a>
</li>
<li class="primary-nav__item">
<a target="_blank" href="https://github.com/micromdm/micromdm/wiki">Docs</a>
</li>
<li class="primary-nav__item">
<a target="_blank" href="https://github.com/micromdm/micromdm">Code</a>
</li>
<li class="primary-nav__item">
<a target="_blank" href="https://github.com/micromdm/micromdm/releases/latest">Releases</a>
</li>
</ul>
</nav>
</header>

485
website/themes/micromdm/static/css/micromdm.css Normal file
View File

@@ -0,0 +1,485 @@
@font-face {
font-family: system;
font-style: bold;
font-weight: 700;
src: local(".SFNSText-Bold"), local(".HelveticaNeueDeskInterface-Bold"), local(".LucidaGrandeUI"), local("Ubuntu Bold"), local("Segoe UI Bold"), local("Roboto-Bold"), local("DroidSans"), local("Tahoma");
}
@font-face {
font-family: system;
font-weight: 900;
src: local(".SFNSText-Heavy"), local(".HelveticaNeueDeskInterface-Heavy"), local(".LucidaGrandeUI"), local("Ubuntu Heavy"), local("Segoe UI Heavy"), local("Roboto-Heavy"), local("DroidSans"), local("Tahoma");
}
@font-face {
font-family: system;
font-weight: 400;
src: local(".SFNSText-Light"), local(".HelveticaNeueDeskInterface-Light"), local(".LucidaGrandeUI"), local("Ubuntu Light"), local("Segoe UI Light"), local("Roboto-Light"), local("DroidSans"), local("Tahoma");
}
/* Global */
body {
position: relative;
font-family: "system", "Helvetica Neue", "Helvetica", "Arial", sans-serif;
color: #202532;
margin: 0;
}
main {
min-height: calc(100vh - 308px);
}
a {
font-weight: bold;
color: #4a9dff;
text-decoration: none;
}
p {
max-width: 700px;
font-size: 22px;
line-height: 1.45;
letter-spacing: -0.3px;
}
section {
min-width: 1280px;
}
/* Navigation */
.primary-header {
min-width: 1200px;
margin: 16px auto;
padding: 0 40px;
position: relative;
}
.primary-nav {
font-size: 16px;
color: #a8b9cd;
position: absolute;
right: 40px;
top: 15px;
}
.primary-nav__items {
list-style: none;
margin: 0;
padding: 0;
}
.primary-nav__item {
display: inline-block;
margin-left: 50px;
}
.primary-nav__item > a {
text-decoration: none;
color: #a8b9cd;
transition: 0.3s all;
}
.primary-nav__item > a:hover {
text-decoration: none;
color: #4a9dff;
}
section p {
margin: 0 auto;
}
/* Blog List */
.blog-post-list {
width: 700px;
margin: 100px auto 0 auto;
text-align: center;
}
.blog-post-list-box {
margin: 40px 0;
}
.blog-post-list-box > a {
font-size: 28px;
}
.blog-post-list-box > .post-date {
display: block;
margin-top: 10px;
font-size: 20px;
}
.post {
width: 700px;
margin: 0 auto;
margin-top: 100px;
}
.post ol,
.post ul {
font-size: 22px;
line-height: 1.45;
}
.post img {
max-width: 700px;
}
/* Hero */
.hero {
margin-top: 210px;
position: relative;
padding-bottom: 180px;
z-index: 3;
background: #fff;
}
.hero__title {
text-align: center;
font-size: 48px;
font-weight: 900;
letter-spacing: -0.9px;
margin-bottom: 0;
}
.hero__text {
text-align: center;
font-size: 22px;
max-width: 580px;
}
.hero__subtitle {
text-align: center;
font-size: 24px;
margin-top: 10px;
font-weight: normal;
}
.hero__logo {
margin: 60px 0;
text-align: center;
}
.hero__logo-image {
width: 204px;
height: 192px;
}
.hero__cta {
text-align: center;
font-size: 24px;
display: block;
margin: 65px 0 0 0;
}
.documentation {
background-color: #f9f9fb;
padding: 80px 0;
position: relative;
}
.documentation::before {
content: '';
display: block;
width: 1200px;
height: 94px;
filter: blur(36px);
background: rgba(32, 37, 50, 0.06);
box-shadow: 0 0 66px 0 rgba(32, 37, 50, 0.06);
position: relative;
z-index: 9;
border-radius: 100%;
position: absolute;
top: -40px;
left: 50%;
margin-left: -600px;
z-index: 1;
}
.documentation__header {
text-align: center;
margin: 0 0 68px;
font-size: 42px;
}
.documentation__items {
list-style: none;
padding: 48px 20px;
width: 1200px;
border-radius: 10px;
background-color: #fff;
box-shadow: 0 8px 20px 0 rgba(32, 37, 50, 0.14);
margin: 0 auto;
display: flex;
}
.documentation__item {
margin: 0;
padding: 0;
display: inline-block;
width: 397px;
text-align: center;
vertical-align: top;
position: relative;
flex: 1;
}
.documentation__item::after {
content: '';
border-radius: 2px;
background-color: rgba(74, 157, 255, 0.1);
width: 2px;
position: absolute;
top: 0;
right: 0;
bottom: 0;
}
.documentation__item:last-child:after {
display: none;
}
.documentation__item-header {
height: 200px;
}
.documentation__item-image {
height: 140px;
}
.documentation__item-title {
margin: 0 0 25px;
font-size: 24px;
}
.documentation__item-description {
font-size: 18px;
line-height: 1.67;
text-align: center;
width: 300px;
margin-bottom: 50px;
}
.documentation__item-cta {
display: block;
text-align: center;
position: absolute;
bottom: 0;
left: 0;
right: 0;
}
/* Blog Teaser */
.blog-teaser {
padding: 40px 0 128px;
margin-top: 48px;
z-index: 3;
position: relative;
background: #fff;
}
.blog-teaser__header {
font-size: 42px;
text-align: center;
}
.blog-teaser__header::after {
content: '';
display: block;
margin: 0 auto;
margin-top: 23px;
width: 600px;
height: 2px;
background-color: rgba(74, 157, 255, 0.1);
}
.blog-post {
width: 640px;
margin: 0 auto;
}
.blog-post__title {
font-weight: normal;
font-size: 32px;
}
.blog-post__preview {
font-weight: normal;
font-size: 18px;
line-height: 1.44;
}
.blog-post__actions {
position: relative;
margin-top: 13px;
font-size: 18px;
letter-spacing: -0.2px;
height: 48px;
}
.blog-post__additional-actions {
position: absolute;
top: 0;
right: -20px;
}
.blog-post__read-more-link {
position: absolute;
bottom: 0;
}
.blog-post__view-all-link {
display: inline-block;
margin-right: 20px;
}
.blog-post__view-all-link::after {
content: '';
display: inline-block;
position: relative;
top: 15px;
left: 10px;
width: 2px;
height: 44px;
background-color: rgba(74, 157, 255, 0.2);
}
.do-more {
background-color: #f9f9fb;
padding: 80px 0;
position: relative;
}
.do-more::before {
content: '';
display: block;
width: 1200px;
height: 94px;
filter: blur(36px);
background: rgba(32, 37, 50, 0.06);
box-shadow: 0 0 66px 0 rgba(32, 37, 50, 0.06);
position: relative;
z-index: 9;
border-radius: 100%;
position: absolute;
top: -40px;
left: 50%;
margin-left: -600px;
z-index: 1;
}
.do-more__header {
text-align: center;
font-size: 42px;
margin: 0 0 50px;
}
.do-more__items {
width: 1000px;
margin: 0 auto;
display: flex;
margin: 0 auto;
padding: 0;
list-style: none;
}
.do-more__item {
flex: 1;
margin: 0;
padding: 0;
position: relative;
}
.do-more__item:nth-child(2n) {
margin: 0 50px;
}
.do-more__item-description {
font-size: 16px;
line-height: 1.88;
margin-bottom: 70px;
}
.do-more__item-header {
text-align: center;
}
.do-more__item-cta {
position: absolute;
bottom: 0;
left: 0;
right: 0;
text-align: center;
background: #4a9dff;
color: #fff;
height: 40px;
font-weight: 400;
border-radius: 3px;
line-height: 40px;
font-size: 16px;
}
/* Footer */
.primary-footer {
height: 243px;
background: #4a9dff;
color: #fff;
padding-top: 65px;
min-width: 1280px;
}
.primary-footer__container {
width: 1170px;
margin: 0 auto;
position: relative;
}
.primary-footer__logo {
position: absolute;
top: 0;
}
.primary-footer__logo-text {
vertical-align: top;
font-weight: normal;
position: relative;
top: 15px;
left: 7px;
}
.primary-footer__navigation {
position: absolute;
right: 0;
top: 0;
}
.primary-footer__navigation-items {
list-style: none;
display: inline-block;
width: 200px;
margin: 0 0 0 116px;
padding: 0;
vertical-align: top;
font-size: 16px;
}
.primary-footer__navigation-header {
font-size: 18px;
font-weight: bold;
letter-spacing: 0.8px;
}
.primary-footer__navigation-item {
height: 30px;
}
.primary-footer a {
font-weight: normal;
color: #fff;
}

0
website/themes/micromdm/static/css/normalize.css vendored Normal file
View File

BIN
website/themes/micromdm/static/images/android-chrome-192x192.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 7.9 KiB

22
website/themes/micromdm/static/images/api.svg Normal file
View File

@@ -0,0 +1,22 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg width="160px" height="160px" viewBox="0 0 160 160" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch -->
<title>api-160</title>
<desc>Created with Sketch.</desc>
<defs></defs>
<g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="api-160">
<g id="Group-11">
<rect id="Rectangle-18" x="0" y="0" width="160" height="160"></rect>
<g id="API-Copy" transform="translate(4.000000, 25.000000)">
<g id="Group-14">
<path d="M121,20 L6,20 L6,86.6166888 C6,90.5878003 6.23352957,91.7971157 6.89367541,93.0314811 C7.38031917,93.9414258 8.05857422,94.6196808 8.96851893,95.1063246 C10.2028843,95.7664704 11.4121997,96 15.3833112,96 L111.616689,96 C115.5878,96 116.797116,95.7664704 118.031481,95.1063246 C118.941426,94.6196808 119.619681,93.9414258 120.106325,93.0314811 C120.436273,92.4145304 120.659648,91.8038375 120.800558,90.8514394 C121.853825,90.949742 122.921043,91 124,91 C124.951065,91 125.89301,90.9609503 126.824318,90.8843669 C126.584281,93.2338844 126.101643,94.5438866 125.397204,95.8610742 C124.351361,97.8166298 122.81663,99.3513612 120.861074,100.397204 C118.905519,101.443046 116.965801,102 111.616689,102 L15.3833112,102 C10.0341988,102 8.09448133,101.443046 6.13892578,100.397204 C4.18337022,99.3513612 2.64863878,97.8166298 1.60279622,95.8610742 C0.556953667,93.9055187 0,91.9658012 0,86.6166888 L0,6 C0,2.6862915 2.6862915,0 6,0 L121,0 C124.313708,0 127,2.6862915 127,6 L127,23.1305358 C126.011518,23.0441187 125.010911,23 124,23 C122.989089,23 121.988482,23.0441187 121,23.1305358 L121,20 Z M11,14 C13.209139,14 15,12.209139 15,10 C15,7.790861 13.209139,6 11,6 C8.790861,6 7,7.790861 7,10 C7,12.209139 8.790861,14 11,14 Z M23,14 C25.209139,14 27,12.209139 27,10 C27,7.790861 25.209139,6 23,6 C20.790861,6 19,7.790861 19,10 C19,12.209139 20.790861,14 23,14 Z M35,14 C37.209139,14 39,12.209139 39,10 C39,7.790861 37.209139,6 35,6 C32.790861,6 31,7.790861 31,10 C31,12.209139 32.790861,14 35,14 Z" id="Combined-Shape" fill-opacity="0.4" fill="#202532" fill-rule="nonzero"></path>
<path d="M36.984375,70 L30.7265625,70 L38.3203125,46.0058594 L46.1074219,46.0058594 L53.6484375,70 L46.9335938,70 L45.5449219,64.796875 L38.390625,64.796875 L36.984375,70 Z M42.1523438,51.4902344 L41.8535156,51.4902344 L39.515625,60.2792969 L44.4550781,60.2792969 L42.1523438,51.4902344 Z M56.0039062,46.0058594 L66.4101562,46.0058594 C72.0878906,46.0058594 74.9355469,49.9433594 74.9355469,54.4960938 C74.9355469,59.1191406 72.0351562,62.8632812 66.3222656,62.8632812 L62.296875,62.8632812 L62.296875,70 L56.0039062,70 L56.0039062,46.0058594 Z M62.2617187,50.7695312 L62.2617187,58.2050781 L64.3886719,58.2050781 C66.9550781,58.2050781 68.5722656,57.0976562 68.5722656,54.4960938 C68.5722656,52.0703125 67.1308594,50.7695312 64.8457031,50.7695312 L62.2617187,50.7695312 Z M84.1464844,70 L84.1464844,46.0058594 L77.8359375,46.0058594 L77.8359375,70 L84.1464844,70 Z" id="API" fill-opacity="0.4" fill="#202532"></path>
<path d="M124,52 C121.238576,52 119,54.2385763 119,57 C119,59.7614237 121.238576,62 124,62 C126.761424,62 129,59.7614237 129,57 C129,54.2385763 126.761424,52 124,52 Z M124,68 C117.924868,68 113,63.0751322 113,57 C113,50.9248678 117.924868,46 124,46 C130.075132,46 135,50.9248678 135,57 C135,63.0751322 130.075132,68 124,68 Z" id="Oval" fill="#202532" fill-rule="nonzero"></path>
<path d="M118.032152,79.2181818 C115.851707,78.6339759 113.79906,77.737339 111.925132,76.5791912 L104.73433,79.9973125 C103.005583,78.5475473 101.442705,76.9064637 100.078279,75.1066464 L103.616207,67.6638019 C102.731056,65.9753134 102.049551,64.1632844 101.604319,62.2603412 L94.1107167,59.5955117 C94.03741,58.7400875 94,57.8744125 94,57 C94,55.4060809 94.1243046,53.8411947 94.3637484,52.3145067 L102.246694,49.5112213 C102.740886,48.0754086 103.373229,46.703888 104.127842,45.4125383 L100.669978,38.1381279 C102.312088,36.109548 104.213418,34.2994159 106.32357,32.7581271 L113.869902,36.3452479 C114.9484,35.8152992 116.074462,35.3673337 117.239959,35.00948 L119.993956,27.2651485 C121.304438,27.0902736 122.641677,27 124,27 C125.358323,27 126.695562,27.0902736 128.006044,27.2651485 L130.760035,35.0094782 C131.925538,35.3673336 133.051599,35.8152988 134.130097,36.3452472 L141.676425,32.7581239 C143.786582,34.2994159 145.687912,36.109548 147.330022,38.1381279 L143.872158,45.4125383 C144.626771,46.703888 145.259114,48.0754086 145.753306,49.5112213 L153.636252,52.3145067 C153.875695,53.8411947 154,55.4060809 154,57 C154,57.8744125 153.96259,58.7400875 153.889283,59.5955117 L146.395681,62.2603412 C145.950449,64.1632844 145.268944,65.9753134 144.383793,67.6638019 L147.921721,75.1066464 C146.557295,76.9064637 144.994417,78.5475473 143.26567,79.9973125 L136.074868,76.5791912 C134.20094,77.737339 132.148293,78.6339759 129.967848,79.2181818 L127.262898,86.8246064 C126.191179,86.9405243 125.102535,87 124,87 C122.897465,87 121.808821,86.9405243 120.737102,86.8246064 L118.032152,79.2181818 Z M124,73 C132.836556,73 140,65.836556 140,57 C140,48.163444 132.836556,41 124,41 C115.163444,41 108,48.163444 108,57 C108,65.836556 115.163444,73 124,73 Z" id="Combined-Shape" fill="#4A9DFF"></path>
</g>
</g>
</g>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 5.4 KiB

BIN
website/themes/micromdm/static/images/apple-touch-icon.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 7.3 KiB

13
website/themes/micromdm/static/images/branch.svg Normal file
View File

@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg width="160px" height="160px" viewBox="0 0 160 160" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch -->
<title>branch-160</title>
<desc>Created with Sketch.</desc>
<defs></defs>
<g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="branch-160">
<rect id="Rectangle-18" x="0" y="0" width="160" height="160"></rect>
<path d="M107.6,43.301676 C99.6125,43.301676 93.2,49.6703911 93.2,57.603352 C93.2,62.8547486 96.125,67.4357542 100.4,69.8938547 L100.4,71.9050279 C100.4,79.0558659 93.2,86.2067039 86,86.2067039 C80.0375,86.2067039 75.3125,87.4357542 71.6,89.4469274 L71.6,55.5921788 C75.875,53.1340782 78.8,48.5530726 78.8,43.301676 C78.8,35.3687151 72.3875,29 64.4,29 C56.4125,29 50,35.3687151 50,43.301676 C50,48.5530726 52.925,53.1340782 57.2,55.5921788 L57.2,102.407821 C52.925,104.865922 50,109.446927 50,114.698324 C50,122.631285 56.4125,129 64.4,129 C72.3875,129 78.8,122.631285 78.8,114.698324 C78.8,110.899441 77.3375,107.547486 74.975,104.977654 C77.1125,102.407821 80.4875,100.396648 86,100.396648 C100.4,100.396648 114.8,86.0949721 114.8,71.7932961 L114.8,69.7821229 C119.075,67.3240223 122,62.7430168 122,57.4916201 C122,49.5586592 115.5875,43.1899441 107.6,43.1899441 L107.6,43.301676 Z M64.4,36.150838 C68.3375,36.150838 71.6,39.3910615 71.6,43.301676 C71.6,47.2122905 68.3375,50.452514 64.4,50.452514 C60.4625,50.452514 57.2,47.2122905 57.2,43.301676 C57.2,39.3910615 60.4625,36.150838 64.4,36.150838 Z M64.4,121.960894 C60.4625,121.960894 57.2,118.72067 57.2,114.810056 C57.2,110.899441 60.4625,107.659218 64.4,107.659218 C68.3375,107.659218 71.6,110.899441 71.6,114.810056 C71.6,118.72067 68.3375,121.960894 64.4,121.960894 Z M107.6,64.7541899 C103.6625,64.7541899 100.4,61.5139665 100.4,57.603352 C100.4,53.6927374 103.6625,50.452514 107.6,50.452514 C111.5375,50.452514 114.8,53.6927374 114.8,57.603352 C114.8,61.5139665 111.5375,64.7541899 107.6,64.7541899 Z" id="Shape" fill="#202532" fill-rule="nonzero"></path>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 2.2 KiB

9
website/themes/micromdm/static/images/browserconfig.xml Normal file
View File

@@ -0,0 +1,9 @@
<?xml version="1.0" encoding="utf-8"?>
<browserconfig>
<msapplication>
<tile>
<square150x150logo src="/mstile-150x150.png"/>
<TileColor>#da532c</TileColor>
</tile>
</msapplication>
</browserconfig>

BIN
website/themes/micromdm/static/images/favicon-16x16.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 905 B

BIN
website/themes/micromdm/static/images/favicon-32x32.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.4 KiB

BIN
website/themes/micromdm/static/images/favicon.ico Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 11 KiB

23
website/themes/micromdm/static/images/logo-inverted.svg Normal file
View File

@@ -0,0 +1,23 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg width="51px" height="48px" viewBox="0 0 51 48" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch -->
<title>micromdm-logo-sm-invert</title>
<desc>Created with Sketch.</desc>
<defs></defs>
<g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="micro-mdm-in-progress" transform="translate(-199.000000, -2998.000000)">
<g id="Group-18" transform="translate(0.000000, 2950.000000)">
<g id="footer">
<g id="facebook-open-source-w-logo" transform="translate(199.000000, 48.000000)">
<g id="micromdm-logo-sm-invert">
<polygon id="Triangle" fill="#366BE0" points="34 38 0 20 34 2.27373675e-13"></polygon>
<polygon id="Triangle" fill="#FFFFFF" transform="translate(34.000000, 29.000000) rotate(-180.000000) translate(-34.000000, -29.000000) " points="51 48 17 30 51 10"></polygon>
<polygon id="Path-3" fill="#80CFFF" points="17 29 0 39 17 48"></polygon>
<polygon id="Path-3" fill="#80CFFF" points="51 28 34 38 51 47"></polygon>
</g>
</g>
</g>
</g>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 1.4 KiB

BIN
website/themes/micromdm/static/images/logo.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 5.8 KiB

7
website/themes/micromdm/static/images/logo.svg Normal file
View File

@@ -0,0 +1,7 @@
<svg xmlns="http://www.w3.org/2000/svg" width="51" height="48" viewBox="0 0 51 48">
<g fill="none" fill-rule="evenodd">
<path fill="#366BE0" d="M34 38L0 20 34 0z"/>
<path fill="#4A9DFF" d="M17 10l34 18-34 20z"/>
<path fill="#80CFFF" d="M17 29L0 39l17 9zM51 28L34 38l17 9z"/>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 319 B

13
website/themes/micromdm/static/images/manifest.json Normal file
View File

@@ -0,0 +1,13 @@
{
"name": "",
"icons": [
{
"src": "/android-chrome-192x192.png",
"sizes": "192x192",
"type": "image/png"
}
],
"theme_color": "#ffffff",
"background_color": "#ffffff",
"display": "standalone"
}

38
website/themes/micromdm/static/images/micromdm-docs.svg Normal file
View File

@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg width="140px" height="140px" viewBox="0 0 140 140" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch -->
<title>micromdm-docs</title>
<desc>Created with Sketch.</desc>
<defs>
<filter x="-19.8%" y="-14.2%" width="139.6%" height="132.5%" filterUnits="objectBoundingBox" id="filter-1">
<feOffset dx="0" dy="2" in="SourceAlpha" result="shadowOffsetOuter1"></feOffset>
<feGaussianBlur stdDeviation="6" in="shadowOffsetOuter1" result="shadowBlurOuter1"></feGaussianBlur>
<feColorMatrix values="0 0 0 0 0.125490196 0 0 0 0 0.145098039 0 0 0 0 0.196078431 0 0 0 0.14 0" type="matrix" in="shadowBlurOuter1" result="shadowMatrixOuter1"></feColorMatrix>
<feMerge>
<feMergeNode in="shadowMatrixOuter1"></feMergeNode>
<feMergeNode in="SourceGraphic"></feMergeNode>
</feMerge>
</filter>
</defs>
<g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="micromdm-docs">
<g id="micro-mdm-140">
<rect id="Rectangle-18" x="0" y="0" width="140" height="140"></rect>
<g id="micromdm-docs" filter="url(#filter-1)" transform="translate(22.000000, 6.000000)">
<g id="Page-1">
<path d="M87.7714286,2.75862069 C87.7714286,1.23586207 86.5426286,0 85.0285714,0 C80.5275429,0 74.0571429,8.27586207 48,8.27586207 L15.0857143,8.27586207 L9.6,8.27586207 C4.29805714,8.27586207 0,12.5986207 0,17.9310345 L0,105.558621 L0,108.965517 C0,110.168276 0.770742857,111.18069 1.83908571,111.558621 C1.92548571,111.590345 2.01325714,111.62069 2.10651429,111.641379 C2.31222857,111.692414 2.52205714,111.724138 2.74285714,111.724138 C3.34217143,111.724138 3.89074286,111.525517 4.34194286,111.198621 C6.40868571,110.088276 9.44777143,107.586207 16.4571429,107.586207 L49.5126857,107.586207 C57.7412571,107.586207 87.7714286,104.670345 87.7714286,97.2551724 L87.7714286,6.89655172 L87.7714286,2.75862069 Z" id="Fill-1" fill="#80CFFF"></path>
<path d="M0,16.8353103 C0,15.7511724 0.312685714,14.6918621 0.898285714,13.7925517 C0.898285714,13.7925517 2.66742857,16.5511724 7.99954286,16.5511724 L93.3339429,16.5511724 C94.8068571,16.5511724 96,17.7870345 96,19.3097931 L96,117.240828 C96,118.764966 94.8068571,119.999448 93.3339429,119.999448 L6.66377143,119.999448 C2.98285714,119.999448 0,116.913931 0,113.105655 L0,16.8353103 Z" id="Fill-3" fill="#FFFFFF"></path>
<g id="Group-3" transform="translate(22.000000, 25.000000)">
<polygon id="Triangle" fill="#366BE0" points="34 38 0 20 34 2.27373675e-13"></polygon>
<polygon id="Triangle" fill="#4A9DFF" transform="translate(34.000000, 29.000000) rotate(-180.000000) translate(-34.000000, -29.000000) " points="51 48 17 30 51 10"></polygon>
<polygon id="Path-3" fill="#80CFFF" points="17 29 0 39 17 48"></polygon>
<polygon id="Path-3" fill="#80CFFF" points="51 28 34 38 51 47"></polygon>
</g>
</g>
<rect id="Rectangle-3" fill="#80CFFF" x="21" y="84" width="55" height="7" rx="2"></rect>
<rect id="Rectangle-3" fill="#80CFFF" x="21" y="100" width="41" height="7" rx="2"></rect>
</g>
</g>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.5 KiB

BIN
website/themes/micromdm/static/images/mstile-150x150.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 6.0 KiB

31
website/themes/micromdm/static/images/octocat.svg Normal file
View File

@@ -0,0 +1,31 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg width="160px" height="160px" viewBox="0 0 160 160" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch -->
<title>octocat-160</title>
<desc>Created with Sketch.</desc>
<defs></defs>
<g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="octocat-160">
<g id="Group-15">
<rect id="Rectangle-18" x="0" y="0" width="160" height="160"></rect>
<g id="octocat-svg" transform="translate(7.000000, 11.000000)" fill-rule="nonzero">
<path d="M116,115.50078 C116,123.50897 97.4192516,130 74.5019534,130 C51.5807484,130 33,123.50897 33,115.50078 C33,107.49259 51.5799671,101 74.5019534,101 C97.4192516,101 116,107.49376 116,115.50078 Z" id="puddle" fill="#9CDAF1"></path>
<g id="shadow-legs" transform="translate(50.000000, 110.000000)" fill="#7DBBE6">
<path d="M12.86625,19.288 L12.86625,8.688 C12.86625,7.3192 12.6238083,6.1744 12.218825,5.2076 C14.9029167,7.3364 15.0842583,12.6856 15.0842583,12.6856 L15.0842583,19.4872 C17.499275,19.6796 19.9934083,19.7964 22.5466833,19.8316 L22.4793167,13.0636 C22.1095833,3.8116 14.3447917,2.6792 14.3447917,2.6792 C11.5071667,2.0212 11.5494667,3.4756 11.8346,4.4152 C9.05063333,-0.4336 1.58938333,0.1928 1.58938333,0.1928 C-0.999925,1.1356 1.40334167,2.8356 1.40334167,2.8356 C5.47158333,4.3456 5.840925,8.8776 5.840925,8.8776 L5.840925,18.3264 C8.08125833,18.7184 10.4273417,19.0424 12.867425,19.2864 L12.86625,19.288 Z" id="Shape"></path>
<path d="M45.59,0.192 C45.59,0.192 38.127575,-0.4344 35.344,4.4156 C35.6291333,3.4756 35.6726083,2.02 32.8342,2.6784 C32.8342,2.6784 25.0698,3.8112 24.7000667,13.0628 L24.6319167,19.8412 C27.181275,19.8312 29.6750167,19.7396 32.0947333,19.5728 L32.0947333,12.6852 C32.0947333,12.6852 32.2768583,7.336 34.9601667,5.2072 C34.5551833,6.174 34.3127417,7.3184 34.3127417,8.6876 L34.3127417,19.3976 C36.7465583,19.18 39.0953833,18.886 41.3380667,18.5224 L41.3380667,8.8772 C41.3380667,8.8772 41.7078,4.3452 45.77565,2.8352 C45.77565,2.8312 48.1765667,1.1312 45.58765,0.1872 L45.59,0.192 Z" id="Shape"></path>
</g>
<path d="M147.890502,55.2884127 L148,54.7450124 C135.81361,52.3073401 123.307719,52.2826934 115.742161,52.5972318 C116.984968,48.1174074 117.358827,42.9627338 117.358827,37.2145843 C117.358827,28.9704711 114.262759,22.375337 109.236391,17.356807 C110.114725,14.5204846 111.287922,8.22150174 108.064758,0.157739529 C108.064758,0.157739529 102.378272,-1.64850878 89.5161196,6.96334827 C84.4776287,5.70362994 79.1153353,5.08159511 73.7452207,5.08159511 C67.8366085,5.08159511 61.866208,5.83429637 56.297823,7.36238948 C43.025052,-1.69584602 37.1657141,0.159695613 37.1657141,0.159695613 C33.3410912,9.72768671 35.7058657,16.8122331 36.4242535,18.5715354 C31.9289529,23.4249719 29.1844536,29.6206735 29.1844536,37.2165404 C29.1844536,42.9509973 29.8371423,48.0954992 31.4311262,52.5667169 C23.8010427,52.2889529 11.7515253,52.3957551 0,54.7465773 L0.107934142,55.2899775 C11.9302423,52.9246803 24.0556265,52.8425248 31.6391732,53.1296779 C31.9903502,54.0552971 32.381807,54.9531398 32.8205827,55.8208588 C25.3211152,56.0626308 12.5156677,57.0187649 0.243633952,60.4822079 L0.394976391,61.0142628 C12.7639945,57.5253907 25.6805046,56.5931209 33.1072339,56.3658239 C37.5880651,64.7214339 46.42224,70.1178795 62.1383897,71.812631 C59.9077508,73.3121653 57.6321393,75.8613344 56.7100063,80.1745005 C53.6702523,81.6290448 44.0476889,85.1793379 38.2743855,75.2455591 C38.2743855,75.2455591 35.0426182,69.3346633 28.8567405,68.8718537 C28.8567405,68.8718537 22.8562279,68.7799178 28.4426019,72.6126695 C28.4426019,72.6126695 32.4576737,74.5053767 35.2279834,81.6180907 C35.2279834,81.6180907 38.8418218,93.749726 56.2810072,89.8575093 L56.2810072,102.388968 C56.2810072,102.388968 55.9122322,106.821455 51.8502324,108.298299 C51.8502324,108.298299 49.450262,109.96058 52.0359886,110.882678 C52.0359886,110.882678 63.2955532,111.806341 63.2955532,102.574014 L63.2955532,88.9091996 C63.2955532,88.9091996 62.8489561,83.4900635 65.5101585,81.6063542 L65.5101585,104.050858 C65.5101585,104.050858 65.3263576,109.405834 62.5572211,111.437423 C62.5572211,111.437423 60.7102176,114.760419 64.7718264,113.838321 C64.7718264,113.838321 72.5243135,112.730395 72.8938706,103.68194 L73.0694591,80.9678883 L74.9328873,80.9678883 L75.1100401,103.68194 C75.4788151,112.730395 83.2316932,113.838321 83.2316932,113.838321 C87.2921287,114.760419 85.4462985,111.437423 85.4462985,111.437423 C82.6775531,109.405834 82.4933611,104.050858 82.4933611,104.050858 L82.4933611,81.8000066 C85.1529992,83.8718911 84.7079664,88.9088084 84.7079664,88.9088084 L84.7079664,102.573623 C84.7079664,111.806341 95.967922,110.882287 95.967922,110.882287 C98.5513023,109.960188 96.1532872,108.297908 96.1532872,108.297908 C92.0916785,106.821064 91.7225124,102.388577 91.7225124,102.388577 L91.7225124,84.4763212 C91.7225124,77.4915351 88.7824803,73.7925796 85.907365,71.8400162 C102.668051,70.1773445 110.7111,64.7632941 114.41723,56.3513489 C121.758707,56.5532168 134.970472,57.4479298 147.608152,61.0142628 L147.758321,60.4822079 C135.192988,56.9366093 122.068431,56.0192058 114.652652,55.8032541 C115.003829,54.953531 115.310424,54.0697721 115.582606,53.1605841 C123.110621,52.8476106 135.675563,52.8515227 147.9081,55.2966282 L147.890502,55.2884127 Z" id="cat" fill="#000000"></path>
<path d="M101.291995,37.256122 C104.893293,40.5125134 107,44.4448698 107,48.681722 C107,68.4638227 92.2249636,69 74.0007803,69 C55.7734758,69 41,66.2607063 41,48.681722 C41,44.4729052 43.0770568,40.5650798 46.6338799,37.3219274 C52.5669902,31.9169329 62.6081786,34.7788816 74.0003901,34.7788816 C85.3414946,34.777324 95.3483514,31.8861718 101.290045,37.2541751 L101.291995,37.256122 Z" id="face" fill="#F4CBB2"></path>
<path d="M62.5771041,49.498875 C62.5771041,54.746694 59.5376842,59 55.788552,59 C52.0394199,59 49,54.746694 49,49.498875 C49,44.2518059 52.0394199,40 55.788552,40 C59.5376842,40.00375 62.5771041,44.252556 62.5771041,49.498875 L62.5771041,49.498875 Z M99,49.498875 C99,54.746694 95.9605801,59 92.211448,59 C88.4623158,59 85.4228959,54.746694 85.4228959,49.498875 C85.4228959,44.2518059 88.4623158,40 92.211448,40 C95.9605801,40.00375 99,44.252556 99,49.498875 L99,49.498875 Z" id="eyes" fill="#FFFFFF"></path>
<g id="Group" transform="translate(51.000000, 43.000000)" fill="#AD5C51">
<path d="M9.45512605,6.89206897 C9.45512605,10.5911034 7.42184874,13.5886379 4.91929412,13.5886379 C2.4167395,13.5886379 0.383848739,10.5911034 0.383848739,6.89206897 C0.383848739,3.19184483 2.41519328,0.192724138 4.91929412,0.192724138 C7.42030252,0.192724138 9.45357983,3.19065517 9.45357983,6.89048276 L9.45512605,6.89206897 Z M45.9536134,6.89206897 C45.9536134,10.5911034 43.9203361,13.5886379 41.4177815,13.5886379 C38.9152269,13.5886379 36.8823361,10.5911034 36.8823361,6.89206897 C36.8823361,3.19184483 38.9136807,0.192724138 41.4177815,0.192724138 C43.9187899,0.192724138 45.9520672,3.19065517 45.9520672,6.89048276 L45.9536134,6.89206897 Z" id="pupils"></path>
<ellipse id="nose" cx="21.6134454" cy="15.6875862" rx="1.70122689" ry="1.74522414"></ellipse>
<path d="M17.6435294,20.1012069 C17.5430252,19.8085517 17.6930084,19.4885345 17.9763529,19.385431 C18.2612437,19.2823276 18.5739664,19.4361897 18.674084,19.7268621 C19.112437,20.9950345 20.2848571,21.8468276 21.592958,21.8468276 C22.9010588,21.8468276 24.073479,20.995431 24.5118319,19.7268621 C24.6123361,19.4342069 24.9242857,19.2823276 25.209563,19.385431 C25.4948403,19.4885345 25.6428908,19.8085517 25.5427731,20.1012069 C24.9517311,21.8158966 23.3629916,22.9678793 21.592958,22.9678793 C19.8229244,22.9678793 18.2376639,21.8218448 17.6462353,20.1047759 L17.6435294,20.1012069 Z" id="mouth"></path>
</g>
<path d="M31.3962414,70.8343576 C31.3962414,71.2948822 30.8592336,71.6667538 30.1981207,71.6667538 C29.5373981,71.6667538 29,71.2948822 29,70.8343576 C29,70.3734407 29.5373981,70 30.1981207,70 C30.8592336,70 31.3962414,70.3726562 31.3962414,70.8355344 L31.3962414,70.8343576 Z M34.7135138,72.6858704 C34.7135138,73.146395 34.1765059,73.5182667 33.515393,73.5182667 C32.8546704,73.5182667 32.3172723,73.146395 32.3172723,72.6858704 C32.3172723,72.2249536 32.8546704,71.8515129 33.515393,71.8515129 C34.1765059,71.8515129 34.7135138,72.224169 34.7135138,72.6870473 L34.7135138,72.6858704 Z M36.740172,75.0944062 C36.740172,75.5549308 36.2031642,75.9268025 35.5420513,75.9268025 C34.8813287,75.9268025 34.3439306,75.5549308 34.3439306,75.0944062 C34.3439306,74.6334894 34.8813287,74.2600486 35.5420513,74.2600486 C36.2031642,74.2600486 36.740172,74.6327048 36.740172,75.095583 L36.740172,75.0944062 Z M38.5822338,77.8716755 C38.5822338,78.3322001 38.045226,78.7040718 37.3841131,78.7040718 C36.7233905,78.7040718 36.1859924,78.3322001 36.1859924,77.8716755 C36.1859924,77.4107586 36.7233905,77.0373179 37.3841131,77.0373179 C38.045226,77.0373179 38.5822338,77.4099741 38.5822338,77.8728523 L38.5822338,77.8716755 Z M40.6069408,80.464578 C40.6069408,80.9251026 40.0699329,81.2969743 39.40882,81.2969743 C38.7480974,81.2969743 38.2106993,80.9251026 38.2106993,80.464578 C38.2106993,80.0036612 38.7480974,79.6302205 39.40882,79.6302205 C40.0699329,79.6302205 40.6069408,80.0028766 40.6069408,80.4657549 L40.6069408,80.464578 Z M43.3739361,82.6848244 C43.3739361,83.145349 42.8369283,83.5172206 42.1758154,83.5172206 C41.5150928,83.5172206 40.9776947,83.145349 40.9776947,82.6848244 C40.9776947,82.2239075 41.5150928,81.8504668 42.1758154,81.8504668 C42.8369283,81.8504668 43.3739361,82.223123 43.3739361,82.6860012 L43.3739361,82.6848244 Z M47.2414854,84.1676038 C47.2414854,84.6281284 46.7044776,85 46.0433647,85 C45.3826421,85 44.845244,84.6281284 44.845244,84.1676038 C44.845244,83.7066869 45.3826421,83.3332462 46.0433647,83.3332462 C46.7044776,83.3332462 47.2414854,83.7059024 47.2414854,84.1687806 L47.2414854,84.1676038 Z M51.093424,84.1676038 C51.093424,84.6281284 50.5564161,85 49.8953033,85 C49.2345807,85 48.6971826,84.6281284 48.6971826,84.1676038 C48.6971826,83.7066869 49.2345807,83.3332462 49.8953033,83.3332462 C50.5564161,83.3332462 51.093424,83.7059024 51.093424,84.1687806 L51.093424,84.1676038 Z M55,83.5242815 C55,83.9848061 54.4629921,84.3566777 53.8018793,84.3566777 C53.1411567,84.3566777 52.6037586,83.9848061 52.6037586,83.5242815 C52.6037586,83.0633646 53.1411567,82.6899239 53.8018793,82.6899239 C54.4629921,82.6899239 55,83.0625801 55,83.5254583 L55,83.5242815 Z" id="octo" fill="#C3E4D8"></path>
<path d="M27.0002011,73 L26.0237544,77.2089435 C26.0237544,77.2089435 25.7689738,78.7301202 26.9282256,79 C28.1384336,78.9708451 28.0384322,77.5710158 27.954673,77.116357 L27.0002011,73 Z" id="drop" fill="#9CDAF1"></path>
</g>
</g>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 11 KiB

19
website/themes/micromdm/static/images/safari-pinned-tab.svg Normal file
View File

@@ -0,0 +1,19 @@
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN"
"http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
<svg version="1.0" xmlns="http://www.w3.org/2000/svg"
width="16.000000pt" height="16.000000pt" viewBox="0 0 16.000000 16.000000"
preserveAspectRatio="xMidYMid meet">
<metadata>
Created by potrace 1.11, written by Peter Selinger 2001-2013
</metadata>
<g transform="translate(0.000000,16.000000) scale(0.008000,-0.008000)"
fill="#000000" stroke="none">
<path d="M1155 1848 c-207 -121 -225 -132 -915 -529 -74 -43 -143 -84 -153
-91 -16 -12 6 -27 200 -138 120 -68 258 -148 306 -176 l88 -51 -213 -123
c-337 -194 -388 -224 -388 -230 0 -3 28 -22 62 -42 35 -20 170 -97 300 -173
l237 -137 138 79 c76 44 213 123 305 176 92 54 170 97 172 97 3 0 74 -40 158
-89 351 -204 451 -261 454 -261 2 0 4 157 4 350 l0 350 -22 14 c-13 7 -150 87
-305 176 l-283 163 0 353 c0 277 -3 354 -12 354 -7 -1 -67 -33 -133 -72z"/>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 959 B

33
website/themes/micromdm/static/images/slack-logo.svg Normal file
View File

@@ -0,0 +1,33 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg width="140px" height="140px" viewBox="0 0 140 140" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch -->
<title>slack-140</title>
<desc>Created with Sketch.</desc>
<defs></defs>
<g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="slack-140">
<g>
<rect id="Rectangle-18" x="0" y="0" width="140" height="140"></rect>
<g id="slack-logo" transform="translate(13.000000, 24.000000)">
<g id="text" transform="translate(0.000000, 57.000000)" fill-rule="nonzero" fill="#202532">
<path d="M20.1733929,13.5954536 C21.6873934,14.2595993 21.8069198,14.728408 20.6116562,16.9552496 C19.3765505,19.2211585 19.0976557,19.3774281 17.5836552,18.7914171 C15.7110756,18.0100692 13.2807063,17.4240583 11.7268637,17.4240583 C9.17696807,17.4240583 7.50359907,18.3226084 7.50359907,19.6899672 C7.50359907,24.1827177 22.0858146,21.7605392 22.0858146,31.2929836 C22.0858146,36.0982733 17.86255,39.3017997 11.5674952,39.3017997 C8.26059933,39.3017997 4.15686108,38.2079126 1.32807063,36.8014864 C-0.0664035316,36.0982733 -0.185929888,35.7075993 1.0491758,33.402623 C2.08507089,31.4101858 2.44364996,31.1757815 3.95765048,31.8008598 C6.34817762,32.8166121 9.41602078,33.6370274 11.4479688,33.6370274 C13.7588117,33.6370274 15.3126544,32.6994099 15.3126544,31.3711184 C15.3126544,27.0346376 0.451544015,29.1052095 0.451544015,19.8462368 C0.451544015,14.923745 4.63496651,11.6420838 10.8901792,11.6420838 C13.9181802,11.6030164 17.6234973,12.4624991 20.1733929,13.5954536 Z" id="Shape"></path>
<path d="M31.9666601,2.26590893 L31.9666601,37.8953735 C31.9666601,38.442317 31.3690283,38.9892605 30.572186,38.9892605 L26.7473425,38.9892605 C25.910658,38.9892605 25.3528684,38.4032496 25.3528684,37.8953735 L25.3528684,2.26590893 C25.3528684,0.507876139 25.8708159,0.351606558 28.6597642,0.351606558 C31.8471338,0.312539163 31.9666601,0.546943534 31.9666601,2.26590893 Z" id="Shape"></path>
<path d="M59.1389852,22.2684153 L59.1389852,37.6219017 C59.1389852,38.442317 58.5413535,38.9892605 57.7445111,38.9892605 L53.9595098,38.9892605 C53.0829832,38.9892605 52.4853514,38.3641822 52.5650356,37.5046995 L52.6048777,35.8638689 C50.5729297,38.0907104 47.6246129,39.2627323 44.6762961,39.2627323 C38.9788731,39.2627323 35.1540296,36.0201385 35.1540296,31.2148489 C35.1540296,26.0970201 39.4569785,22.6200219 45.9512439,22.6200219 C48.4214552,22.6200219 50.6526139,23.0497632 52.4853514,23.7920437 L52.4853514,22.034011 C52.4853514,19.2211585 50.2143506,17.5412605 46.3496651,17.5412605 C44.5567697,17.5412605 42.325611,18.2444736 40.5725578,19.2602259 C39.2179258,20.0025064 38.8991888,19.963439 37.4250304,17.8147323 C35.9907141,15.6660255 36.0305562,15.2753516 37.4250304,14.3768015 C40.0944524,12.6969035 43.6802431,11.6030164 46.987139,11.6030164 C54.4376152,11.6030164 59.1389852,15.5488233 59.1389852,22.2684153 Z M41.5287687,31.1757815 C41.5287687,33.011949 43.1224534,34.2230383 45.4731384,34.2230383 C48.341771,34.2230383 50.9713509,32.8556795 52.4853514,30.5507031 L52.4853514,28.167592 C50.9713509,27.5815811 49.0987713,27.2690419 47.4652444,27.2690419 C43.8794537,27.2690419 41.5287687,28.9098725 41.5287687,31.1757815 Z" id="Shape"></path>
<path d="M85.0363626,13.634521 C86.4308367,14.4158689 86.4706789,14.8456102 84.9566783,17.1505865 C83.5223621,19.3383607 83.2833093,19.4555629 81.7294667,18.7132824 C80.5740453,18.1272714 78.7014657,17.6193953 77.1874651,17.6193953 C72.4064109,17.6193953 69.2190413,20.7057195 69.2190413,25.393807 C69.2190413,30.238164 72.4064109,33.5198252 77.1874651,33.5198252 C78.8608341,33.5198252 80.9326243,32.8947469 82.2872564,32.1524663 C83.6817305,31.3711184 83.9606254,31.4101858 85.4347838,33.5198252 C86.7495737,35.4731949 86.7495737,35.9420037 85.5543101,36.762419 C83.4028357,38.2079126 80.0560977,39.3017997 77.0679388,39.3017997 C68.2229884,39.3017997 62.2865126,33.7542296 62.2865126,25.393807 C62.2865126,17.1115191 68.2229884,11.6030164 77.147623,11.6030164 C79.8568871,11.6030164 83.0442566,12.5015665 85.0363626,13.634521 Z" id="Shape"></path>
<path d="M113.961741,35.6294645 C115.07732,36.9968234 114.639057,37.5046995 111.850109,38.4813844 C109.021318,39.4971367 108.622897,39.4190019 107.626844,38.1688452 L99.6982624,27.8159855 L96.1523138,31.1757815 L96.1523138,37.8953735 C96.1523138,38.442317 95.554682,38.9892605 94.7578396,38.9892605 L90.9329962,38.9892605 C90.0963117,38.9892605 89.538522,38.4032496 89.538522,37.8953735 L89.538522,2.26590893 C89.538522,0.507876139 90.0564696,0.351606558 92.8454179,0.351606558 C96.0726295,0.351606558 96.1523138,0.58601093 96.1523138,2.26590893 L96.1523138,22.5028197 L106.98937,12.3062295 C108.184634,11.2123425 108.86195,11.2904772 110.973582,12.6578361 C113.324267,14.1423971 113.483636,14.5721385 112.368056,15.6269581 L104.319948,23.3623024 L113.961741,35.6294645 Z" id="Shape"></path>
</g>
<g id="pound-color" transform="translate(32.000000, 0.114931)">
<rect id="Rectangle-4" fill="#89D3DF" transform="translate(23.154587, 17.395910) rotate(-18.000000) translate(-23.154587, -17.395910) " x="0.886839676" y="12.9599785" width="44.5354948" height="8.87186208" rx="4.43593104"></rect>
<rect id="Rectangle-4" fill="#E01A59" transform="translate(28.637699, 34.271194) rotate(-18.000000) translate(-28.637699, -34.271194) " x="6.36995199" y="29.835263" width="44.5354948" height="8.87186208" rx="4.43593104"></rect>
<rect id="Rectangle-5" fill="#63C1A0" transform="translate(17.424989, 28.585997) rotate(-18.000000) translate(-17.424989, -28.585997) " x="12.9714392" y="6.40634151" width="8.90709896" height="44.3593104" rx="4.45354948"></rect>
<rect id="Rectangle-5" fill="#ECB32D" transform="translate(34.367298, 23.081107) rotate(-18.000000) translate(-34.367298, -23.081107) " x="29.9137483" y="0.901451614" width="8.90709896" height="44.3593104" rx="4.45354948"></rect>
<rect id="Rectangle-7" fill="#AB184D" transform="translate(20.166545, 37.023639) rotate(-18.000000) translate(-20.166545, -37.023639) " x="15.7129954" y="32.5877079" width="8.90709896" height="8.87186208"></rect>
<rect id="Rectangle-8" fill="#399989" transform="translate(14.683433, 20.148354) rotate(-18.000000) translate(-14.683433, -20.148354) " x="10.2298831" y="15.7124234" width="8.90709896" height="8.87186208"></rect>
<rect id="Rectangle-9" fill="#819C3C" transform="translate(31.625742, 14.643465) rotate(-18.000000) translate(-31.625742, -14.643465) " x="27.1721921" y="10.2075335" width="8.90709896" height="8.87186208"></rect>
<rect id="Rectangle-6" fill="#BD1E24" transform="translate(37.108854, 31.518749) rotate(-18.000000) translate(-37.108854, -31.518749) " x="32.6553044" y="27.082818" width="8.90709896" height="8.87186208"></rect>
</g>
</g>
</g>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.2 KiB

39
website/themes/micromdm/static/images/wiki-logo.svg Normal file
View File

@@ -0,0 +1,39 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg width="140px" height="140px" viewBox="0 0 140 140" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch -->
<title>wiki-140</title>
<desc>Created with Sketch.</desc>
<defs>
<path d="M2,0 L49,0 L68,17 L68,89 L68,89 C68,90.1045695 67.1045695,91 66,91 L2,91 L2,91 C0.8954305,91 1.3527075e-16,90.1045695 0,89 L0,2 L-2.22044605e-16,2 C-3.57315355e-16,0.8954305 0.8954305,2.02906125e-16 2,0 Z" id="path-1"></path>
<path d="M57.7098661,2.53275019 L3.91407903,55.9219218 L0.207296715,70.1863184 L0.207296715,70.1863184 C0.137844358,70.4535841 0.298203799,70.7265481 0.565469549,70.7960004 C0.643307797,70.8162277 0.724876725,70.8173802 0.803255409,70.7993604 L14.6658701,67.6122351 L68.5871192,12.5945833 L68.5871192,12.5945833 C71.3498294,9.77569781 71.3042903,5.25092051 68.4854048,2.48821033 C68.4358834,2.43967573 68.3856582,2.39186442 68.3347452,2.34479159 L68.3347452,2.34479159 L68.3347452,2.34479159 C65.3142294,-0.447900086 60.629715,-0.365029044 57.7098661,2.53275019 Z" id="path-2"></path>
</defs>
<g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="wiki-140">
<g>
<rect id="Rectangle-18" x="0" y="0" width="140" height="140"></rect>
<g id="wiki-logo" transform="translate(25.000000, 23.000000)">
<g id="Rectangle-10">
<use fill="#FFFFFF" fill-rule="evenodd" xlink:href="#path-1"></use>
<path stroke="#1AC5FF" stroke-width="4" d="M66,17.8942208 L48.2358709,2 L2,2 L2,89 L66,89 L66,17.8942208 Z"></path>
</g>
<rect id="Rectangle-13" fill="#5CCAFF" x="14" y="33" width="40" height="6" rx="1"></rect>
<rect id="Rectangle-13" fill="#5CCAFF" x="14" y="50" width="34" height="6" rx="1"></rect>
<rect id="Rectangle-13" fill="#5CCAFF" x="14" y="68" width="22" height="6" rx="1"></rect>
<rect id="Rectangle-11" fill="#00C0FF" x="45" y="3" width="4" height="18"></rect>
<rect id="Rectangle-12" fill="#00C0FF" x="45" y="17" width="22" height="4"></rect>
<g id="Group-13" transform="translate(38.000000, 3.000000)">
<mask id="mask-3" fill="white">
<use xlink:href="#path-2"></use>
</mask>
<use id="Path-7" fill="#FDBD39" xlink:href="#path-2"></use>
<path d="M5.62874262,56.7007974 L50.6287426,11.7007974" id="Path-10" stroke="#FFCC00" stroke-width="4" stroke-linecap="round" mask="url(#mask-3)"></path>
<path d="M-2.21125366,71.9271156 L3.77204487,54.1556342 C3.91866948,57.9189168 5.17214918,60.9443785 7.53248399,63.2320191 C9.8928188,65.5196598 13.1295633,67.1754299 17.2427174,68.1993296 L-2.21125366,71.9271156 Z" id="Path-2" fill="#F9DBCE" mask="url(#mask-3)"></path>
<path d="M50.6582195,9.42507104 L57.9150269,2.23707832 L57.9150269,2.23707832 C60.8755514,-0.695372168 65.6167042,-0.787495198 68.6889091,2.02773627 L68.6889091,2.02773627 L68.6889091,2.02773627 C71.6613141,4.7515156 71.862865,9.36918538 69.1390857,12.3415904 C69.1074284,12.3761374 69.0754392,12.4103788 69.0431225,12.4443098 L62.7117661,19.0919399 L50.6582195,9.42507104 Z" id="Path-8" fill="#FF99A1" mask="url(#mask-3)"></path>
<polygon id="Path-9" fill="#DADDE2" mask="url(#mask-3)" points="48.35654 11.4146971 60.4568403 21.6967142 66.2291412 15.6424234 54.0540965 5.32345881"></polygon>
<circle id="Oval-3" fill="#5F6269" mask="url(#mask-3)" cx="1" cy="70" r="3"></circle>
</g>
</g>
</g>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.9 KiB

21
website/themes/micromdm/theme.toml Normal file
View File

@@ -0,0 +1,21 @@
# theme.toml template for a Hugo theme
# See https://github.com/spf13/hugoThemes#themetoml for an example
name = "MicroMDM"
license = "MIT"
licenselink = "https://github.com/micromdm/website/blob/master/LICENSE.md"
description = ""
homepage = "https://micromdm.io/"
tags = ["", ""]
features = ["", ""]
min_version = 0.18
[author]
name = ""
homepage = ""
# If porting an existing theme
[original]
name = ""
homepage = ""
repo = ""