Parallex in managed fleets

Deploying the app

• The disk image. Parallex.dmg always holds the newest release. Copy Parallex.app from it to /Applications with your MDM's app deployment, or a script. Check it with codesign --verify --deep --strict and spctl -a -vv: the Team ID is UK74VYMUP7.
• Homebrew. brew install --cask mandipadk/parallex/parallex installs the app and links the parallex command. On Homebrew 6 and later it trusts only the Parallex cask from that tap.
• Installomator and AutoPkg. There's no label or recipe yet. For a label of your own: type dmg, the download URL above, and expectedTeamID="UK74VYMUP7". The newest version number is in the disk image's app (CFBundleShortVersionString).
• The installer package. From Parallex 3.3.1, each release comes with a component package beside its app archive and disk image, signed with Parallex's Developer ID Installer certificate and notarized by Apple: https://parallex.mandip.dev/download/<version>/Parallex-<version>.pkg, listed on Releases with each version's other files. It installs Parallex.app in /Applications (never relocated to another copy's folder), upgrades an older one there, and links the parallex command into /usr/local/bin when nothing else is there. Its postinstall runs as root and touches nothing of any user's: no preferences, no login items, no files in anyone's home. Check it with pkgutil --check-signature: the Team ID is UK74VYMUP7.

Parallex updates itself by default, from signed releases only. If you deploy updates yourself, set AppUpdatesAllowed to false below: Parallex then never checks for, downloads or installs a version of its own. To let it update but not first, set UpdateDeferralDays.

Managed preferences

Deliver the keys in a configuration profile whose payload type is com.parallex.app. A key the profile sets wins over what's chosen on the Mac, in the app and in the parallex command alike, and the app shows it as Managed by your organization, locked. Leave a key out to leave it to the person using the Mac. parallex policy lists what's managed on a Mac, and so does Settings › About.

• The schema: every key, as JSON Schema.
• A Jamf Pro custom schema: paste it into Application & Custom Settings › External Applications, with the preference domain com.parallex.app. Each key starts as Not Configured.
• A sample profile: settings for an agency, and Parallex's login item allowed by Team ID. Change its identifiers before you use it.

Licenses for many Macs

Put a license key in LicenceKey. When Parallex opens, it adds the Mac to that license without asking, as long as the license has a free seat. When every seat is taken it frees nothing: it tries again a day later, and Settings › License says why. It adds a Mac once per key, so a Mac taken off the license stays off; a Mac that already has a license of its own keeps it. The key is read only from the managed profile and never written to a log. Like any managed preference, every account on the Mac and the programs it runs can read it (sealed agent runs can't), so treat it as you would a shared license key.

For scripted installs without a profile, parallex license activate --key-file /path/to/key reads the key from a file, so it isn't in the command's arguments, and never prints it. Each license covers the Macs its seats allow; for more, write to hello@mandip.dev.

Privacy permissions (PPPC)

Parallex itself asks for no privacy permissions by default: no Full Disk Access, Accessibility, Screen Recording, camera or microphone. Opening at login uses a login item, which a managed login item rule can allow by Team ID; the sample profile does.

• Sign-in link routing is off until someone turns it on. Then Parallex builds a small helper on that Mac, Parallex Links, and macOS asks once to let it pass links to the apps (Automation). It's signed on each Mac, so a PPPC profile can't approve it in advance.
• Copies are apps of their own to macOS. A copy of Zoom asks for the camera as itself, the first time it needs it, and the person using the Mac answers. A PPPC payload needs an app's code requirement, and each Mac signs its copies with its own certificate, so copies can't be approved ahead of time across a fleet.

Endpoint security, EDR and Santa

Everything Parallex makes on a Mac is signed on that Mac. A plain instance is a small wrapper app, signed ad hoc, whose launcher starts the original app with a data folder of its own; the original keeps its developer's signature. A copy is what security tools notice most, because of how it works:

• Each copy is a copy of the app re-signed on that Mac, with a self-signed certificate Parallex makes once per Mac ("Parallex Local Signing"). It has no Team ID, and no two Macs share the certificate.
• Copies run without the hardened runtime, and the launcher loads Parallex's own library into them with DYLD_INSERT_LIBRARIES, so the app keeps to its own data. Those are the signals EDR rules for library injection and app tampering look for: some tools flag them, and some block them.
• A copy is rebuilt when its app updates, so its code hash changes with every update.

What you can do: allow Parallex itself, its command and its libraries by Team ID UK74VYMUP7 (they ship signed with its Developer ID, and the library a copy loads is that same signed file, kept in Parallex's folder). For copies and wrappers, a rule by certificate or code hash covers one Mac only, and a hash only until the next rebuild, so in Santa Lockdown they won't run without rules made on each Mac. Where your EDR's exclusions can match the signer of an injected library, Team ID UK74VYMUP7 is the one to use; check how yours scopes them, as Parallex hasn't been tested against each EDR. Agent workspaces and the parallex command don't need copies at all.

To turn copies off for some apps, or allow only a few, use BlockedApps and CopyableApps. Copies made before a block stay; remove them with parallex remove.