BCU 3.4.7

Blueprint Conversion Utility 3.4.7

BCU 3.4.7 focuses on workflow clarity, administrator intent, profile-specific analysis reliability, and safer Blueprint migration decisions.

This release resolves several issues where BCU could display conflicting information between Setup and Review, reevaluate an administrator-selected alternative, or retain analysis from a previously selected Configuration Profile.

Highlights

Administrator selections are now authoritative

BCU now clearly separates three concepts:

• Recommended Approach: BCU and jamf-cli guidance based on profile analysis.
• Selected Approach: The action explicitly selected by the administrator.
• Takeover Capability: Whether the selected profile is technically eligible for takeover.
• Evaluation Incomplete: Provides this "error" when there are no groups assigned. The world is your oyster. Choose an alternative method and go for it!

Once an administrator explicitly selects an Approach, subsequent analysis or reevaluation will not silently replace that selection.

For example, if BCU recommends:

Convert to a New Blueprint

but the administrator selects:

Create Blueprint for Review

BCU may continue to display its recommendation, but the administrator's selected Approach remains authoritative.

---

Setup and Review consistency

The Review screen now uses Approach instead of the previous Workflow terminology.

The Approach displayed on Review reflects the administrator's actual selection rather than an internal execution mode or takeover capability.

This prevents confusing situations where Setup could show:

Convert to a New Blueprint

while Review incorrectly displayed:

Profile Takeover

BCU now carries the selected Approach consistently through the workflow.

---

Improved jamf-cli takeover verdict handling

BCU now recognizes additional valid jamf-cli responses indicating that profile takeover is unavailable, including variations such as:

• takeover not supported
• takeover is not supported
• takeover is unsupported
• takeover not possible
• takeover is not possible
• cannot take over
• converting the profile rather than keeping it as installed

When takeover is conclusively unsupported but conversion is available, BCU now recommends:

Convert to a New Blueprint

instead of incorrectly reporting:

Evaluation Incomplete

Genuinely inconclusive jamf-cli results can still produce Evaluation Incomplete so administrators are not given false certainty.

---

Profile-specific analysis isolation

Analysis in the Advanced view is now tied to the Configuration Profile currently selected in the sidebar.

When selecting a different Configuration Profile, BCU now:

1. Cancels the pending analysis task for the previous profile.
2. Immediately clears previous jamf-cli Activity.
3. Resets profile-specific evaluation state.
4. Displays the newly selected profile name and ID while analysis begins.
5. Starts a fresh analysis for the new profile.
6. Prevents late asynchronous results from a previously selected profile from updating the current profile's interface.

The Advanced activity pane therefore remains synchronized with the profile currently being reviewed.

---

Improved asynchronous analysis protection

BCU now tracks the Configuration Profile ID and profile-load generation associated with an evaluation.

Before asynchronous analysis results are applied, BCU verifies that the result still belongs to the currently selected profile.

This prevents circumstances such as:

Select Profile A
        ↓
Profile A analysis starts
        ↓
Select Profile B
        ↓
Profile B analysis starts
        ↓
Profile A finishes late

BCU 3.4.6

Blueprint Conversion Utility 3.4.6

Blueprint Conversion Utility 3.4.6 focuses on improving the Jamf Blueprint migration workflow, takeover analysis, deployment validation, administrative safeguards, and in-app guidance.

What's New

Improved Configuration Profile Analysis

• Automatically analyzes the selected Configuration Profile using jamf-cli.
• Provides a recommended migration approach based on the profile and takeover analysis.
• Separates profile compatibility analysis from deployment scope requirements.
• Unscoped profiles can complete analysis before a deployment group is selected.
• Selecting another Configuration Profile starts a fresh, profile-specific analysis.
• Improved handling of incomplete or inconclusive jamf-cli analysis results.

Unlimited Discovered Groups

• Polls groups in 100 per page. Keep scrolling to load more in the list!

Improved jamf-cli Integration

• Uses the public Jamf jamf-cli workflow for Configuration Profile analysis and takeover operations.
• Displays jamf-cli activity in the Advanced interface for troubleshooting and validation.
• Improved parsing of mixed jamf-cli output and Blueprint results.
• Improved handling of Blueprint IDs, deployment information, and dropped-key warnings.

Create and Deploy

The guided workflow supports:

• Create Only

  • Creates the Blueprint without deploying it.
  • Leaves the existing Configuration Profile scoped.

• Create and Deploy

  • Creates and deploys the Blueprint.
  • Leaves the existing Configuration Profile scoped.
  • Uses Jamf Platform API read-back to validate deployment.

• Create, Deploy, and Unscope

  • Creates the Blueprint.
  • Deploys the Blueprint.
  • Waits for Jamf Platform to confirm the Blueprint is DEPLOYED.
  • Unscopes the existing Configuration Profile only after successful deployment validation and explicit administrator acknowledgement.

Deployment Validation

Blueprint deployment is asynchronous.

BCU no longer treats the initial NOT_DEPLOYED state returned immediately after creation as a final deployment failure.

For deployment operations, BCU:

1. Creates the Blueprint.
2. Retains the Blueprint ID.
3. Requests deployment.
4. Queries the Jamf Platform API.
5. Polls the Blueprint deployment state.
6. Completes successfully when Jamf Platform reports DEPLOYED.

If deployment cannot be confirmed within the validation period, BCU reports a partial-completion state rather than incorrectly reporting that Blueprint creation failed.

Deployment validation can be retried against the existing Blueprint without recreating it.

Safer Configuration Profile Takeover

The existing Configuration Profile is protected throughout the takeover process.

BCU will not unscope the source Configuration Profile unless:

• Blueprint creation succeeds.
• Deployment was requested.
• Jamf Platform reports the Blueprint as DEPLOYED.
• The administrator explicitly selected the unscope workflow.
• The administrator acknowledged the unscope action.

If creation, deployment, validation, or unscoping fails, BCU preserves the safest available state and reports the result.

Scope and Group Improvements

• Better handling of currently unscoped Configuration Profiles.
• Compatible target-group selection is available when deployment requires a group.
• Mobile Configuration Profiles use compatible mobile-device groups.
• Computer Configuration Profiles use compatible computer groups.
• Analysis can complete independently of target-group selection.

Blueprint Editing

Expanded Blueprint review and editing capabilities include:

• Blueprint name and description
• Editable Blueprint properties
• Payload/component review
• Activation Conditions
• Advanced Blueprint JSON
• jamf-cli Activity

Activation Conditions can be reviewed and adjusted before creation.

Completion Reporting

Operation results provide clearer information about what actually occurred, including:

• Configuration Profile
• Profile ID
• Blueprint ID
• Requested deployment action
• Deployment state
• Deployment validation source
• Takeover support
• Existing Configuration Profile state
• Dropped-key warnings

The workflow distinguishes between successful completion, partial completion, and failure rather than treating every non-final deployment response as a complete failure.

Updated Interface Guidance

The in-app Knowledge Base has been updated for the current BCU interface and workflow.

A new Administrator Quick Start walks through:

1. Configuring the Jamf Platform API
2. Selecting a Configuration Profile
3. Waiting for automatic analysis
4. Reviewing the recommended approach
5. Selecting deployment scope when required
6. Running Dry Run
7. Choosing Create Only, Create and Deploy, or Create, Deploy, and Unscope
8. Reviewing operation results and logs

Additional documentation covers:

• Profile Takeover
• jamf-cli
• Platform API
• Deployment and Unscoping
• Device Groups
• Payload Compatibility
• Blueprint GUI and JSON editing
• Troubleshooting
• Application Updates

Administrative Visibility

• The application indicates when the API is configured.
• Detailed application logs remain available from the header.
• Long-running workflows expose operation status and activity.
• Advanced mode provides access to jamf-cli Activity and Blueprint JSON.

Upgrade Notes

Version 3.4.6 is intended as a direct replacement for previous 3.4.x builds.

Existing Jamf Platform API credentials stored by the application can continue to be used.

For production migrations, the recommended workflow remains:

Analyze → Review → Dry Run → Create/Deploy → Validate → Unscope only when explicitly required

Always review the Dry Run results and reported dropped keys before allowing a Blueprint to take ownership of an existing Configuration Profile.

BCU 3.3.0

Blueprint Conversion Utility 3.3.0

🚀 What's New

Blueprint Conversion Utility 3.3.0 introduces the first public command-line interface (CLI), enhanced enterprise deployment capabilities, Developer ID code signing support, and a fully notarized macOS release.

This release focuses on automation, security, deployment readiness, and platform administration workflows.

Still a work in progress - do not judge this too heavily.

---

✅ Signed and Notarized Release

Blueprint Conversion Utility is now distributed as a:

• ✅ Developer ID signed application
• ✅ Developer ID signed installer package
• ✅ Apple notarized application
• ✅ Apple notarized installer package
• ✅ Gatekeeper-approved distribution

Users should no longer receive unidentified developer warnings when installing or launching the application.

---

🖥️ New Command-Line Interface (CLI)

Added the new:

bcu

command-line utility.

The CLI shares configuration and credentials with the graphical application and allows administrators to perform common operations directly from Terminal.

Supported Commands

Version Information

bcu version

Platform Connection Status

bcu connection status

Platform Connection Testing

bcu connection test

Credential Expiration Status

bcu credentials status

Configuration Profile Discovery

bcu profiles list --type computer

bcu profiles list --type mobile

Device Group Discovery

bcu groups list --type computer

bcu groups list --type mobile

Unified Log Viewing

bcu logs show

bcu logs stream

Application Management

bcu app open

bcu app check-for-updates

---

🔐 Platform Credential Expiration Tracking

Added API credential expiration awareness directly within the application.

Status Indicator

The footer now displays API credential health.

🟢 Green

Credentials valid and not nearing expiration.

Platform credentials expire Mar 29, 2027
177 days remaining

🟡 Yellow

Credentials approaching expiration.

Platform credentials expire soon
21 days remaining

🔴 Red

Credentials expired or authentication failed.

Platform credentials expired

or

Platform credentials invalid
Authentication failed

⚪ Gray

Expiration date not configured.

---

🌐 Platform Environment Architecture

Blueprint Conversion Utility now uses:

Platform Environment ID

as the sole scope identifier.

Removed:

Tenant ID

throughout the application.

Benefits include:

• Simplified configuration
• Reduced user confusion
• Consistent Platform API behavior
• Standardized request headers

All Platform API requests now use:

X-Environment-Id

---

🧭 Connections Improvements

The Platform API connection screen now incorporates:

Platform API URL
Client ID
Client Secret
Platform Environment ID
API Client Expiration Date
Expiration Warning Period

Additional improvements include:

• Date-picker based expiration tracking
• Configurable warning thresholds
• Improved connection testing
• Better validation messaging

---

🔒 Security Improvements

Enhanced handling of sensitive authentication information.

Client Secret Protection

Client Secrets are:

• Stored in macOS Keychain
• Excluded from Unified Logging
• Excluded from exports
• Never written to plain-text settings
• Hidden after entry

CLI Security

The new CLI:

• Reads existing application settings
• Uses Keychain-stored secrets
• Never displays Client Secrets
• Supports automation-friendly JSON output

---

🧰 Developer Experience Improvements

Enhanced Build System

build.sh now supports:

--sign-app
--sign-installer
--notary-profile
--skip-notarization
--version
--arch

Example:

./build.sh \
  --sign-app "Developer ID Application: Your Name (TEAMID)" \
  --sign-installer "Developer ID Installer: Your Name (TEAMID)" \
  --notary-profile blueprint-notary

Automatic Release Pipeline

The build system now supports:

• Building application bundles
• Signing helper binaries
• Signing CLI binaries
• Signing application bundles
• Signing installer packages
• Notarizing packages
• Notarizing disk images
• Stapling notarization tickets
• Performing Gatekeeper validation

---

📦 Packaging Improvements

The installer package now deploys:

/Applications/Blueprint Conversion Utility.app

and

/usr/local/bin/bcu

allowing CLI access immediately after installation.

---

📚 Documentation Updates

Updated documentation now includes:

• Platform Environment setup
• API Client requirements
• Required Jamf permissions
• Credential security guidance
• CLI usage documentation
• Developer ID signing guidance
• Notarization procedures
• Build and release workflows

---

🛠️ Fixes and Stability Improvements

Fixed

• Platform API credential validation workflow
• Environment ID configuration workflow
• Multiple scope identifier confusion
• CLI configuration sharing
• Build-signing compatibility issues
• Developer ID signing support
• Release packaging workflows

Improved

• Platform API onboarding experience
• Footer status visibility
• Connection validation
• Enterprise deployment readiness
• Build automation
• macOS distribution compatibility

---

💡 Upgrade Recommendation

This is a recommended upgrade for all users.

Version 3.3.0 provides:

• Enterprise-ready signed distribution
• Apple notarization
• Automated deployment tooling
• Terminal automation support
• Improved credential lifecycle management
• Simplified Platform API configuration

---

🙏 Thank You

Thank you for using Blueprint Conversion Utility!

The addition of the CLI, Developer ID signing, Apple notarization, and enterprise-focused deployment enhancements mark a significant step toward enterprise-scale automation and deployment workflows.

BCU 3.2.2

Blueprint Conversion Utility 3.2.2

This release series introduces guided application updates, improved GitHub update reliability, workspace layout improvements, automatic installer-driven relaunch, and several UI and workflow refinements.

---

3.2.2

New

• Added automatic application relaunch after a successful update.
• Update workflow now launches a background monitor after opening macOS Installer.
• Application closes after the installer is launched.
• Updated application automatically relaunches when installation completes.

Improved

• Update dialog now clearly communicates the update lifecycle.
• Added monitoring of CFBundleShortVersionString to detect successful upgrades.
• Added timeout protection for abandoned or canceled installations.

Security

• macOS Installer continues to handle package validation, administrator authorization, and installation privileges.
• No privileged installation commands are executed directly by the application.

---

3.2.1

Fixed

• Removed duplicate application title displayed in the macOS toolbar.
• Fixed Deployment pane resize behavior.
• Corrected divider interaction where the cursor indicated resizing but pane sizing was fixed.

Improved

• Deployment pane is now fully resizable.
• Added minimum and maximum width constraints for workspace panes.
• Improved usability for longer device-group names and conversion details.

---

3.2.0

New

• Added guided application update installation.
• Added Download and Install option in update notifications.
• Application can now download release packages directly from GitHub Releases.
• Added PKG validation before launching Installer.
• Added native macOS Installer integration.

Improved

• Downloaded update packages are stored securely in the user's Application Support directory.
• Added update progress and status reporting.
• Added package validation to prevent invalid downloads from being opened.

Security

• Invalid files and HTML responses are rejected.
• Installer authorization remains controlled by macOS.
• Application does not perform direct privileged installation operations.

---

Previously Included Improvements

Update System

• GitHub tagged-release update discovery.
• Automatic update checks on first launch.
• Weekly automatic update checks after successful validation.
• Daily retry interval after failed update attempts.
• Redirect-based GitHub update detection that avoids API rate-limit issues.
• User-initiated manual update checks from the Help menu.

Configuration Profile Conversion

• Stable profile selection during asynchronous conversion.
• Automatic Platform device-group matching from source profile scope.
• Strict mobile and computer group filtering.
• Improved conversion planning and validation.

Workspace Enhancements

• Improved sidebar layout.
• Better profile-type selector placement.
• Resizable workspace regions.
• Enhanced deployment workflow.

Logging

• Unified Logging subsystem migrated to:

com.jawheelr.blueprintcreator

BCU 3.2.0

Blueprint Conversion Utility 3.2.0

New

• Added guided application update installation.
• The update window now includes Download and Install.
• Downloads the versioned PKG directly from the official GitHub release.
• Validates the downloaded file before opening it.
• Opens the package using the native macOS Installer.
• Displays download progress and installation status.

Update Safety

• Invalid files and HTML responses are rejected.
• Downloaded packages are stored with restricted permissions.
• Administrator authorization remains controlled by macOS Installer.
• The app does not execute privileged installation commands directly.
• Users can still open the GitHub release page or skip the update.

BCU 3.1.7

Blueprint Conversion Utility 3.1.7

Fixed

• Replaced the rate-limited GitHub REST API update check with the public releases/latest redirect.
• Update checks no longer require a GitHub token.
• Added friendly update-check errors instead of displaying raw GitHub rate-limit responses.
• Fixed Swift compiler errors affecting Unified Logging and normalized group-name matching.

Improved

• Successful automatic update checks run every seven days.
• Failed update checks retry after 24 hours.
• Manual update checks always run immediately.
• Platform device groups load before source-profile scope matching.
• Matching source groups automatically populate the Blueprint Deployment pane.
• Computer profiles show only computer/macOS groups.
• Mobile profiles show only mobile/iOS/iPadOS/tvOS groups.
• Profile selection remains highlighted while conversion data loads.

Logging

• Logs open automatically with the last hour of application events.
• Logs are filtered to:

com.jawheelr.blueprintcreator

**Full Changelog**: https://github.com/jawheelr/Blueprint-Conversion-Utility/commits/3.1.7

Initial Release

Blueprint Conversion Utility 3.1.6

Fixed

• Resolved Swift compiler failures affecting group-match logging.
• Corrected group-name normalization logic that could fail with newer Xcode/Swift toolchains.
• Fixed Platform device-group auto-selection from source configuration profile scope.
• Fixed profile-selection flicker during asynchronous profile loading and conversion.

Improved

• Device groups now load before source profile evaluation, allowing reliable automatic targeting.
• Deployment pane now auto-selects matching Platform groups from source profile scope.
• Computer profiles only display compatible computer/macOS groups.
• Mobile profiles only display compatible mobile/iOS/iPadOS/tvOS groups.
• Added exact and normalized group-name matching.
• Selected profiles remain highlighted while conversion data loads.
• Added inline loading indicators for profile processing.
• Moved PROFILE TYPE above the segmented control.
• Added sidebar sizing protections to prevent label wrapping.

Logging

• Default Logs view now opens with:
  • Last 1 hour
  • com.jawheelr.blueprintcreator subsystem
  • Compact log format
• Automatic log query on window open.
• Manual refresh, copy, export, and category filtering remain available.

Retained

• Platform-only API architecture
• Bundled jamf-cli and blueprint-profile-convert
• Semantic profile unscoping verification
• Weekly GitHub update checks
• Unified logging migration to com.jawheelr.blueprintcreator

Full Changelog: https://github.com/jawheelr/Blueprint-Conversion-Utility/commits/3.1.6