Only show updates for higher OSes if the ShowOptionalInstallsForHigherOSVersions preference is true

code/client/munkilib/prefs.py

@@ -157,25 +157,26 @@ def pref(pref_name):
         - default_prefs defined here.
     """
     default_prefs = {
-        'ManagedInstallDir': '/Library/Managed Installs',
-        'SoftwareRepoURL': 'http://munki/repo',
+        'AppleSoftwareUpdatesOnly': False,
         'ClientIdentifier': '',
+        'DaysBetweenNotifications': 1,
+        'FollowHTTPRedirects': 'none',
+        'InstallAppleSoftwareUpdates': False,
+        'LastNotifiedDate': NSDate.dateWithTimeIntervalSince1970_(0),
         'LogFile': '/Library/Managed Installs/Logs/ManagedSoftwareUpdate.log',
         'LoggingLevel': 1,
         'LogToSyslog': False,
-        'InstallAppleSoftwareUpdates': False,
-        'AppleSoftwareUpdatesOnly': False,
+        'ManagedInstallDir': '/Library/Managed Installs',
+        'PackageVerificationMode': 'hash',
+        'PerformAuthRestarts': False,
+        'ShowOptionalInstallsForHigherOSVersions': False,
+        'SoftwareRepoURL': 'http://munki/repo',
         'SoftwareUpdateServerURL': '',
-        'DaysBetweenNotifications': 1,
-        'LastNotifiedDate': NSDate.dateWithTimeIntervalSince1970_(0),
-        'UseClientCertificate': False,
-        'SuppressUserNotification': False,
         'SuppressAutoInstall': False,
         'SuppressStopButtonOnInstall': False,
-        'PackageVerificationMode': 'hash',
-        'FollowHTTPRedirects': 'none',
+        'SuppressUserNotification': False,
         'UnattendedAppleUpdates': False,
-        'PerformAuthRestarts': False,
+        'UseClientCertificate': False,
     }
     pref_value = CFPreferencesCopyAppValue(pref_name, BUNDLE_ID)
     if pref_value is None:

code/client/munkilib/updatecheck/analyze.py

@@ -35,6 +35,7 @@ from .. import fetch
 from .. import info
 from .. import installer
 from .. import munkilog
+from .. import prefs
 from .. import processes
 
 
@@ -159,7 +160,7 @@ def process_optional_install(manifestitem, cataloglist, installinfo):
 
     item_pl = catalogs.get_item_detail(manifestitem, cataloglist,
                                        suppress_warnings=True)
-    if not item_pl:
+    if not item_pl and prefs.pref('ShowOptionalInstallsForHigherOSVersions'):
         # could not find an item valid for the current OS and hardware
         # try again to see if there is an item for a higher OS
         item_pl = catalogs.get_item_detail(
@@ -174,12 +175,12 @@ def process_optional_install(manifestitem, cataloglist, installinfo):
             item_pl['note'] = ('Requires macOS version %s.'
                                % item_pl['minimum_os_version'])
             item_pl['update_available'] = True
-        else:
-            # could not find anything!
-            display.display_warning(
-                'Could not process item %s for optional install. No pkginfo '
-                'found in catalogs: %s ', manifestitem, ', '.join(cataloglist))
-            return
+    if not item_pl:
+        # could not find anything that matches and is applicable
+        display.display_warning(
+            'Could not process item %s for optional install. No pkginfo '
+            'found in catalogs: %s ', manifestitem, ', '.join(cataloglist))
+        return
 
     is_currently_installed = installationstate.some_version_installed(item_pl)
     needs_update = False
@@ -199,7 +200,8 @@ def process_optional_install(manifestitem, cataloglist, installinfo):
             needs_update = False
         else:
             needs_update = installationstate.installed_state(item_pl) == 0
-        if not needs_update:
+        if (not needs_update and
+                prefs.pref('ShowOptionalInstallsForHigherOSVersions')):
             # the version we have installed is the newest for the current OS.
             # check again to see if there is a newer version for a higher OS
             display.display_debug1(