Forge Home


Puppet package provider for the Mac App Store


7,196 latest version

4.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 0.0.2 (latest)
  • 0.0.1
released Apr 2nd 2016

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'binford2k-mas', '0.0.2'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add binford2k-mas
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install binford2k-mas --version 0.0.2

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



binford2k/mas — version 0.0.2 Apr 2nd 2016

Mac App Store package management

Table of Contents

  1. Overview
  2. Setup
  3. Limitations


This is a barebones package provider for the Mac App Store. It's still fairly early in development, but should work for most things. Be aware that the Mac App Store is intended for interactive use, so you'll likely get popup dialogs requesting your iCloud password unless you save it for free items.

This uses the mas command-line tool:

Projects $ puppet resource package
package { '1Password':
  ensure => '443987910',
package { 'DaisyDisk':
  ensure => '411643860',
package { 'Dash':
  ensure => '458034879',
package { 'GarageBand':
  ensure => '682658836',
package { 'Keynote':
  ensure => '409183694',
package { 'Kindle':
  ensure => '405399194',
[... plus a whole pile of gems, etc ...]

Projects $ puppet resource package Dash
package { 'Dash':
  ensure => '458034879',

This can take standard ensure parameters and can also accept App IDs. This is a bit weird, and I might refactor it sometime. But it seemed like the most reasonable way to handle the unusual versioning scheme used by the Mac App Store. This allows you to install apps that don't have unique names.

package { 'Dash':
  ensure   => present,
  provider => mas,

package { 'Kindle':
  ensure   => '405399194',
  provider => mas,

package { 'Twitter':
  ensure   => latest,
  provider => mas,


This comes with a utility class to install the mas tool using Homebrew and (optionally) to log into an account. This isn't required if you're managing this some other way, or prefer the end user to manage the logged in account manually.

Warning: including passwords in Puppet manifests means that they are visible in the catalog and every report. You might consider using binford2k/node_encrypt to mitigate that issue!


  • This is super early in development.
  • Installing by name will only work when the App Store has only a single app by that name. Otherwise, you'll need to use the app ID.
  • You cannot upgrade a single package. Instead, it will upgrade all outdated packages. This is a limitation of the mas tool.
  • You can only install the latest version of any app.
  • You may see popup dialogs requesting App Store logins. Choose to save your password for free apps to see this dialog less.


I take no liability for the use of this module.