TN 4521: Adobe Updaters vs keyed programs

Adobe updaters for Creative Suite products, CS5 and beyond, include a "mode=sassa" option that can recognize a keyed installation and update it correctly while preserving the keyed state.

2012.08.08 (reviewed)

The standard product updaters for Adobe CS5, CS5.5 and CS6 are "keyed-state-aware" – this means they will recognize a keyed installation and refuse to run while posting a dialog that says "Contact your KeyServer administrator...". However, Adobe has implemented a special "mode=sassa" option which when activated, causes the modified updater to correctly preserve the keyed state of the main executable.

Before proceeding, make sure your K2 Products database has the latest definitions for Adobe products – use the "Find Product Definitions" from the KeyConfigure Tasks menu.

1. Install the latest, updated, Adobe Product versions and set up KeyServer Policies to manage the keyed variant:

  • Install the relevant Creative Suite product(s) using the standard, initial release CS product installer(s)
  • Download and save the relevant updater(s) from the Adobe product support page
  • Update the installed CS components
  • Key any updated version of the main program(s) as usual, using the "Key a Program...." menu item in KeyConfigure
    (the wizard will automate the inclusion of the keyed variant into appropriate Product definitions)

With a management Policy configured for one or more of the CS Products, verify that you have achieved the desired behavior when launching the keyed program.

In the next steps, you will modify the updater's behavior using Adobe's "--mode=sassa" option so the updater will still run even when encountering a keyed installations. Furthermore, when this modified updater is run on a computer where an unkeyed program version is installed, it will likewise be replaced by a keyed version!

Note: the steps below must be performed on a computer where step 1 was performed so that it that has the updated and keyed executable installed in the standard location.

2. Create a modifiable copy of the updater:
    (as the "mode=sassa" option is applied, a message will confirm success while listing the updater payloads being modified)

  • on Mac, use Disk Utility
    from the Images menu use the Convert... menu item to loacate the updater dmg
    save a copy in “read/write” Image Format, but keep the same name (so you will have to save in a different location)
    and then mount this new modifiable dmg
  • on Windows,
     extract the contents of the updater zip, saving as a modifiable folder.

3. Navigate within the modifiable mounted dmg or updater folder and activate the "sassa" option:

  • on Mac, use the Terminal utility to enter:
       sudo --mode=sassa
  • on Windows, use the command prompt to enter:
       AdobePatchInstaller.exe --mode=sassa


The next steps describe how to reconstruct a dmg (Mac) or zip (Win) that is exactly like the original in terms of structure, name, and contents – but containing the "sassa" modified installer from above. It is important to make sure that the resulting updater has exactly the same file and folder structure (starting at the root level of the dmg or zip) as the original updater.

4. Reconstruct the product updater(s):

  • on Mac, use Disk Utility:
    un-mount the modified dmg and then from the Images menu use the Convert... menu item to save as “compressed”. Again keep the original file name
  • on Windows, use a Zip Utility:
    create a zip file encapsulating the contents of your extracted and modified updater folder. Name the zip file exactly like the original updater zip

We now have an updater that will produce a keyed executable when run on a computer that has some previous version installed. Test the modified updater to verify its behavior and then make it available by whatever means is convenient for use on computers where keyed software is installed. Caution: this modified updater will also produce a keyed executable when run on a computer with an unkeyed older product version, so take care to manage where it is run.