From 9ebae36498d6b77880ec2c36e3e6cc29d020e9b0 Mon Sep 17 00:00:00 2001
From: Ryan Curran <rcurran@mozilla.com>
Date: Fri, 20 Feb 2026 12:53:10 -0500
Subject: [PATCH 1/3] disable ss via puppet

---
 .../manifests/init.pp                         | 40 +++++++++++++++++++
 .../manifests/profiles/screensaver.pp         |  3 +-
 .../roles/applicationservices_1_b_osx_1015.pp |  1 +
 .../roles/applicationservices_3_b_osx_1015.pp |  1 +
 .../roles/enterprise_1_b_osx_arm64.pp         |  1 +
 .../roles/enterprise_3_b_osx_arm64.pp         |  1 +
 .../manifests/roles/gecko_1_b_osx_1015.pp     |  1 +
 .../roles/gecko_1_b_osx_1015_staging.pp       |  1 +
 .../manifests/roles/gecko_1_b_osx_arm64.pp    |  1 +
 .../manifests/roles/gecko_3_b_osx_1015.pp     |  1 +
 .../manifests/roles/gecko_3_b_osx_arm64.pp    |  1 +
 .../manifests/roles/gecko_t_osx_1015_r8.pp    |  1 +
 .../roles/gecko_t_osx_1015_r8_staging.pp      |  1 +
 .../manifests/roles/gecko_t_osx_1400_r8.pp    |  1 +
 .../roles/gecko_t_osx_1400_r8_staging.pp      |  1 +
 .../manifests/roles/gecko_t_osx_1500_m4.pp    |  1 +
 .../roles/gecko_t_osx_1500_m4_ipv6.pp         |  1 +
 .../roles/gecko_t_osx_1500_m4_staging.pp      |  1 +
 .../manifests/roles/gecko_t_osx_1500_m_vms.pp |  1 +
 .../manifests/roles/mac_v4_signing_adhoc.pp   |  1 +
 .../manifests/roles/mac_v4_signing_dep.pp     |  1 +
 .../roles/mac_v4_signing_ff_ent_prod.pp       |  1 +
 .../manifests/roles/mac_v4_signing_ff_prod.pp |  1 +
 .../manifests/roles/mac_v4_signing_tb_prod.pp |  1 +
 .../roles/mac_v4_signing_vpn_prod.pp          |  1 +
 .../manifests/roles/mozillavpn_b_1_osx.pp     |  1 +
 .../manifests/roles/mozillavpn_b_3_osx.pp     |  1 +
 .../manifests/roles/nss_1_b_osx_1015.pp       |  1 +
 .../manifests/roles/nss_3_b_osx_1015.pp       |  1 +
 29 files changed, 68 insertions(+), 2 deletions(-)
 create mode 100644 modules/macos_disable_screensaver/manifests/init.pp

diff --git a/modules/macos_disable_screensaver/manifests/init.pp b/modules/macos_disable_screensaver/manifests/init.pp
new file mode 100644
index 0000000000..9fd27a8436
--- /dev/null
+++ b/modules/macos_disable_screensaver/manifests/init.pp
@@ -0,0 +1,40 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Disables the macOS screen saver and removes the password-after-screensaver
+# requirement by writing to the system-level com.apple.screensaver preferences
+# domain as root.  Writing to /Library/Preferences sets a system-wide default
+# that applies to all users, replacing the MDM/mobileconfig profile approach.
+# Works on macOS 10.15 and later.
+class macos_disable_screensaver {
+  $domain = '/Library/Preferences/com.apple.screensaver'
+
+  macos_utils::defaults { 'screensaver_idleTime':
+    domain   => $domain,
+    key      => 'idleTime',
+    value    => '0',
+    val_type => 'int',
+  }
+
+  macos_utils::defaults { 'screensaver_loginWindowIdleTime':
+    domain   => $domain,
+    key      => 'loginWindowIdleTime',
+    value    => '0',
+    val_type => 'int',
+  }
+
+  macos_utils::defaults { 'screensaver_askForPassword':
+    domain   => $domain,
+    key      => 'askForPassword',
+    value    => '0',
+    val_type => 'bool',
+  }
+
+  macos_utils::defaults { 'screensaver_askForPasswordDelay':
+    domain   => $domain,
+    key      => 'askForPasswordDelay',
+    value    => '0',
+    val_type => 'int',
+  }
+}
diff --git a/modules/roles_profiles/manifests/profiles/screensaver.pp b/modules/roles_profiles/manifests/profiles/screensaver.pp
index bf897af356..e540fc9558 100644
--- a/modules/roles_profiles/manifests/profiles/screensaver.pp
+++ b/modules/roles_profiles/manifests/profiles/screensaver.pp
@@ -5,8 +5,7 @@
 class roles_profiles::profiles::screensaver {
   case $facts['os']['name'] {
     'Darwin': {
-      # This disables the screensaver
-      include macos_mobileconfig_profiles::setdefaultscreensaver
+      include macos_disable_screensaver
     }
     default: {
       fail("${facts['os']['name']} not supported")
diff --git a/modules/roles_profiles/manifests/roles/applicationservices_1_b_osx_1015.pp b/modules/roles_profiles/manifests/roles/applicationservices_1_b_osx_1015.pp
index 9ff9d5f74e..c4cfd2a762 100644
--- a/modules/roles_profiles/manifests/roles/applicationservices_1_b_osx_1015.pp
+++ b/modules/roles_profiles/manifests/roles/applicationservices_1_b_osx_1015.pp
@@ -14,6 +14,7 @@
   include roles_profiles::profiles::ntp
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/applicationservices_3_b_osx_1015.pp b/modules/roles_profiles/manifests/roles/applicationservices_3_b_osx_1015.pp
index 53659b2924..a0f173f709 100644
--- a/modules/roles_profiles/manifests/roles/applicationservices_3_b_osx_1015.pp
+++ b/modules/roles_profiles/manifests/roles/applicationservices_3_b_osx_1015.pp
@@ -14,6 +14,7 @@
   include roles_profiles::profiles::ntp
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/enterprise_1_b_osx_arm64.pp b/modules/roles_profiles/manifests/roles/enterprise_1_b_osx_arm64.pp
index 57dd28258b..113d27dc79 100644
--- a/modules/roles_profiles/manifests/roles/enterprise_1_b_osx_arm64.pp
+++ b/modules/roles_profiles/manifests/roles/enterprise_1_b_osx_arm64.pp
@@ -13,6 +13,7 @@
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/enterprise_3_b_osx_arm64.pp b/modules/roles_profiles/manifests/roles/enterprise_3_b_osx_arm64.pp
index d5bfa682da..f3082a4d87 100644
--- a/modules/roles_profiles/manifests/roles/enterprise_3_b_osx_arm64.pp
+++ b/modules/roles_profiles/manifests/roles/enterprise_3_b_osx_arm64.pp
@@ -13,6 +13,7 @@
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015.pp b/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015.pp
index f6fa57b6b9..61f3e57e73 100644
--- a/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015.pp
@@ -13,6 +13,7 @@
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015_staging.pp b/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015_staging.pp
index 134d42e3cf..3b1ae9105b 100644
--- a/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015_staging.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_1_b_osx_1015_staging.pp
@@ -12,6 +12,7 @@
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_1_b_osx_arm64.pp b/modules/roles_profiles/manifests/roles/gecko_1_b_osx_arm64.pp
index 6a62542a42..b17bd2152e 100644
--- a/modules/roles_profiles/manifests/roles/gecko_1_b_osx_arm64.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_1_b_osx_arm64.pp
@@ -13,6 +13,7 @@
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_3_b_osx_1015.pp b/modules/roles_profiles/manifests/roles/gecko_3_b_osx_1015.pp
index e9ebcc12c9..ab5eaa00ea 100644
--- a/modules/roles_profiles/manifests/roles/gecko_3_b_osx_1015.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_3_b_osx_1015.pp
@@ -12,6 +12,7 @@
   include roles_profiles::profiles::ntp
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_3_b_osx_arm64.pp b/modules/roles_profiles/manifests/roles/gecko_3_b_osx_arm64.pp
index 9374c42544..d3cfe13878 100644
--- a/modules/roles_profiles/manifests/roles/gecko_3_b_osx_arm64.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_3_b_osx_arm64.pp
@@ -13,6 +13,7 @@
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8.pp
index cb8c397cfc..b0e2b63f52 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8.pp
@@ -20,6 +20,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
   include roles_profiles::profiles::safariupdate
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8_staging.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8_staging.pp
index 9d6a6c3dc3..5cc911c2a2 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8_staging.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1015_r8_staging.pp
@@ -21,6 +21,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
   include roles_profiles::profiles::safariupdate
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8.pp
index 8daf7bfed3..e3b2c1e522 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8.pp
@@ -22,6 +22,7 @@
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::talos
   include roles_profiles::profiles::timezone
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8_staging.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8_staging.pp
index a18ab73b57..dd2c1e9925 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8_staging.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1400_r8_staging.pp
@@ -23,6 +23,7 @@
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::talos
   include roles_profiles::profiles::timezone
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4.pp
index 91aa37a6c6..edcec35490 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4.pp
@@ -21,6 +21,7 @@
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::talos
   include roles_profiles::profiles::timezone
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_ipv6.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_ipv6.pp
index 663755876f..8c0a924688 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_ipv6.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_ipv6.pp
@@ -19,6 +19,7 @@
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::talos
   include roles_profiles::profiles::timezone
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_staging.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_staging.pp
index c2bcbbf515..0a2793a950 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_staging.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m4_staging.pp
@@ -21,6 +21,7 @@
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::talos
   include roles_profiles::profiles::timezone
diff --git a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m_vms.pp b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m_vms.pp
index acfdcd28e9..1c8bc15051 100644
--- a/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m_vms.pp
+++ b/modules/roles_profiles/manifests/roles/gecko_t_osx_1500_m_vms.pp
@@ -15,6 +15,7 @@
   include roles_profiles::profiles::pipconf
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::safaridriver
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::talos
   include roles_profiles::profiles::timezone
diff --git a/modules/roles_profiles/manifests/roles/mac_v4_signing_adhoc.pp b/modules/roles_profiles/manifests/roles/mac_v4_signing_adhoc.pp
index 65316fa23f..afb8699ea2 100644
--- a/modules/roles_profiles/manifests/roles/mac_v4_signing_adhoc.pp
+++ b/modules/roles_profiles/manifests/roles/mac_v4_signing_adhoc.pp
@@ -17,6 +17,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::remove_bootstrap_user
   include roles_profiles::profiles::signing_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/mac_v4_signing_dep.pp b/modules/roles_profiles/manifests/roles/mac_v4_signing_dep.pp
index 99f1882d26..6d42c15169 100644
--- a/modules/roles_profiles/manifests/roles/mac_v4_signing_dep.pp
+++ b/modules/roles_profiles/manifests/roles/mac_v4_signing_dep.pp
@@ -17,6 +17,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::remove_bootstrap_user
   include roles_profiles::profiles::signing_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_ent_prod.pp b/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_ent_prod.pp
index f4392c949d..7bd6246516 100644
--- a/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_ent_prod.pp
+++ b/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_ent_prod.pp
@@ -17,6 +17,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::remove_bootstrap_user
   include roles_profiles::profiles::signing_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_prod.pp b/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_prod.pp
index d0874fe303..acb7297cf7 100644
--- a/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_prod.pp
+++ b/modules/roles_profiles/manifests/roles/mac_v4_signing_ff_prod.pp
@@ -17,6 +17,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::remove_bootstrap_user
   include roles_profiles::profiles::signing_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/mac_v4_signing_tb_prod.pp b/modules/roles_profiles/manifests/roles/mac_v4_signing_tb_prod.pp
index 37d3e9f922..d47a3277f7 100644
--- a/modules/roles_profiles/manifests/roles/mac_v4_signing_tb_prod.pp
+++ b/modules/roles_profiles/manifests/roles/mac_v4_signing_tb_prod.pp
@@ -17,6 +17,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::remove_bootstrap_user
   include roles_profiles::profiles::signing_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/mac_v4_signing_vpn_prod.pp b/modules/roles_profiles/manifests/roles/mac_v4_signing_vpn_prod.pp
index 653c7ae075..98f2fe3a31 100644
--- a/modules/roles_profiles/manifests/roles/mac_v4_signing_vpn_prod.pp
+++ b/modules/roles_profiles/manifests/roles/mac_v4_signing_vpn_prod.pp
@@ -17,6 +17,7 @@
   include roles_profiles::profiles::relops_users
   include roles_profiles::profiles::remove_bootstrap_user
   include roles_profiles::profiles::signing_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/mozillavpn_b_1_osx.pp b/modules/roles_profiles/manifests/roles/mozillavpn_b_1_osx.pp
index 1f6d10c3b4..c8dac08648 100644
--- a/modules/roles_profiles/manifests/roles/mozillavpn_b_1_osx.pp
+++ b/modules/roles_profiles/manifests/roles/mozillavpn_b_1_osx.pp
@@ -13,6 +13,7 @@
   include roles_profiles::profiles::network
   include roles_profiles::profiles::ntp
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/mozillavpn_b_3_osx.pp b/modules/roles_profiles/manifests/roles/mozillavpn_b_3_osx.pp
index e63e33ee72..bc912e3d46 100644
--- a/modules/roles_profiles/manifests/roles/mozillavpn_b_3_osx.pp
+++ b/modules/roles_profiles/manifests/roles/mozillavpn_b_3_osx.pp
@@ -13,6 +13,7 @@
   include roles_profiles::profiles::network
   include roles_profiles::profiles::ntp
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/nss_1_b_osx_1015.pp b/modules/roles_profiles/manifests/roles/nss_1_b_osx_1015.pp
index 533c11237d..0502ed9102 100644
--- a/modules/roles_profiles/manifests/roles/nss_1_b_osx_1015.pp
+++ b/modules/roles_profiles/manifests/roles/nss_1_b_osx_1015.pp
@@ -12,6 +12,7 @@
   include roles_profiles::profiles::ntp
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users
diff --git a/modules/roles_profiles/manifests/roles/nss_3_b_osx_1015.pp b/modules/roles_profiles/manifests/roles/nss_3_b_osx_1015.pp
index ffd4723e82..ce862ced26 100644
--- a/modules/roles_profiles/manifests/roles/nss_3_b_osx_1015.pp
+++ b/modules/roles_profiles/manifests/roles/nss_3_b_osx_1015.pp
@@ -12,6 +12,7 @@
   include roles_profiles::profiles::ntp
   include roles_profiles::profiles::packages_installed
   include roles_profiles::profiles::relops_users
+  include roles_profiles::profiles::screensaver
   include roles_profiles::profiles::sudo
   include roles_profiles::profiles::timezone
   include roles_profiles::profiles::users

From 5c26f6596248218deb9e4e5b203d9b7a7c48d12d Mon Sep 17 00:00:00 2001
From: Ryan Curran <rcurran@mozilla.com>
Date: Fri, 20 Feb 2026 13:48:46 -0500
Subject: [PATCH 2/3] fix

---
 modules/roles_profiles/manifests/profiles/screensaver.pp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/roles_profiles/manifests/profiles/screensaver.pp b/modules/roles_profiles/manifests/profiles/screensaver.pp
index e540fc9558..0a1dca11e4 100644
--- a/modules/roles_profiles/manifests/profiles/screensaver.pp
+++ b/modules/roles_profiles/manifests/profiles/screensaver.pp
@@ -5,7 +5,11 @@
 class roles_profiles::profiles::screensaver {
   case $facts['os']['name'] {
     'Darwin': {
+      mac_profiles_handler::manage { 'org.mozilla.SetDefaultScreensaver':
+        ensure => 'absent',
+      }
       include macos_disable_screensaver
+      Mac_profiles_handler::Manage['org.mozilla.SetDefaultScreensaver'] -> Class['macos_disable_screensaver']
     }
     default: {
       fail("${facts['os']['name']} not supported")

From e5f580c54bbdb8417207163e15dbb8f417b7508a Mon Sep 17 00:00:00 2001
From: Ryan Curran <rcurran@mozilla.com>
Date: Fri, 20 Feb 2026 14:37:10 -0500
Subject: [PATCH 3/3] fix

---
 modules/macos_utils/manifests/defaults.pp | 41 ++++++++++++++---------
 1 file changed, 26 insertions(+), 15 deletions(-)

diff --git a/modules/macos_utils/manifests/defaults.pp b/modules/macos_utils/manifests/defaults.pp
index f9c7cf63f3..d455dbd864 100644
--- a/modules/macos_utils/manifests/defaults.pp
+++ b/modules/macos_utils/manifests/defaults.pp
@@ -3,22 +3,33 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 define macos_utils::defaults (
-    Optional[String] $domain = undef,
-    Optional[String] $key = undef,
-    Optional[String] $value = undef,
-    String $user = 'root',
-    Enum['string', 'int', 'float', 'bool', 'date', 'array'] $val_type = 'string',
+  Optional[String] $domain = undef,
+  Optional[String] $key = undef,
+  Optional[String] $value = undef,
+  String $user = 'root',
+  Enum['string', 'int', 'float', 'bool', 'date', 'array'] $val_type = 'string',
 ) {
-
-    $defaults_cmd = '/usr/bin/defaults'
-    if ($domain != undef) and ($key != undef) and ($value != undef) {
-        exec { "osx_defaults write ${domain} ${key}=>${value}" :
-            command => "${defaults_cmd} write ${domain} ${key} -${val_type} ${value}",
-            unless  => "/bin/test x`${defaults_cmd} read ${domain} ${key}` = x'${value}'",
-            user    => $user,
-        }
+  $defaults_cmd = '/usr/bin/defaults'
+  # macOS 10.15+ requires 'true'/'false' for -bool, not '0'/'1'.
+  # 'defaults read' returns '0'/'1', so $value is used in the unless check
+  # while $write_value is used in the actual write command.
+  if $val_type == 'bool' {
+    $write_value = $value ? {
+      '0'     => 'false',
+      '1'     => 'true',
+      default => $value,
     }
-    else {
-        fail('Cannot ensure present without domain, key, and value attributes')
+  } else {
+    $write_value = $value
+  }
+  if ($domain != undef) and ($key != undef) and ($value != undef) {
+    exec { "osx_defaults write ${domain} ${key}=>${value}" :
+      command => "${defaults_cmd} write ${domain} ${key} -${val_type} ${write_value}",
+      unless  => "/bin/test x`${defaults_cmd} read ${domain} ${key}` = x'${value}'",
+      user    => $user,
     }
+  }
+  else {
+    fail('Cannot ensure present without domain, key, and value attributes')
+  }
 }