Fix #120 - Update the mas role to use root privileges

[glennbrown]

Fixes #120 - Switch mas role to community.general.mas module and add root privileges

This update resolves Issue #120 by migrating the mas role from old approach of using mas binary with command module to the community.general.mas module while using root privileges.

Changes:

• Switched to using community.general.mas module
• Added mas binary path to environment (required for remote Mac execution)
• Updated uninstall, install, and upgrade tasks to run as root

Context:

Root privileges are now required due to upstream changes in mas 4.0.0+. From the mas project notes:

Root privileges are now necessary to install/update apps from the App Store, because Apple secured installd on macOS 26.1+, 15.7.2+ & 14.8.2+ to fix CVE-2025-43411. To simplify the code, mas 4.0.0+ requires root privileges to install/update apps for all versions of macOS, even older ones for which installd hasn't been secured. Most users are already, or soon will be, using affected macOS versions.

Root privileges were always necessary to uninstall apps from the App Store, because such apps are owned by the root user on macOS. mas 4.0.0+ will request root privileges if you run mas without them, so you needn't remember to use sudo mas uninstall … like beforehand.

Root privileges can be granted by running using sudo mas … on the command line, or, if you run mas by itself without sudo, by entering your macOS account password when prompted by mas. If you choose the latter route, the supplied password is piped directly from the terminal to an external process sudo call in the mas executable; your password is never seen by any mas code, nor is it stored in any way.

Any sudo credentials used or established by the mas executable will remain valid, pursuant to your user-configured sudo timeout settings.

[geerlingguy]

Thank you! I think I can merge this soon — but what version is the mas module added in? Might need to update https://github.com/geerlingguy/ansible-collection-mac/blob/master/meta/runtime.yml ? (or maybe not, if it's 3rd party collection...)

[glennbrown]

Thank you! I think I can merge this soon — but what version is the mas module added in? Might need to update https://github.com/geerlingguy/ansible-collection-mac/blob/master/meta/runtime.yml ? (or maybe not, if it's 3rd party collection...)

It's part of the community.general collection same as the homebrew, homebrew_cask and homebrew_tap modules. I am not entirely sure what version it was added in, but it appears to have been there for a bit.