Building the wrapper package

With the payload and script in place, build the package in two stages using Apple's built-in packaging tools.

Steps

Build the component package:

pkgbuild --root ~/wrapper/payload \
  --scripts ~/wrapper/scripts \
  --identifier com.forcepoint.websenseendpoint.wrapper \
  --version 1.0 \
  --install-location / \
  WrapperComponent.pkg

Build the final distribution package:
```
productbuild --package WrapperComponent.pkg WebsenseEndpointInstaller.pkg
```
Note: To find the full path of the generated file at any point, run find ~ -iname "WebsenseEndpointInstaller.pkg" 2>/dev/null. If you are already in the working directory, run pwd or realpath WebsenseEndpointInstaller.pkg.

Result

The build commands work as follows:

--identifier is the unique bundle-style identifier of the wrapper package itself. It must follow reverse-DNS naming, for example com.forcepoint.websenseendpoint.wrapper.
--install-location / together with the payload's internal path (private/tmp/websenseendpoint_install) determines where the staged files land on the target macOS endpoint.
pkgbuild produces the component package. productbuild wraps it into a distribution package, which is the format Intune expects to receive.
WebsenseEndpointInstaller.pkg is the deliverable produced by this stage, but it is not yet ready to upload to Intune. See Signing and notarizing the wrapper package.