Sample manifest to use with MDM InstallApplication command

manifest.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>items</key>
	<array>
		<dict>
			<key>assets</key>
			<array>
				<dict>
					<key>kind</key>
					<string>software-package</string>
          <key>md5-size</key>
          <integer>3249600</integer>
          <key>md5s</key>
          <array>
            <string>e89892d2a0541043f72876cafed78020</string>
          </array>
					<key>url</key>
          <string>https://myserver.com/munkitools-2.4.0.2561-signed.pkg</string>
				</dict>
			</array>
      <key>metadata</key>
			<dict>
				<key>bundle-identifier</key>
				<string>com.googlecode.munki.ManagedSoftwareCenter</string>
        <key>bundle-version</key>
        <string>4.1.2531</string>
        <key>items</key>
        <array>
          <dict>
      			<key>bundle-identifier</key>
      			<string>com.googlecode.munki.core</string>
      			<key>bundle-version</key>
      			<string>2.4.0.2561</string>
      		</dict>
      		<dict>
      			<key>bundle-identifier</key>
      			<string>com.googlecode.munki.admin</string>
      			<key>bundle-version</key>
      			<string>2.4.0.2561</string>
      		</dict>
      		<dict>
      			<key>bundle-identifier</key>
      			<string>com.googlecode.munki.app</string>
      			<key>bundle-version</key>
      			<string>4.1.2531</string>
      		</dict>
      		<dict>
      			<key>bundle-identifier</key>
      			<string>com.googlecode.munki.launchd</string>
      			<key>bundle-version</key>
      			<string>2.0.0.1969</string>
      		</dict>
        </array>
        <key>kind</key>
				<string>software</string>
				<key>subtitle</key>
				<string>My Org</string>
				<key>title</key>
				<string>Munki Bootstrap Package</string>
			</dict>
		</dict>
	</array>
</dict>
</plist>

Important notes: the MD5 hash and size are required, in my testing experience. The integer used in md5-size can be the size of the entire file, or chunked for larger files. Chunking requires there to also be multiple hashes inside the md5s array for all the pieces. In this example I used the full size of the file so there is only one md5s entry.

Secondly, the package must be signed or there will be errors logged in /var/log/commerce due to missing appropriate privileges: installd[460]: PackageKit: request (at PKTrustLevelNotSigned) not compatible with right(s) system.install.apple-software, system.install.apple-software.standard-user, system.install.app-store-software, system.install.app-store-software.standard-user, system.install.software.mdm-provided

It's probably a good idea not to allow any old package to be installed using your organization's MDM service.