For every vendor that doesn't care enough to do their Mac packages correctly

loginwindow.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>AutoLaunchedApplicationDictionary</key>
	<array>
		<dict>
			<key>Hide</key>
			<true/>
			<key>Path</key>
			<string>/Applications/SafeConnect.app</string>
		</dict>
	</array>
	<key>Vendor</key>
	<dict>
		<key>ID</key>
		<string>SafeConnect</string>
	</dict>
</dict>
</plist>

postinstall

#!/bin/bash
#
# This postflight script echoes the values of the available 
# arguments and environmental variables.
#


# Make sure directory exists
if [ ! -d /Library/LaunchDaemons ];
then
  # Nope
  mkdir /Library/LaunchDaemons
  chmod 755 /Library/LaunchDaemons
  chown root /Library/LaunchDaemons
fi
 

# Make the install dir read/executable by everyone

chmod 744 $2/SafeConnect.app/Contents/MacOS/scManagerD
chmod 755 $2/SafeConnect.app/Contents/MacOS/scClient


#Rename the App twice to make sure the finder re-reads the info.plist
mv $2/SafeConnect.app $2/SafeConnectXyZ.app
mv $2/SafeConnectXyZ.app $2/SafeConnect.app

#Remove and Migrate old PK if it is installed
if [ -d /Applications/PolicyKey.app ];
then
  if [ -f /Applications/PolicyKey.app/Contents/MacOS/sc.dat ];
  then 
   killall PolicyKey
   cp /Applications/PolicyKey.app/Contents/MacOS/sc.dat $2/SafeConnect.app/Contents/MacOS/.
   rm -r /Applications/PolicyKey.app;
  fi
fi




#we have some different steps for osx 10.6 and up for the scClient
OSX_VER=`sw_vers | grep 'ProductVersion:' | grep -o '[0-9]*\.[0-9]*\.[0-9]*'|awk -F"." '{print $2}'`

if [ [$OSX_VER > 5] ];then 


XPREFS=""
# We need to nuke this file if it has our startup stuff in it, it will double launch the scClient
#I have found no way to edit it out so it has to be nuked.
if [ -f /Library/Preferences/loginwindow.plist ];
then
   # The file is here, now only add the defaults if they are not already there
   XPREFS=`defaults read /Library/Preferences/loginwindow | grep SafeConnect`;
   if [ -n "$XPREFS" ]; 
   then
    rm -f /Library/Preferences/loginwindow.plist;   
  fi
fi


#the new method for starting the client
cp -f /Applications/SafeConnect.app/Contents/Resources/Safe.Connect.client.plist /Library/LaunchAgents/Safe.Connect.client.plist
#chmod 644 /Library/LaunchAgents/Safe.Connect.client.plist
#chown root /Library/LaunchAgents/Safe.Connect.client.plist


# Launch the Agent.  This will launch as root so we need to kill it and re-launch
killall scClient
open $2/SafeConnect.app


else

# setup the loginwindow hook.
X=""
# Make sure this file is here before we bother trying to read it
if [ -f /Library/Preferences/loginwindow.plist ];
then
   # The file is here, now only add the defaults if they are not already there
   X=`defaults read /Library/Preferences/loginwindow AutoLaunchedApplicationDictionary | grep $2/SafeConnect.app`;
else
   # copy our premade which will aid in uninstall
  cp -f $1/Contents/Resources/loginwindow.plist  /Library/Preferences/loginwindow.plist
  X="installed";
fi

# there is a plist file, but we didn't make it.  We could have if this an old PK install, but there is no vendor marker
# in that file, which means uninstall will not kill it.
if [ -z "$X" ]; then
  
    # If this file does not already exist, it will be created
    defaults write /Library/Preferences/loginwindow AutoLaunchedApplicationDictionary -array-add '<dict><key>Hide</key><true/><key>Path</key><string>'$2/SafeConnect.app'</string></dict>';
fi

#make sure everyone can read from this file
chmod 644 /Library/Preferences/loginwindow.plist
chown root /Library/Preferences/loginwindow.plist

# now launch the PK
open $2/SafeConnect.app
sleep 1

fi


 


# Copy the uninstaller
cp -Rf /Applications/SafeConnect.app/Contents/SCUninstall.app "/Applications/Uninstall SafeConnect.app"
  


# Copy are daemon plist file
cp -f /Applications/SafeConnect.app/Contents/Resources/Safe.Connect.plist /Library/LaunchDaemons/Safe.Connect.plist
chmod 644 /Library/LaunchDaemons/Safe.Connect.plist
chown root /Library/LaunchDaemons/Safe.Connect.plist


# Launch the Daemon
launchctl load /Library/LaunchDaemons/Safe.Connect.plist

exit 0

preflight

#!/bin/bash
#
# This preflight script echoes the values of the available 
# arguments and environmental variables.
#



SCDIR="/Applications/SafeConnect.app"

# Kill the old proc if its running
killall scClient
if [ -f /Library/LaunchDaemons/Safe.Connect.plist ];
then
launchctl unload /Library/LaunchDaemons/Safe.Connect.plist;
fi

# lets try an overwrite instead
# Nuke the old dir if it is still there
#if [ -d $SCDIR ]; then rm -rf $SCDIR; fi


exit 0

what to say.txt

The Mac package is a mess, you have files being moved from the app bundle instead of setting the destination of them in the payload, pre and postinstall scripts should only be necessary to start/restart processes, it assumes a live, booted system($2 instead of $3/Applications - and variable quoting...), the loginwindow manipulation (from 2009) is inaccurate(filename seems wrong so it's probably just ignored), is destructive, and all in all should be unnecessary - that's not how you do loginhooks,
it assumes all called binaries/commands are in the path of the shell session running the script, and with the 'open' command assumes that it's being installed in a user context - what about installs over the login window?
Also, there should be an RSS/appcast feed for your software so we can poll it to check as new updates come out, e.g. http://sparkle-project.org