Sparkle-cli to update app that is run by launchd as root

[TotteAlm]

Hi,

I'm trying to update an app (my own) that installed by a .pkg-installer and installed with privs (owner is system) using the sparkle-cli as sparkle itself has "priv issues" and I need a silent update (No user interactions). The app is a faceless background application that is launched by launchd as root ( /Library/LaunchDaemons for the .plist file)
I've signed the sparkle.app with the same keys as the app to update.

Test using sparkle-cli
totte@machine % sudo ./sparkle.app/Contents/MacOS/sparkle /Applications/xxxxxxxxx.App --check-immediately --grant-automatic-checks --verbose
A new update check cannot be performed because updating this bundle will require user authorization. Please use --interactive or run as root to allow this.

To test that sudo actually is running sparkle-cli as root (just as a proof)
totte@machine % sudo ./sparkle /Applications/xxxxxxxxx.App --check-immediately --grant-automatic-checks --verbose --interactive
Error: --interactive is not supported when running as root

So, how to break this catch-22 using sparkle-cli

I'm using the Sparkle 2.6.4

Cheers,

Totte - Code 66

[zorgiepoo]

Cannot reproduce issue. What macOS version are you using? Did you build sparkle-cli yourself (perhaps incorrectly? e.g. signed with sandboxing) or are you using a prebuilt binary we provide? Sparkle does a simulated test to see if it has sufficient permission to replace/overwrite the bundle (SPUSystemNeedsAuthorizationAccessForBundlePath()), and it failed here.

[TotteAlm]

Hi,
Running on macOS 14.7.
I've tried both the one shipping in 2.6.4 and also built the 2.6.4 myself to see if there was a difference, but same behaviour for both.
No sandboxing is turned on.
The app is in /Applications but is periodically launched by launchd and has these disk privs
0 drwxr-xr-x@ 3 root admin.

Any ptr to what to do to figure out why it fails. The reason for using Sparkle-cli is that running Sparkle update from itself (if the background only flag is turned off) throws up the "Authentication dialog".

[TotteAlm]

OK, so this is still a mystery.

• Running in xcode in the debugger it works.
• Running the freshly built version after codesigning with setting hardened runtime works
• Running it after it has been put into an installer package with the whole build and being signed, notarized and stapled with a github action (together with the rest), and downloaded in a .pkg and installed throught the installer, the old error is there again.
  Will need to delve deeper into this it looks like.

[zorgiepoo]

You can also try commenting out this method implementation in sparkle-cli and see if the update can be installed then https://github.com/sparkle-project/Sparkle/blob/2.x/sparkle-cli/SPUCommandLineDriver.m#L137 (avoids calling SPUSystemNeedsAuthorizationAccessForBundlePath -- but if SPUSystemNeedsAuthorizationAccessForBundlePath returns YES under root user, then something fishy may be about and maybe could cause later install failure).

At the point it's failing, you can also upload/attach your copy of sparkle-cli.app produced from your pkg and I could take a look if it's signed wrong or something of that sort..

[TotteAlm]

OK, you are correct!

Disabling the check but checking the result from the check gave:
2024-10-11 10:46:02.944 Updater[70325:17431762] SPUSystemNeedsAuthorizationAccessForBundlePath gave:YES
Checking for Updates...
Found new update! (1.1.12)
Downloading Update...
Downloading 5164980 bytes...
Downloaded 16005 out of 5164980 bytes (0%)
...
Downloaded 5164980 out of 5164980 bytes (100%)
Extracting Update...
Extracting Update (5%)
...
Extracting Update (100%)
Installing Update...
Installation Finished.
Exiting.

[zorgiepoo]

Okay I will fix this in #2645

What directory is the app/bundle that you are updating in, if you don't mind me asking?
edit: I see, you said /Applications. Odd.

[TotteAlm]

It's in /Applications so no fancy location.