macOS shell games: long live bash

October 18, 2019October 27, 2019 brunerd

TL;DR – Bash ain’t goin’ nowhere on Mac, both version-wise and in terms of its presence. Looking at the longevity of other shells on the system, it will likely be around for a good while longer.

There’s been a lot of hand wringing and angst online about bash and zsh becoming the new default shell. Some folks feel Apple is signaling deprecation and removal and have the crushing feeling they must convert all their bash script to zsh. I think that’s a bit unnecessary.

True, the default shell is changing from bash to zsh, as Apple notes here. This is indeed a Good Thing™ as zsh shell has been one of the most frequently updated shells on macOS. Bash, on the other hand, has been stuck at varying versions of 3.2 for 12 years now! On the plus side, sysadmins have “enjoyed” predictable and stable behavior from bash during this time. Sure, you’d love new features but when you are scripting for the enterprise, across multiple OS versions, this is just the sort of thing you want: boringness and dependability.

As far as deprecations go, the only thing Apple has signaled as being deprecated eventually are scripting language runtimes (not shells):

Scripting language runtimes such as Python, Ruby, and Perl are included in macOS for compatibility with legacy software. Future versions of macOS won’t include scripting language runtimes by default, and might require you to install additional packages. If your software depends on scripting languages, it’s recommended that you bundle the runtime within the app. (49764202)
Use of Python 2.7 isn’t recommended as this version is included in macOS for compatibility with legacy software. Future versions of macOS won’t include Python 2.7. Instead, it’s recommended that you run python3 from within Terminal. (51097165)
mac OS Catalina 10.15 Release Notes

I’ve done some digging and culled the shell versions from OS X 10.0 to macOS 10.15, along with their respective release dates. I think it shows that shells, no matter how old and crusty, tend to be long lived and not soon removed on macOS.

Here’s a quick way to check your shell versions (except for dash):

macOS	zsh	bash/sh	csh/tcsh	ksh	dash
10.0	3.0.8 (2000-05-16)	3.0.8 (zsh, no bash)	6.08.00 (1998-10-02)	–	–
10.1	3.0.8 (2000-05-16)	3.0.8 (zsh, no bash)	6.10.00 (2000-11-19)	–	–
10.2	4.0.4 (2001-10-26)	2.05b.0 (2002-07-17)	6.10.00 (2000-11-19)	–	–
10.3	4.1.1 (2003-06-19)	2.05b.0 (2002-07-17)	6.12.00 (2002-07-23)	–	–
10.4	4.2.3 (2005-03-00)	2.05b.0 (2002-07-17)	6.12.00 (2002-07-23)	M p (1993-12-28)	–
10.5	4.3.4 (2007-04-19)	3.2.17 (2007-05-01)	6.14.00 (2005-03-23)	M s+ (1993-12-28)	–
10.6	4.3.4 (2008-11-03)	3.2.48 (2008-11-18)	6.15.00 (2007-03-03)	M s+ (1993-12-28)	–
10.7	4.3.11 (2010-12-20)	3.2.48 (2008-11-18)	6.17.00 (2009-07-10)	M s+ (1993-12-28)	–
10.8	4.3.11 (2010-12-20)	3.2.48 (2008-11-18)	6.17.00 (2009-07-10)	JM 93u (2011-02-08)	–
10.9	5.0.2 (2012-12-12)	3.2.51 (2010-03-17)	6.17.00 (2009-07-10)	JM 93u (2011-02-08)	–
10.10	5.0.5 (2014-01-06)	3.2.57 (2014-11-07)	6.17.00 (2009-07-10)	AJM 93u+ (2012-08-01)	–
10.11	5.0.8 (2015-05-31)	3.2.57 (2014-11-07)	6.18.01 (2012-02-14)	AJM 93u+ (2012-08-01)	–
10.12	5.2 (2015-12-02)	3.2.57 (2014-11-07)	6.18.01 (2012-02-14)	AJM 93u+ (2012-08-01)	–
10.13	5.3 (2016-12-12)	3.2.57 (2014-11-07)	6.18.01 (2012-02-14)	AJM 93u+ (2012-08-01)	–
10.14	5.3 (2016-12-12)	3.2.57 (2014-11-07)	6.18.01 (2012-02-14)	AJM 93u+ (2012-08-01)	–
10.15	5.7.1 (2019-02-03)	3.2.57 (2014-11-07)	6.21.00 (2019-05-08)	AJM 93u+ (2012-08-01)	dash-9 (1993)

As you can see, zsh has has been updated with almost every new release of macOS. Bash really hit a wall with 3.2 and as many have noted, it was v4’s change in licensing to GPLv3 that caused this (sh is really bash in sh compatibility mode so the versions are intertwined). csh/tcsh has the same duality thing going on and took a notably giant 7 year leap in 10.15 to a version from 2019. ksh has remained at the same version just as long as bash yet I don’t think anyone is fretting that ksh will be deprecated or removed. Finally, dash is just a weirdo that apparently disdains versioning! I used a combination of what /bin/dash and man dash to get some sort of crude answer.

So there you go: In my opinion, all signs point to bash being yet another shell on macOS for some time. Removing bash from macOS would break a lot of stuff and while that reason alone hasn’t stopped Apple before, I think they will let sleeping dogs lie. Go ahead and learn zsh, master it, customize it, or make it “sexy” but take the rumors of its demise on macOS with a grain of salt and dose of skepticism.

Install macOS High Sierra, HFS Compression, and OS X 10.8

April 3, 2018October 15, 2019 brunerd

If you have downloaded Install macOS High Sierra.app on a non-macOS 10.8 machine then copy said installer to a 10.8 Mac, the installer will be unusable. Why? HFS Compression. It seems Install macOS High Sierra.app uses HFS compression on numerous files and it seems 10.8 has issues with that and will not “see” those files.

To quickly demonstrate which files are compressed, we will use stat and examine the st_flags attribute, 0=no compression, 32=compression (thanks ghost of Mac OS X Hints!)

IFS=$'\n\t'; for file in $(find /Applications/Install\ macOS\ High\ Sierra.app -type f); do echo "$(stat -f %f "$file"): $file)"; done

You’ll see many files with 32 as the flag, these will not be readable in 10.8

The trick is to copy the file and do away with the HFS compression, we can use ditto for this:

ditto --nopreserveHFSCompression /Applications/Install\ macOS\ High\ Sierra.app [destination folder]

This will produce an installer compatible with 10.8… sure you could have downloaded it via the Mac App Store by now on a 10.8 machine, but now you know.

Java 8 Update 40 Installer App Fun!

March 6, 2015March 28, 2015 brunerd

So perhaps you saw my previous post: Java 8 without the Adware (aka Java8Unjunker)?

Java 8 U40 App

Good stuff eh? There was something in there that got me thinking: If they didn’t sign the package, is the app doing any integrity checks on the package inside either? Hmmm let’s see…

Voice over: We’ve secretly replaced the JavaAppletPlugin.pkg package with QuickTime 7 let’s see if it can tell the difference!
Not Java

Here we go!
Sure let me authenticate right when you run before any confirmation of action – why not!? (Ugh, bad form already.)

Java8 Auth

Safe and Easy

Oh OK, “safe and easy” – I love it! But just to clarify…
By “easy” you mean: Checking lots of trust boxes and clicking “Run” buttons a lot to get a Java apps working (plus crossing your fingers)?
By “safe” you mean: a steady stream of high scored CVEs with low complexity? Or even running in Unsafe Mode when needed?

OK what’s next?

Ask

Oh dear God no! No Ask.com. Uncheck. Next.

Oh, right, away we go, I gave you my password at the door. Installing Java are we?
Java8 Installing Installed

OK I’ve successfully installed Java then if you say so… I guess I that’s proof alright!
It then takes you to the Verify Java page — but who cares about that!

What does /var/log/install.log say about what was installed?

Yep it installed the QuickTime7 package we put in there and Java Updater 40.app was none the wiser.

So in conclusion… That’s a really nifty “Ask Toolbar installer” with arbitrary package installer Oracle. It’s also a great delivery vehicle for malware by nefarious folks. Heck, bundle Java along with your Trojan and the “Verify Java” page would open too! Sheesh. Is the Ask contract that lucrative? Oracle made $38 billion in revenue last year, IAC the parent of Ask.com pulled in $3 billion. I guess IAC have got money to spend and Oracle will take it (but not invest in more secure installers?)

Notes: The first attempt used a QuickTimePlayer7.6.6_SnowLeopard.pkg with an expired certificate, that halted the install. The 2nd attempt I stripped out the expired certificate. It worked. The 3rd time I downloaded a newly signed version from Apple, that too worked.

Parting note for Oracle:
Sign your critical packages! If you insist on using your glorified “Ask Toolbar installer app” to do this, then require that it verify the package integrity in some way, Orable! (heh, that was a typo but I like it: Orable, ha!)

Update: Oracle is now signing the package within and the installer can no longer be duped into running an arbitrary package. The version when this article was written was 1.8.40.25, it is now 1.8.40.27.

Damaged Java 8 — Attempted JavaAppletPlugin.pkg Replacement

Java 8 without the Adware (aka Java8Unjunker)

March 6, 2015March 6, 2015 brunerd

So you’ve heard the Ask toolbar is now bundled with Java 8 Update 40 for the Mac?
Yep, apparently it is.

Ask

Fortunately there’s a simple workaround! Let’s take control of our Macs and do a little spelunking into this new installer app.

Right or Control-Click the Java 8 Update xx.app and choose Show Package Contents

Show Package Contents

Navigate into Contents then Resources folder
Eureka we’ve found it: JavaAppletPlugin.pkg
Let’s run it!

Gatekeeper_Java8

Aw snap. It seems the package isn’t signed and Gatekeeper is not happy about that. I’m flabbergasted that they’d sign the installer app but not the package inside? (Update: I’m really flabbergasted!)

Control or right-click on JavaAppletPlugin.pkg and choose Open

Java 8 PKG Open

Click Open

Open JavaAppletPlugin

Here we are. Your unsigned Java installer awaits.

Installer

Alternately… Java8Unjunker.command

A script I just made to do the same thing plus some other nice things like: name the package and un-quarantine it. Of course being a script it’s not signable! Gatekeeper will balk if it’s on. You’ll need to right-click and choose Open as before.

Drag in your Java 8 Updater xx.app

Unjunker1

Press Enter.
Voilà! A folder with your package ready to double-click and go.

Unjunker2

Enjoy.

TMI…

#!/bin/bash

#Java 8 Unjunker - Joel Bruner
#Simply moves the JavaAppletPlugin.pkg package out of the installer app (which installs the Ask Toolbar) to the Desktop, renames and Un-Quarantines it

#touch file for debugging
[ -f /tmp/debug ] && set -x

#take command line argument too
sourceApp="$1"

#check to see if path provided is present and valid
#otherwise get the path
while [ -z "$sourceApp" -o ! -d "$sourceApp" ]; do
echo -n "Drag in Java 8 Update xx.app and press enter: "
read sourceApp
done

#get the version from the app
sourcePKGVersion=$(defaults read "$sourceApp"/Contents/Info CFBundleVersion)

#make Desktop folder and copy pkg to it, renamed
echo "Creating Directory ~/Desktop/Java $sourcePKGVersion"
mkdir ~/Desktop/"Java $sourcePKGVersion"
echo "Copying JavaAppletPlugin.pkg to ~/Desktop/Java $sourcePKGVersion/JavaAppletPlugin_${sourcePKGVersion}.pkg"
cp "$sourceApp"/Contents/Resources/JavaAppletPlugin.pkg ~/Desktop/"Java $sourcePKGVersion"/JavaAppletPlugin_${sourcePKGVersion}.pkg

#since Oracle doesn't sign the pkg just the .app we need to strip the quarantine xa off to suppress the warning
xattr -d com.apple.quarantine ~/Desktop/"Java $sourcePKGVersion"/JavaAppletPlugin_${sourcePKGVersion}.pkg

echo "Java Unjunked. Opening Folder."
open ~/Desktop/"Java $sourcePKGVersion"

RecoveryHD Updater now with PKG building

February 28, 2015November 13, 2015 brunerd

** Update: Recovery HD updaters packages for 10.11 will only work when run in OS X 10.11, previous packages could run in different OSesnot so for 10.11

Updated April 6, 2015: createRecoveryHDUpdater 15.4.6.command – built PKG now is targetable to volumes other than /

~~Released Feb 28, 2015: createRecoveryHDUpdater 15.2.28.command~~

Building off the previous work the updated script will now create a nicely named dmg

recoverydmg_icon

Containing both an interactive script for updating disks and a new script to create a .pkg!

The fruits of RecoveryHD PKG Maker.command:

Custom Bundle ID is interactively provided, the PackageVersion is matched to the OS release. Signing identity is asked for in the script but not tested (my cert might be broken, YMMV). ~~The target of the package is always / – an exercise for the reader to change the postinstall script to use Installer’s variables to affect the target~~ The exercise to make the .pkg targetable has been exercised by me… Enjoy!

BASH parameter fun

February 28, 2015February 28, 2015 brunerd

Some exercises in handling parameters in a script:

Using BASH_ARGV to loop through all arguments

#!/bin/bash #debugging output [ -f /tmp/debug ] && set -x

#Loop Though the arguments provided
#BASH places arguments in reverse order in BASH_ARGV array
#Start at end of array (ARGC – 1)
for (( i=$(( $BASH_ARGC – 1 )); i>=0; i– )); do
item=”${BASH_ARGV[$i]}”
echo “\$$(( $BASH_ARGC – $i )): $item”
done

Loop through all arguments with special handling of first and last only

#!/bin/bash [ -f /tmp/debug ] && set -x ##loop through parameters, start with end of BASH_ARGV for (( loopNumber=1, i=$(( $BASH_ARGC - 1 )); i>=0; i--, loopNumber++ )); do #do something special for first and last if [ $i -eq $(( $BASH_ARGC - 1 )) ]; then conditionalString="(I am the first one!)" elif [ $i -eq 0 ]; then conditionalString="(I am the last one!)" else unset conditionalString fi echo Arg $loopNumber: ${BASH_ARGV[$i]} $conditionalString done

Loop through all arguments with special handling of first and everything else

#!/bin/bash [ -f /tmp/debug ] && set -x

##loop through parameters, start with end of BASH_ARGV
for (( loopNumber=1, i=$(( $BASH_ARGC – 1 )); i>=0; i–, loopNumber++ )); do

#if not the last don’t restart dock
if [ $i -eq $(( $BASH_ARGC – 1 )) ]; then
unset conditionalString
conditionalString=”(I am the first)”
else
conditionalString=”(I am not the first)”
fi

echo Arg $loopNumber: ${BASH_ARGV[$i]} $conditionalString
done

Loop through all arguments with special handling of the last and everything else

#!/bin/bash [ -f /tmp/debug ] && set -x

##loop through parameters, start with end of BASH_ARGV
for (( loopNumber=1, i=$(( $BASH_ARGC – 1 )); i>=0; i–, loopNumber++ )); do

#if not the last don’t restart dock
if [ ! $i -eq 0 ]; then
conditionalString=”(I am not the last)”
else
unset conditionalString
#conditionalString=”(I am the last)”
fi

echo Arg $loopNumber: ${BASH_ARGV[$i]} $conditionalString
done

(WordPress is bugging the heck out of me with the code tags breaking when their are line breaks… sorry, that’s an exercise for the Googler)

Apple Remote Desktop 3.7.1

December 4, 2013January 21, 2014 brunerd

Apple has release Remote Desktop Admin 3.7.1

The release notes are sparse, as usual:

This update improves the overall stability and reliability of the Remote Desktop application. It includes the following specific improvements.

Prevents an issue that could cause the OS X Firewall to block Remote Desktop connections. See Additional Information below.
Improves reliability of the kickstart command.
Fixes the “Display full screen” option in Control & Observe preferences.

Hmmm, I didn’t see a bullet point titled: “Fixed insane memory and CPU usage issues”

Just installed the update. Fingers crossed.

Update: The answer is no… they didn’t fix runaway memory usage.

Naming Conventions! Please, Apple?

July 9, 2013July 9, 2013 brunerd 1 Comment

Apple, there was a time when your updates had naming conventions for the various platforms there were targeted for. Suffixes like Tiger, Leopard, Snow, etc. made it easy to identify for what platform an update package was intended.

SnowSecurityUpdates — Names used to be useful, who did you hire between April and September of 2012?

But then something happened. Somewhere after Snow Leopard 2012-002 and the first appearance of the 10.7/10.8 Java updates: form trumped function and all useful naming conventions were removed.

Which Java — Elegantly named and informational useless packages. Beautiful.

In the case of Java not just the platform name, but even what release number was removed too! Oh sure, someone took the time to change the disk image volume name, thanks, but once it was copied out of there, good luck in keeping things straight! Since these are flat packages now, Finder can’t tell you the version number in column view anymore, either.

WhichSecurityUpdate — What platform are you for? Should I just chuck all these at a machine and see what sticks?

How about the latest security updates? They all named the same! What a mess! Note that now even the disk image names are all the same too and the system has to resort to appending numbers on the volume name to avoid naming conflicts.

So Apple, if you are going to keep putting out security updates for older platforms then let’s stop pretending there is only one OS X release out there and start naming updates appropriately! Please? Thanks!

P.S. I’ve submitted a bug and mirrored it at Open Radar, if you are a systems administrator who is also irked by this trend of needless naming minimalism I encourage you to file a bug report and see if we can turn this around!

XProtect Plugin Checker

March 5, 2013March 5, 2013 brunerd 4 Comments

Are you a system administrator or power user who needs a quick way to check if your Flash or Java plugins have been blocked by Apple? Like so:

Then XProtectPluginChecker is the status menu app for you!

XProtect Plugin Checker icon Click to download.

Written in BASH, sprinkled with PlistBuddy/awk/sed-Fu with a dash of mdfind magic, and wrapped with Platypus, the aim is for XProtect Plugin Checker to be able to dynamically accommodate any additions Apple might make to the Plugin Blacklist, although only Flash and Java seem to be in their crosshairs right now, who knows? Silverlight might be next, given its lack of updates (going on 10 months).

A bonus idea for making this more useful is to make a launchd script that watches the XProtect plist file(s) then fires off the XProtectPluginChecker script when they change, emailing the results to you, because knowing is half the battle!

If you find this useful or if you have some hiccups with it, let me know. UPDATE: Now with comments enabled! :]

Also related, myXProtectStatus is a similar style menu status script that lists the malware threats Apple is blocking.

10.7.4: Return of partial volume and brightness shortcuts

May 9, 2012May 10, 2012 brunerd

Yes folks, the shorcuts for partial volume and brightness are back in 10.7.4! After users had grown to love and know Option-Shift-Volume Key and Option-Shift Brightness Key in previous versions of OS X (10.4, 10.5, and 10.6), Apple yanked the rug out from under users with 10.7. Well, now 9 1/2 months later they are finally back. Rejoice.

Now start filing those bug reports for the insane amounts of inactive memory being used and not released to Free… :/