Auth required for upgrade despite having access to /Applications directory

[jeffduet]

When Sparkle shows a popup that an update is available, and I try to install it, it always prompts for the password of my current user.

This is a bit surprising since this current user already has read/write access to /Applications, and I even verified I can write and delete files in /Applications.

The problem with this is that not only is it inconvenient to users, but it is prohibiting installs from happening in the background.

Here are some logs from the console that seem relevant, does anyone have any ideas?

default 14:19:22.888339-0700 authd Validating shared credential XXX (501) for authenticate-admin (engine 47)
default 14:19:22.888353-0700 authd credential 501 expired '6518.236469 > 0' (does NOT satisfy rule) (engine 47)
default 14:19:22.888451-0700 authd Validating session owner XXX (501) for authenticate-admin (engine 47)
default 14:19:22.889425-0700 authd session owner 501 is member of group admin (does satisfy rule) (engine 47)

default 14:19:23.059372-0700 authd engine 47: running mechanism builtin:authenticate (1 of 3)

error 14:19:27.087923-0700 authd Evaluate cancelled or failed -60006 (engine 47)
default 14:19:27.087955-0700 authd Failed to authorize right 'MYAPP.sparkle2-auth' by client '/Applications/MYAPP.app' [3781] for authorization created by '/Applications/MYAPP.app' [3781] (3,0) (-60006) (engine 47)
error 14:19:27.088234-0700 authd copy_rights: authorization failed

Does this mean that no applications installed to /Applications can ever be configured for automatic background updates?

[zorgiepoo]

Those logs aren't super helpful. There might be more helpful logs under your app's process name.

Is your app sandboxed and if so, are you following the sandboxing documentation? (For example, the Installer XPC Service cannot be sandboxed, and sandboxing it would prevent having write access to the bundle and having installation working).

If you can move your app in /Applications in Finder without an authorization prompt then Sparkle shouldn't require auth, which may point to a misconfiguration issue.

Oh and also updates that use a package installer (pkg) always require authorization. The solution there is to not use pkg if that's the case here.

[jeffduet]

I checked under my processes name but didn't find anything that seemed related. My understanding is that the OS itself is what is popping up the auth request, and the logs I gave earlier correlate directly to that request.

Can you clarify what you mean by moving my app? I am able to rename it without authorization, but if I try to move it to Desktop nothing happens. However if I try the same thing for other apps (including 3rd party) the same thing happens. And by misconfiguration, what/where could be misconfigured?

I am not using any .pkg files.

[zorgiepoo]

Does installing the update work if you authorize it?

Sparkle decides to bring up the authorization dialog, not the OS. It is based on if YourApp.app is writable and if ../YourApp.app is writeable. I am also assuming you're using a recent version of Sparkle.

If you move the app with Finder you may need to make sure it is not copying an alias file (maybe hold command while dragging the app). mv from Terminal may be better test.

If you reproduce the problem, and then collect logs right away for the last 5 minutes, compress/upload/share it, it may reveal something: sudo log collect --last 5m

I still don't know if your app is sandboxed

[jeffduet]

Sorry, I had forgotten to mention about the Sandbox status. My app is not sandboxed.

Yes, installing works if I authorize it.

I'm using Sparkle 2.2.2.

Moving with mv from Terminal fails, and here are the permissions:

me@me-Air /Applications % mv myapp.app ~/Desktop
mv: rename myapp.app to /Users/me/Desktop/myapp.app: Permission denied
me@me-Air /Applications % ls -l myapp.app
total 0
drwxr-xr-x@ 11 root admin 352 Apr 20 08:02 Contents

(Out of curiosity I checked the permissions for the ExpressVPN.app [a random 3rd party app] and they are the same.)

Due to security reasons I'm not too comfortable sharing a huge log bundle like that with everything in it. Is it possible for me to just filter out the Sparkle log messages? Or is there a specific set of messages you are looking for?

[zorgiepoo]

me@me-Air /Applications % mv myapp.app ~/Desktop
mv: rename myapp.app to /Users/me/Desktop/myapp.app: Permission denied
me@me-Air /Applications % ls -l myapp.app
total 0
drwxr-xr-x@ 11 root admin 352 Apr 20 08:02 Contents

This is already a "problem" probably. if you ls -l /Applications then myapp.app in there is probably root admin instead of yourusername admin for example. I have 3rd party apps (that are downloaded outside of the App Store and not using pkg's) as myusername admin or myusername staff. Since the owner is root in your case, you can't move or replace it without auth. /Applications for me is root admin (from ls -l /).

[jeffduet]

I have modified my app's installer so the permissions are set to [current user] and staff for the application. And now when I click 'Install Update' for a manual update, it will update w/o asking for my password.

However, if I leave the app on (or if I close and reopen), I never see the app automatically upgraded. I see the "Automatically download and install updates in the future" checked on the "Software Update" UI, but I have not clicked "Install Update" so I am not sure if that has been taken into effect. (Note: I reinstalled after doing the above manual upgrade test in order to test the case where user has not done a manual update.)

Does the user have to do one manual update before the automatic kicks in? I'm trying to get it so automatic is enabled from the start, but user can disable it if desired.

[zorgiepoo]

No, Sparkle checks for updates in the background automatically once every 24 hours by default to prevent too frequent polling. If you want to test resetting the last checked update time on your machine before launching your app, you can run defaults delete mybundleid SULastCheckTime. There should also be an Autoupdate process run in the background when the update is installing.

Side note that "app installers" are not the norm and not generally desirable or favorable by users. It is actually very odd you have a custom one considering you can't serve it over to Sparkle.