Doin' Mac Pkgs Rong

[macpkghallofshame]

Graphically Obtuse

Let's not talk about package managers in general, but you may think of nix as a solution when you desire more problems. 'Measure twice, cut once' is a saying, and you'd think a shop with the name Determinate Systems wants to be measurable. But here we are, the 'Universal' nix installer package they've released has no payload and runs everything in the postinstall script, with a separate 7MB binary for Apple Silicon and 8MB for Intel.

!/bin/sh args="--verbose install --no-confirm --diagnostic-attribution=PKG-3C6F9A5D-5AD1-470C-94B2-CF4734B2128A" if /usr/sbin/sysctl -n machdep.cpu.brand_string | /usr/bin/grep -oi "Intel"; then exec ./nix-installer-x86_64-darwin $args else exec ./nix-installer-aarch64-darwin $args fi

Installer.app therefore has no idea what the size of the actual payload is, but that's only to stay on the measuring theme, there's way many other violations of logic where the people they've asked could've enlightened them/they could've taken hints and learned about Proper Packaging Principles.

Let's start with their recent announcement post which states it was created for these two benefits: a signed package 'for secur' (obvs), and since it's in the distribution format you can push via MDM (lol).

Why the snark? (Besides the fact very few people in their right mind trust MDM a.k.a. mgmt over UDP with software installation.) Why are those two points not obviously highest-value to have for the nix community? Well when what's really happening under the covers is shelling out to the binary you delivered, your process is not noticeably more advantageous than copying and pasting from the nix-installer README. Yes, you signed a script and sped up the process some amount by not needing to curl ~8MBs before the process begins. But that's not what made this first try at a 'graphical installer' post-worthy. (Hello, soon to be 2024! small 3-ish year slumber for ye olde tumblr).

It's the claim that ~I need to join YET ANOTHER DISCORD to provide feedback~ installation packages cannot 'provide custom parameters' - sure, if you want to build a graphical experience then you need to do more than deliver bits to disk. It's not like they didn't decide to code some stuff, there's two JS functions that run before you even decide to go ahead with the install, because they want to avoid conflicting with a previous install of nix-darwin or something. How folks have handled this is providing a GUI (via an installer plugin or a first-run experience) that takes whatever responses you want to prompt about and writes to an artifact on disk that the installer can also check for to supply defaults (and even enable enterprise distribution if it writes to either preference domains or uses standards like AppConfig).

We're rooting for you, nix friendlies, you're in the MacAdmins Slack... help us help you!

[macpkghallofshame]

All This Snappin' is Making Me Twitch

When playing buzzword bingo, it's important to be learn-ed. Machine Learn-ed. Make sure you get your intelligence artificially. Reality is yours for the augmenting, and Los Angeles has some pretty mind-expanding chemicals, as evidenced by the pre- and post-installs for Snap Camera (from the artist formerly known as SnapChat).

Why would you download this software in the first place? How else are Snap going to get the 'Lenses' you made in the LensStudio in front of your unwitting coworkers or Twitch subscribers (or both)? Sorry, Zoom broke their integration so you’ll need Teams to turn yourself into a peanut. But, hey, now there's a point of differentiation for all y'all on Hangouts/Meet/Skype(and WebEx, I guess, if whoever you're talking to is chained to Cisco?)

SNAP_CAMERA_ASSISTANT_EXE=AssistantService

You always know it's about to be quality code if they refer to binaries/processes generically as... EXE's? No less than 4 variables in the preinstall are wholly unused? I guess this person was being paid by the line and therefore needed to build up each subfolder in the path to the app in... /Applications, as put in place by THE ACTUAL PAYLOAD. Backticks instead of $() of course, not quoting... anything, rm -rf'ing unquoted... I didn't realize shellcheck would show multiple 'suggestions' for a single line, but here we are (10 times for ~40 lines of code).

I'm also scared/impressed that they know about killall but not... dscl and then grep’ing out the non-underscore users etc.? At least if you're iterating over home folders use basename instead of cut'ing on delimiter forward slash and choosing the 3rd field? If you're dscl'ing you'd also be able to grab the UID without running id -u for every folder you encounter (including Shared or \ (deleted) users).

It’s not all bad news! SUPER impressed they know about launchctl asuser, but not sure why they're also... launchctl remove'ing? Like, calling launchctl to run launchctl? :jackie: Srsly tho, it's in the same legacy subcommands section of the man page covering 1.x commands, and when you unload the job it already spent the time block’ing, using remove to ostensibly do the same thing... again? Yo. Dawg.

Then we get to the main event, the postinstall. Where it echo's a plist into ~/Library/LaunchAgents. Yup. After it mkdir -p's in $HOME to make sure Library/LaunchAgents exists? Nice assumption of logged-in-user you got there. Install this as root from the CLI with a user logged in, and since the program argument runs a bundle with telemetry code (Hockey via Microsoft) which wants to... register in the keychain to 'safely' identify the root 'user', (which has no user keychain to store anything in) enjoy this cool popup!

I also don't quite get why Zoom and these folks copy the plugin (AKA the virtual camera this needs to masquerade as/layer on top of) from the app bundle into place - you maybe could just symlink? Or... now, fly with me for a sec, PUT IT IN THE PAYLOAD? It's only 3MBs out of total ~150MB size, what's another 3 among friends.

Oh, but we're not even DONE echo'ing launchd jobs! The root /Library/LaunchDaemon one's even better. bash -c calling osascript THEN calling do shell script? Check. Shell script with unquoted paths exactly like you saw in the preinstall? Check. rm -rf's without quoting? Check.

Then a sudo -u $USER (again with that assumption of logged-in user!) to open the app before leaving? Ah, just, golf clap. Exit zero, just like the receipt version. You earned it.

[macpkghallofshame]

W

They're wireless microphones - they need to have their levels adjusted, firmware updated, and in general be tracked while in use. Seinnheiser makes a bunch, although according to Wikipedia at one point their company name was 'Labor W', short for Laboratorium Wennebostel in Germany where they were founded.

Fun fact! In Japan, where they think English is cool and really love mangling it, they refer to things that are 'double' with... a W. So I'd like to think Seinnheiser likes the idea of double the labor for anything they do.

Similarly googling to do as little research for this post as possible, as I understand it the Mono (let's bring .NET to all platforms! disambiguation from what my brother had in high school) it's been around for the relatively long ~20 years, and Xamarin was spun off/funded by Microsoft to assist primarily with Android and iOS apps by Mono's creators.

You thought Electron was chunky, but Mono framework weighs in at ~325MBs... compressed. You at least can guess all that C# stuff is running faster than random javascript someone shipped because it was Internet Ready. Hope you had 1GB available before the actual code Sennheiser wrote. I guess the lesson Electron learned is you don't practically need to ship an entire IDE's worth of superfluous shit to disk to make an app run? Or perhaps you actually appreciate 44.9MBs of Microsoft.CodeAnalysis.CSharp.dll.dylib.

Back to the matter at hand, after agreeing to the licenses of various wonderful software on the download site (like Apple's own zeroconf-alike implementation commonly referred to as ~Rendezvous~ Bonjour or MDNS, the M standing for multicast) and waiting for 410MBs to download, we can move several apps, zips, pkgs, .exe, dll.dylib, .ini files, and a totally legit looking binary called softlink creator onto disk. I love that the .zip's never get expanded, they must actually be getting read into the app! Because reasons 🥴.

Who needs receipts to be any version besides 1.0?

Before we install don't you need to clean out what used to be there? As sudo, of course, assuming you’re installing against the startup disk, but of course! I mean it's not like that's exactly what even an upgrade install would do to the same paths... but in reality they're copying almost exactly the mono framework pkg's two preinstall scripts both do. Uh huh.

After dropping the random compressed craplings on disk, time to do the real work! Wait, in the postinstall we should... install the mono framework because installers themselves can't drop bits on disk or be like, I dunno, metapkgs that contain multiple ones. Like mono itself. As that's the first installer let's look at its twin identical postinstalls. sh -x! Love it, From the shebang we know this gun b gud.

Now contains magical perl! Every other line is whitespace, because 110 lines of bash aren't unreadable enough, the 260 line wonderfully politically correct 'whitelist.txt' referenced therein is similarly infected (and doesn’t use the installer built-in variables to be found relative to the script). They delete anything in /usr/local/bin that looks like theirs, surprise, your fault, and after setting up a paths.d and... building gtk? other chowns against humanity occur and then mono is ready. (Files in the payload are group wheel instead of admin but read-only, so I'm unsure what the last chown really accomplishes functionally, or why they didn't just... set it in the payload, or just chown the built files, but I guess this is why I drink.😵)

Then! The rest of Seinnheiser's own postinstall. Spaces or tabs, they say “Yes!”. Delete the mono installer and its folder because obvs, then we get crazy. Let's assume a logged-in user and smack something called wsm.senn in ~/Documents/WSM/Configuration? As sudo? sudo export MONO_GC_PARAMS=major=marksweep-conc sure, go for it It su's to the user? To set random prefs? Didn't they write the app, can't they just make the prefs that way by... 'default'? There's one commented-out, just hanging out before they exit 0? 🤪I mean, gotta drop the mic somewhere.

[macpkghallofshame]

To The Cloud!

Ok, I know it’s been a while, but don’t worry - we’re back to tell you how to use the internet.

I’ve told you twice, I’ve told you a thousand times, two spaces after a period! Just kidding, what type of animal does that.

Anyway. So say you want to put a cloudapp on your Lappy 486. There’s an installer, oh we’re in for a treat.

WTH is Linebreak SL? Well whoever out of this 17 person team across two continents got their package signed and notarized, good on ‘em. That being said... what do these two install scripts do?

Well that dog won’t hunt, only perfect spellers may run code on this system. It’s a story that will never be told...

Hope we have better luck with the correctly spelled script.

Nobody tell them about advanced binaries that can work with names like, I dunno, killall. But who makes installer exit early and launches the app in postinstall? That’s just bad manners. Bad. They should feel bad.

At least they’re putting the files in the payload and not, like, cp -R’ing from... /tmp... Uh huh, they don’t just want to be sloppy in bash, did you notice that updateApp.scpt in /Library/Application Support/Cloudapp? Before we sign off, 

Welp, that’s it, I have no idea WTF is going on. You sunk my scrabbleship!

[macpkghallofshame]

[macpkghallofshame]

Indistinguishable from Malware

It looks like a package, right?

Uh, there’s no files in the payload. Let’s expand it.

pkgutil --expand ~/Downloads/zoomusInstaller.pkg ~/Downloads/zoomusInstaller-expanded.pkg

Ok, there’s a pkg inside that... what the what?

The Distribution file has to say something about this... ok, it’ll allow install to a user’s home folder, and runs this pm_install_check(), which normally maps to system requirement-type stuff. 

Wait a minute. Oh no they didn’t.

That’s system.run, charging ahead and running the preinstall script in the Scripts folder (next to zm.zip and a copy of the browser plugin?) without waiting for us to confirm installation?

It’s checking admin membership...?

And here it’s unzipping the 11MB zm.zip file inside the pkgs Scripts folder, essentially installing the app DURING THE INSTALL CHECK, based on logic of where it has write access to, and then gives the app 775, (and copies the browser plugin into /Library, making one in ~/Library if need be, while it’s at it,) just ‘cause.

As if that wasn’t bad enough, (installing files before you’ve explicitly approved it doing so,) after messing about with PlistBuddy to try and remove older versions of itself from the Dock (hello, 2009!)...

I mean, this is beyond:

It uses APPLESCRIPT to have INSTALLER prompt the user about adding to the Dock! After which it kills it (thrice, because y’know - Do it nice, do it thrice). So you’d believe that installer actually delivered a payload successfully. Sneaky and craptacular, what an aroma!

👏🏻

[macpkghallofshame]

Yes, matrox, 1. make a tsch 2. herefile to use Applescript 3. to add your app to loginitems and 4. launch it. Quality! 

[macpkghallofshame]

Expressively bad

Extensis Portfolio Express client download is bad and they should feel bad.  

It downloads as a .zip that decompresses to a .dmg...mkaaay. 

The DMG mounts and it’s a read/write disk image....whyyyyy?

The app is a drag and drop install..on the dmg its rights are 777. *mic drop*

[macpkghallofshame]

Why you’re making this harder than it needs to be

Consider this a TL,DR for the aforementioned Commandments:

ALL YOU’RE SUPPOSED TO DO IS:

put files THAT ARE IN THE PAYLOAD on disk

with proper perms, scripts to a minimum

Please reply to this post with vendors that just don’t get it!

I mean, is that so hard?

[macpkghallofshame]

Printer drivers, beginner level - clueless about shell scripting

What's wrong with this picture?

Did they really need sudo? How about nobody realizes that you can, I dunno, glob? And don't forget, all's well that ends with 777!

[macpkghallofshame]

References & Counterexample to Kick Things Off

Welcome! Posts on this blog may have a negative tone and bent, because Adobe. We will be piling-on those laziest and most mis-guided of developers and release engineers, as it's their job to do this simpler and right, not to be rong and make Sysadmins lives harder.

So we can point vendors towards the light, here's the canonical resource: https://www.afp548.com/2010/06/03/the-commandments-of-packaging-in-os-x/ (Over 5 years old - wake up, sheeple!)

And for how to interact with vendors when they release their software in a sub-optimal way, here's interactions with the osquery devs that resulted in Good Things™: this regarding signing, and this regarding full paths (as pointed out to me by @tvsutton)

@Sacrilicious I still have at least one complaint: /var should be /private/var.

— Tim Sutton (@tvsutton) March 1, 2015

Now, may the public scorn commence!