Sparkle AutoUpdate.app requires admin

[gaocan1992]

Before I used Sparkle framework without any problem but now since I want to make a custom Sparkle build, I have built a release version of Sparkle using Sparkle 1.18.1 and replace the old sparkle framework in my project with this.
But now the AutoUpdate.app requires admin. Any idea why it happened?

[kornelski]

Most likely it's caused by permissions, e.g. the app bundle is owned by another user or you don't have write permission to /Applications.

We print more information to Console.app

[gaocan1992]

It is weird because the old version doesn't need to have write permission.
From the Console.app
I found

Autoupdate PID to listen: xxxxx

authd succeeded authorizing right 'system.privilege.admin' by client '/Users/{me}/Library/Caches/{my app's identifier}/org.sparkle-project.Sparkle/{My app's name} (Autoupdate).app' [21040] for authorization created by '/Users/{me}/Library/Caches/{my app's identifier}/org.sparkle-project.Sparkle/{My app's name} (Autoupdate).app' [21040] (13,0)

security_authtrampoline executing /Users/{me}/Library/Caches/{my app's identifier}/org.sparkle-project.Sparkle/{My app's name} (Autoupdate).app/Contents/MacOS/fileop

[gaocan1992]

@kornelski I investigated the app bundle's permission.
If I drag & drop this app into Applications folder the AutoUpdate.app won't pop up that permission window.
If I use pkg installer to install the app in Applications folder then it requires admin for AutoUpdate.app.
The difference I found is that the first app bundle has "admin Read Only permission" but the later one has "wheel Read Only permission".
Both have "{current user} Read & Write permission" and "everyone Read permission"

[jkbullard]

Aren't you supposed to specify the ownership and permissions of each file in a pkg install when you make the pkg -- either implicitly from the ownership/permissions on the files from which the pkg is created, or explicitly in a post-install script? (Folder ownership/permissions are also set this way, I think.)

[gaocan1992]

@jkbullard
In my post-install script ($2 - Target location)
I have this permission setting:

chown -R "$USER" "$2"

do sudo -E -u "$USER" open "$2"

[gaocan1992]

maybe a same issue #752

[jkbullard]

@gaocan1992 - I'm not an expert on pkgs, but you aren't specifically setting the group ownership.

Maybe you need something like

chown -R "$USER:staff" "$2"

(Looking at my /Applications folder, some apps are $USER:staff, some are $USER:admin, some are root:wheel.)

[jkbullard]

@gaocan1992 - My understanding is that a "standard" user can't change apps that are $user:admin, but can change apps that are $user:staff, but I'm not certain about it.

[gaocan1992]

@jkbullard
Looks like it works, I will make some tests.

[gaocan1992]

@jkbullard
Today I am testing it using a Guest account of my Mac then it happened again.
Is that because my Guest account is not considered as a standard user?
You said that a "standard" user can change apps that are $user:staff

[kornelski]

Yes. Guests shouldn't be able to replace applications.

[gaocan1992]

@kornelski But is that possible to give guests permission to replace applications?

[kornelski]

Yes, you can make them read & write for everyone (but then don't give your guest account to anyone you don't trust).

[gaocan1992]

@kornelski I have done that like you suggested and I also think it is the way to go:

But for my guest account when it updates it still pops up that window asking admin password.