plugin-updater on macOS can't create temp directories, which requires admin privileges

[flamby]

Hi,

My app (app-sandbox=false) is packaged as a signed and notarized pkg file, for which I had to add a Components.plist with BundleIsRelocatable = false to force it to install under /Applications.

Without this key, I was not able to have the package installed under /Applications

Now that I'm trying to add updater feature, I'm facing - I think - the very same issue since, in my app logs, I see the update package to be unpack in a temporary directory similar to the installation package when I did not have the key described above
[2025-02-23 10:08:39][src/main.rs:130][INFO][MyOfflineModel] Failed to install update: failed to unpack ._MyOfflineModel.app into /var/folders/7d/l0mgzpm50jn5_1n3x9ywyrhh0000gn/T/tauri_updated_appauuG7Z/

I searched how to add this BundleIsRelocatable key to the tar.gz content as well, but there is only the Info.plist for which it's not accepted.

AFAIK it's not tauri-apps/tauri#8104 since I'm using latest plugin-updater commit which provides #2067 (confirmed by inspecting tauri-plugin-updater-2.5.0/src/*.rs I do see all the changes of this PR which provide osakit for admin privileges).

I'm not seeing any request for password, it seems to fail before.

Any help much appreciated.

tauri info output

[✔] Environment
- OS: Mac OS 15.3.1 arm64 (X64)
✔ Xcode Command Line Tools: installed
✔ rustc: 1.84.1 (e71f9a9a9 2025-01-27)
✔ cargo: 1.84.1 (66221abde 2024-11-19)
✔ rustup: 1.27.1 (54dd3d00f 2024-04-24)
✔ Rust toolchain: stable-aarch64-apple-darwin (default)
- node: 23.7.0
- pnpm: 10.4.1
- yarn: 1.22.22
- npm: 11.1.0
- bun: 1.2.3

[-] Packages
- tauri 🦀: 2.2.5
- tauri-build 🦀: 2.0.5
- wry 🦀: 0.48.0
- tao 🦀: 0.31.0
- @tauri-apps/api : 2.2.0
- @tauri-apps/cli : 2.2.7

[-] Plugins
- tauri-plugin-dialog 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#f6838d507f14981b6b7e0e745408360122c12bd6 (2.2.0)
- @tauri-apps/plugin-dialog : not installed!
- tauri-plugin-notification 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#6b4c3917389f4bc489d03b48a837557ac0584175 (2.2.1)
- @tauri-apps/plugin-notification : not installed!
- tauri-plugin-shell 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#f6838d507f14981b6b7e0e745408360122c12bd6 (2.2.0)
- @tauri-apps/plugin-shell : not installed!
- tauri-plugin-autostart 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#6b4c3917389f4bc489d03b48a837557ac0584175 (2.2.0)
- @tauri-apps/plugin-autostart : 2.2.0
- tauri-plugin-log 🦀: 2.2.1
- @tauri-apps/plugin-log : 2.2.1
- tauri-plugin-single-instance 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#6b4c3917389f4bc489d03b48a837557ac0584175 (2.2.1)
- @tauri-apps/plugin-single-instance : not installed!
- tauri-plugin-updater 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#f6838d507f14981b6b7e0e745408360122c12bd6 (2.5.0)
- @tauri-apps/plugin-updater : not installed!
- tauri-plugin-process 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#f6838d507f14981b6b7e0e745408360122c12bd6 (2.2.0)
- @tauri-apps/plugin-process : not installed!
- tauri-plugin-clipboard-manager 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#6b4c3917389f4bc489d03b48a837557ac0584175 (2.2.1)
- @tauri-apps/plugin-clipboard-manager : not installed!
- tauri-plugin-store 🦀: 2.2.0
- @tauri-apps/plugin-store : 2.2.0
- tauri-plugin-global-shortcut 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#6b4c3917389f4bc489d03b48a837557ac0584175 (2.2.0)
- @tauri-apps/plugin-global-shortcut : not installed!
- tauri-plugin-fs 🦀: git+https://github.com/tauri-apps/plugins-workspace?branch=v2#f6838d507f14981b6b7e0e745408360122c12bd6 (2.2.0)
- @tauri-apps/plugin-fs : not installed!

[-] App
- build-type: bundle
- CSP: default-src blob: data: filesystem: ws: wss: http: https: tauri: 'unsafe-eval' 'unsafe-inline' 'self' img-src: 'self'; connect-src ipc: http://ipc.localhost http://localhost:11434
- frontendDist: ../dist
- devUrl: http://localhost:1420/
- framework: React
- bundler: Vite

Thanks

[flamby]

/var/folders ls -l
total 0
drwxr-xr-x@ 3 root wheel 96 3 nov 2021 7d
drwxr-xr-x@ 3 root wheel 96 2 nov 2021 q2
drwxr-xr-x@ 50 root wheel 1600 23 oct 08:23 zz

From what I read here and there /var/folders/* are system-managed directories so root:wheel is normal and expected.

Looking at updater.rs, it seems admin privileges are asked only after temp directories are created, so that might be the issue:
since it happens to create this folder: /var/folders/7d/l0mgzpm50jn5_1n3x9ywyrhh0000gn/T/tauri_updated_appauuG7Z/

let tmp_extract_dir = tempfile::Builder::new()
            .prefix("tauri_updated_app")
            .tempdir()?;

plugins-workspace/plugins/updater/src/updater.rs

Line 1055 in 1ab5f15

let tmp_extract_dir = tempfile::Builder::new()

Need authorization is indeed a few block later:

if need_authorization {
    // Use AppleScript to perform moves with admin privileges
    let apple_script = format!(
        "do shell script \"rm -rf '{src}' && mv -f '{new}' '{src}'\" with administrator privileges",
        src = self.extract_path.display(),
        new = tmp_extract_dir.path().display()
    );

plugins-workspace/plugins/updater/src/updater.rs

Line 1097 in 1ab5f15

if need_authorization {

[flamby]

Thanks to GPT o1 mini high, as I don't know rust at all, I came up with a quick & dirty solution (very dirty, I know) in updater.rs
The osakit with admin privileges handle in one command all actions.

Hopes it helps someone.

#[cfg(target_os = "macos")]
impl Update {
    fn install_inner(&self, bytes: &[u8]) -> Result<()> {
        use std::{env, fs, path::PathBuf, process::Command};

        // Write the archive bytes to a temporary file.
        let temp_archive = env::temp_dir().join("update_archive.tar.gz");
        fs::write(&temp_archive, bytes)?;

        // The target directory (the current app bundle path).
        let src = self.extract_path.to_string_lossy();

        // Build a composite shell command that:
        // 1. Creates temporary backup and extraction directories.
        // 2. Sets proper permissions on the extraction directory.
        // 3. Unpacks the update archive into the extraction directory.
        // 4. If an existing app is present at `src`, moves it to backup.
        // 5. Removes the existing app at `src` and moves the new extraction into place.
        let command = format!(
            "TMP_BACKUP=$(mktemp -d -t tauri_current_app_backup) && \
             TMP_EXTRACT=$(mktemp -d -t tauri_updated_app) && \
             chmod 755 $TMP_EXTRACT && \
             tar -xzf '{}' --strip-components=1 -C $TMP_EXTRACT && \
             if [ -d '{}' ]; then mv '{}' $TMP_BACKUP/current_app; fi && \
             rm -rf '{}' && \
             mv $TMP_EXTRACT '{}'",
            temp_archive.display(),
            src,
            src,
            src,
            src
        );

        // Wrap the composite command in a single AppleScript invocation
        // with administrator privileges.
        let apple_script = format!(
            "do shell script \"{}\" with administrator privileges",
            command
        );

        // Execute the AppleScript command on the main thread.
        let (tx, rx) = std::sync::mpsc::channel();
        (self.run_on_main_thread)(Box::new(move || {
            let mut script = osakit::Script::new_from_source(osakit::Language::AppleScript, &apple_script);
            script.compile().expect("invalid AppleScript");
            let res = script.execute();
            tx.send(res).unwrap();
        }))?;

        let result = rx.recv().unwrap();
        if let Err(e) = result {
            return Err(Error::Io(std::io::Error::new(
                std::io::ErrorKind::Other,
                format!("AppleScript execution failed: {:?}", e),
            )));
        }

        // Optionally remove the temporary archive.
        let _ = fs::remove_file(temp_archive);

        // Touch the extract path to update its modification time.
        let _ = Command::new("touch")
            .arg(&self.extract_path)
            .status();

        Ok(())
    }
}

[szpnygo]

Is there any solution? Any new progress?