First some background. I’d been waiting for a bump in Apple’s laptop line for quite some time and it got to the point where the money I’d saved was starting to burn a hole in my bank account and make inroads to the Earth’s core. So Apple finally and quietly released a new set of MacBook Pros on the 12th July and it was like: credit card clear? check! bank account has enough funds? check! TARGET SIGHTED! PULLING TRIGGER!
I’m typing this now on the results. However during the course of events after receiving the machine I did make some discoveries and they’re all related to “Our new T2 chip overlords” ™.
I decided to update the OS, using my developer account and the 10.14 beta that I’ve access to. Not going to discuss anything NDA, don’t worry. Part way through the initial installation process I thought: “Hey, I wonder if I can hit command + L and get a log window?”.
Yes you can. You can save it too, so I did for later examination.
I also did wonder that the initial window stayed on “estimating 2 minutes …” for rather longer than two minutes. Anyway 30 or so minutes after that, I then examined the log file that I’ve saved earlier.
Oh.
So for brevity’s sake, I’ll post a snippet of the relevant items and then I’ll go through.
Jul 24 08:51:57 Richards-MacBook-Pro InstallAssistant[546]: Hardware: MacBookPro15,1 @ 2.60 GHz (x 12), 32768 MB RAM
Jul 24 08:51:57 Richards-MacBook-Pro InstallAssistant[546]: Running OS Build: Mac OS X 10.13.6 (17G2112)
Jul 24 08:51:57 Richards-MacBook-Pro InstallAssistant[546]: Env: TMPDIR=/var/folders/jc/q967nwyn0clb9wbz4g8nj8tm0000gn/T/
...
Jul 24 08:51:58 Richards-MacBook-Pro osinstallersetupd[548]: seedProgramSource : Default
Jul 24 08:51:58 Richards-MacBook-Pro osinstallersetupd[548]: seedProgram : PublicSeed
Jul 24 08:51:58 Richards-MacBook-Pro osinstallersetupd[548]: catalogURLString : https://swscan.apple.com/content/catalogs/others/index-10.14beta-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog.gz1. It runs a detect on the device and the existing OS version. Makes a note then works out what the appropriate macOS software update catalog URL is, incidentally using a .gz compressed file I’ve never seen before now. I guess the .plist files are getting a little big with nearly ten OS versions in there.
Jul 24 08:51:58 Richards-MacBook-Pro osinstallersetupd[548]: OSISSoftwareUpdateController: Loaded catalog https://swscan.apple.com/content/catalogs/others/index-10.14beta-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog.gz (556 products)2. Err ok, it’s actually loading the catalog?
Jul 24 08:52:18 Richards-MacBook-Pro osinstallersetupd[548]: OSISDownloadOperation: No IAL update found.
Jul 24 08:52:18 Richards-MacBook-Pro osinstallersetupd[548]: OSISDownloadOperation: Using catalog for bridgeOS: https://swscan.apple.com/content/catalogs/others/index-10.14beta-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog.gz
Jul 24 08:52:18 Richards-MacBook-Pro osinstallersetupd[548]: OSISDownloadOperation: bridgeOS update is required (minimum bridge version: 16.16.334.5.5,0)
Jul 24 08:52:19 Richards-MacBook-Pro osinstallersetupd[548]: Using product at distance 253. It’s just compared what the latest bridgeOS update is with the version that’s on my device, and my device has been shown as wanting.
(for those unaware, the touchbar on current macOS laptops is running bridgeOS and on the newer T2 based devices, it’s probably doing a lot more than just making that work.)
Jul 24 08:52:19 Richards-MacBook-Pro osinstallersetupd[548]: Retrieving 8 packages (0.738 GB)4. Wait. It’s now downloading nearly 3/4 Gb of packages, so what exactly is in the 5.5Gb that’s in the Install macOS app bundle?
Jul 24 08:53:46 Richards-MacBook-Pro osinstallersetupd[548]: Retrieved package com.apple.plist.InstallInfo (linkfile:///Applications/Install%20macOS%20Mojave%20Beta.app/Contents/SharedSupport/InstallInfo.plist)
Jul 24 08:53:46 Richards-MacBook-Pro osinstallersetupd[548]: Started downloading package com.apple.pkg.BridgeOSBrain (http://swcdn.apple.com/content/downloads/37/45/091-95250/sr9mc3h2fhn4mwr0lrzh5ekk92gfr7b1yz/BridgeOSBrain.pkg)
Jul 24 08:53:46 Richards-MacBook-Pro osinstallersetupd[548]: PackageKit: Received response from peer 17.253.53.202
Jul 24 08:53:47 Richards-MacBook-Pro osinstallersetupd[548]: Retrieved package com.apple.pkg.BridgeOSBrain (http://swcdn.apple.com/content/downloads/37/45/091-95250/sr9mc3h2fhn4mwr0lrzh5ekk92gfr7b1yz/BridgeOSBrain.pkg)5. Holy )(*!! it’s downloading updates, running some checks who’s logs I’ve left out, and applying them.
Jul 24 08:55:00 Richards-MacBook-Pro osinstallersetupd[548]: Starting bridgeOS update prepare
Jul 24 08:56:18 Richards-MacBook-Pro osinstallersetupd[548]: bridgeOS prepare summary: 15P6613 -> 16P50334e, update = 16.16.334.5.5, brain = 16.16.334.5.5, variant = com.apple.bridgeOSCustomer, macOS = 17G2112 (customer), project = BridgeOSInstall-55.1, userAuth = 0, prod fused = 1, model = j680ap, client = InstallAssistant, retries = 0, session = 6F37CA43-6DF5-4E4D-9479-C9C0C0D272F9: success
Jul 24 08:56:18 Richards-MacBook-Pro osinstallersetupd[548]: bridgeOS update prepare complete6. And now does it get on with the rest of the OS upgrade.
—
It’s only after finding all this out, do I get the real bombshell. This is a suitably censored screen grab from the Mac Admin’s Slack:
I would like to say not all of us get to go to WWDC 😉 (and certainly not me while I need a non immigrant visa to ever visit the USA ever again).
So this all has wider implications: if you deploy the Apple install macOS app bundle to devices it will attempt to contact the internet for further updates. I like the idea of keeping a device and all it’s many firmwares patched but I’m also aware of how impossible this is going to be in very secure environments.
In fact, I feel a migraine coming on just thinking about it.
Do you have proxy services? Do you have next generation firewalls? In fact do you have anything that restricts traffic egress or otherwise interferes with internet traffic? These devices represent a world of pain heading your way, and this is only going to get worse. The T2 chip is going to slowly percolate over the Apple product line.
Now I’m going to go think of crazy networking solutions, or just start recommending to people “BeyondCorp or GTFO” because Apple’s devices really don’t play nice with many corp environments anymore.
And maybe that’s not such a bad thing?