Can Software Update be made to install custom updates?

[cellularmitosis]

Hey all,

I've been curious about the possibility of usurping the built-in Software Update client to install custom updates of my own making (i.e., Bash 4.x, etc).

Today I started poking at Software Update and found that on Tiger and Leopard, it actually uses plain HTTP to download the update indexes, and even adheres to the system HTTP proxy settings, so it was easy to snoop on which URLs it was hitting.

However, upon examining one of the update files (a tar file), it includes a "signature" file, which is 512 hex characters, indicating a 2048-bit signature.

Has anyone ever tried feeding an unsigned update to Software Update? My guess is that it would be rejected.

I'm also guessing that a 2048-bit signature indicates the signing mechanism is too modern to crack.

Perhaps the easiest route would be to modify the Software Update binary to defeat the signature verification check?

Has anyone poked at this before?

 

[Bigwaff]

I've been curious about the possibility of usurping the built-in Software Update client to install custom updates of my own making (i.e., Bash 4.x, etc).

Why usurp? An alternative…

Sparkle: open source software update framework for macOS

sparkle-project.org

 

[Doq]

Is there an old enough version that would be compatible with OS X versions this old?

 

[ChrisCharman]

Apparently setting a custom URL was only deprecated in Catalina so should be possible on any version of OS X for PowerPC.

Ref: Catalogue URL Deprecation

 

[doctor_dog]

Hey all,

I've been curious about the possibility of usurping the built-in Software Update client to install custom updates of my own making (i.e., Bash 4.x, etc).

I like what you're driving at here, at least what I think you're driving at: a new, centralized repo for all manner of software updates, kind of like how dosdude1 does for his patchers (except native)? I love this idea. You mentioned key length, any idea what the signature hashing algorithm is? I'm not sure what would have been en vogue in 2009 to be honest, but probably not something easily exploitable, to your point. If we can figure out what is used though, then we might have a shot at cracking it, especially if we can get plain text versions of some updates (I've never looked at the update tar files, so I apologize if these are daft questions).

 

[TheShortTimer]

This could be invaluable in years to come given that Apple have apparently failed to renew the https certificates that provide the software updates for all macOS versions older than Mojave. Yes, Tiger and Leopard updates will always be available from places like the Mac Garden but it would be nice to have an option to download everything for a new installation with an automated app.

 

[barracuda156]

Why usurp? An alternative…

Sparkle: open source software update framework for macOS

sparkle-project.org

On a side note, it takes quite some effort to get rid of this thing which many projects force onto a user with no configure option to turn it off.