Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

I Keep Getting This Message...

tommiy said:
yes i have a rosetta update sitting there as well same shasum as the download. Can't install it as it fails if doing that with you don't have permissions.
Click to expand...
Were you trying to install the RosettaUpdateAuto.pkg in /Library/Updates/Rosetta? I had no trouble installing the package downloaded from the link that @bogdanw provided above.
 
I can install the downloaded one with no issues. However i want to remove the package in /Library/Updates/Rosetta. If I boot into recovery mode and goto /Volumes/Macintosh HD/Library there is no Updates directory there and hence I can not delete the rogue Rosetta directory.

Even though ls -alO does not show protected i tried disabling SIP. This did not change any thing. So my question is how do I delete the /Library/Updates/Rosetta directory as it does not seem visable even in recovery mode. I also did a find / -name Updates in recovery and that found 3 locations that did list updates but none contained the Rosetta directory. Any clues appreciated as I am obviously missing some thing.

Answered my own question really. Needed to mount the data volume to remove it. All good.
 
Last edited:
tommiy said:
I can install the downloaded one with no issues. However i want to remove the package in /Library/Updates/Rosetta. If I boot into recovery mode and goto /Volumes/Machintosh HD/Library there is no Updates directory there and hence I can not delete the rogue Rosetta directory.
Click to expand...
The Updates folder in question lives in the apfs volume 'Macintosh HD - Data' and that's not mounted in the recovery environment until you decrypt and mount it using a diskutil command, after which you can 'rm -rf' the Updates/Rosetta directory. That's how I did things, but since a simple typo can corrupt your disk, I suggest using the much safer approach mentioned by @bogdanw above, i.e. turn off SIP and then use Finder to remove the directory.

To turn off SIP, boot to recovery, open a terminal from the Utilities menu, and in it type
Code: 
csrutil disable
Then use the Apple menu (upper left) to reboot. Log in and navigate to /Library/Updates in the Finder (use Go -> Go to Folder... in the Finder menu). Now drag the Rosetta folder to the trash and empty the trash. You'll probably want to turn SIP back on now, so boot again to recovery and open a terminal. In it type
Code: 
csrutil enable
Use the Apple menu to reboot.
 
  • Like
Reactions: HDFan and Fishrrman
well my updates directory now does not have any thing in there other than the plist but i just got the same popup that there are updates and when clicking on that get told no updates....so basically this does not fix the issue. Running softwareupdate says there is no updates. So guess this can be a Apple bug.
 
Screenshot 2024-08-20 at 7.33.04 AM.png

Looks like the OS is saving all those old Rosetta installers in a hidden folder.

Here is a screenshot from Find Any File app.
 
Weaselboy said:
Looks like the OS is saving all those old Rosetta installers in a hidden folder.
Click to expand...
I couldn't find anything while booted normally, but in recovery I find 4 instances:
Code: 
-bash-3.2# find /Volumes/Macintosh\ HD\ -\ Data/.com.apple.templatemigration.boot-install -name RosettaUpdateAuto.pkg -exec ls -l@ {} \;
-rw-------  1 _softwareupdate  _softwareupdate  384580 Aug  8 03:01 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/8AD33A0C-0EA6-4B87-B9E2-E9A6707660FE/RosettaUpdateAuto.pkg
-rw-------  1 _softwareupdate  _softwareupdate  384585 Jul 30 13:35 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/33257663-FFAD-453E-9C4B-C69FD17CCB41/RosettaUpdateAuto.pkg
-rw-------  1 root  wheel  383566 Jun  3 19:49 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/B92D7B55-947C-49B1-A84C-2003ABE8A5A7/RosettaUpdateAuto.pkg
-rw-------  1 _softwareupdate  _softwareupdate  383566 May 14 12:34 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/EC0800FA-BC5D-44C2-A042-D7B5C1F03512/RosettaUpdateAuto.pkg
Strange that one is owned by root, all the others by _softwareupdate.

I continue to be untroubled by the notifications after removing /Library/Updates/Rosetta, but if/when the problem returns I'll delete all of these (with fingers crossed).

Nice catch.
 
  • Like
Reactions: Weaselboy
Doh! I just didn't look hard enough, no need for recovery, they're here:
Code: 
$ ls -l /System/Volumes/Data/.com.apple.templatemigration.boot-install
total 0
drwxr-xr-x  3 root  wheel    96B Jul 30 07:46 33257663-FFAD-453E-9C4B-C69FD17CCB41
drwxr-xr-x  3 root  wheel    96B Aug  7 21:09 8AD33A0C-0EA6-4B87-B9E2-E9A6707660FE
drwxr-xr-x  3 root  wheel    96B Jun  3 13:54 B92D7B55-947C-49B1-A84C-2003ABE8A5A7
drwxr-xr-x  3 root  wheel    96B May 14 06:43 EC0800FA-BC5D-44C2-A042-D7B5C1F03512
I'll have to boot to recovery to clean them out, but I'm reluctant until I see another spurious update notification. Since another correspondent reported seeing a notification after removing /Library/Updates/Rosetta, I'm sure it's only a matter of time.
 
Just in case anybody wonders, it’s safe to delete all files and folders inside /Library/Updates. ProductMetadata.plist and index.plist will be recreated by macOS when searching for updates.
 
  • Like
Reactions: DianaofThemiscyra and Daverich4
bogdanw said:
Just in case anybody wonders, it’s safe to delete all files and folders inside /Library/Updates. ProductMetadata.plist and index.plist will be recreated by macOS when searching for updates.
Click to expand...
I received another notification this morning, so removing the Rosetta directory wasn't a cure. When I shut the laptop down last night, /Library/Updates contained only ProductMetadata.plist, but now there is also an index.plist. While the notification was on the screen, there was also a directory with a numeric name, but it disappeared at the same time as the notification and I wasn't able to look inside or make a copy. It's curious that ProductMetadata.plist is quarantined.
Code: 
$ ls -l@ /Library/Updates
total 184
-rw-r--r--@ 1 root  wheel    87K Aug 21 06:26 ProductMetadata.plist
    com.apple.quarantine      15B
-rw-r--r--  1 root  wheel   222B Aug 21 06:10 index.plist
 
Grumpus said:
While the notification was on the screen, there was also a directory with a numeric name, but it disappeared at the same time as the notification and I wasn't able to look inside or make a copy.
Click to expand...

Open the Updates folder, start a screen recording, trigger a search for updates from System Settings or Terminal and maybe you can identify the misbehaving update :)
If the folder name is 052-14079, it's the update mentioned in post 10.
There should be a record of the last update shown, but I can't remember now in which software update plist from /Library/Preferences or ~ /Library/Preferences
 
bogdanw said:
There should be a record of the last update shown, but I can't remember now in which software update plist from /Library/Preferences or ~ /Library/Preferences
Click to expand...
I don't see any clues in the Preferences plist files, but maybe you will:
Code: 
$ plutil -p /Library/Preferences/com.apple.SoftwareUpdate.plist                                                     
{
  "AutomaticallyInstallMacOSUpdates" => 0
  "AutomaticCheckEnabled" => 1
  "AutomaticDownload" => 0
  "ConfigDataInstall" => 1
  "CriticalUpdateInstall" => 1
  "LastAttemptBuildVersion" => "14.6.1 (23G93)"
  "LastAttemptSystemVersion" => "14.6.1 (23G93)"
  "LastBackgroundSuccessfulDate" => 2024-08-21 12:08:53 +0000
  "LastCatalogChangeDate" => 2023-08-10 17:35:16 +0000
  "LastFullSuccessfulDate" => 2024-08-21 13:12:43 +0000
  "LastRecommendedMajorOSBundleIdentifier" => ""
  "LastRecommendedUpdatesAvailable" => 0
  "LastResultCode" => 2
  "LastSessionSuccessful" => 1
  "LastSuccessfulDate" => 2024-08-21 13:12:46 +0000
  "LastUpdatesAvailable" => 0
  "PrimaryLanguages" => [
    0 => "en-US"
    1 => "en"
  ]
  "RecommendedUpdates" => [
  ]
}
$ plutil -p ~/Library/Preferences/com.apple.SoftwareUpdate.plist
{
  "MajorOSUserNotificationDate" => 2024-03-27 23:46:07 +0000
  "UserNotificationDate" => 2024-08-21 12:08:54 +0000
}
Xprotect Remediator was updated some time yesterday, so maybe that was it.
 
In ~/Library/Preferences/com.apple.preferences.softwareupdate.plist ProductKeysLastSeenByUser I have MSU_UPDATE_23G93_patch_14.6.1_minor. I didn't see any phantom notification so far in Sonoma 14.6.1 (23G93)

The folder for the current XProtect update is 062-54041, the link for the pkg https://swcdn.apple.com/content/dow...c7seo2e6tdwivhodil/XProtectPayloads_10_15.pkg The version is 142.

The are the updates installed on my MBA since 14.6
updates.jpg
 
bogdanw said:
In ~/Library/Preferences/com.apple.preferences.softwareupdate.plist ProductKeysLastSeenByUser I have MSU_UPDATE_23G93_patch_14.6.1_minor. I didn't see any phantom notification so far in Sonoma 14.6.1 (23G93)
Click to expand...
My softwareupdate.plist shows the same MSU_UPDATE_23G93_patch_14.6.1_minor, which corresponds to the last non-phantom software update notification on my MBP. The timestamp on the XProtectPayloads install corresponds closely with the appearance of a spurious notification this morning.
Screenshot 2024-08-21 at 9.49.48 AM.png
 
Grumpus said:
The timestamp on the XProtectPayloads install corresponds closely with the appearance of a spurious notification this morning.
Click to expand...
So, software update is sending notifications for updates that don’t require user interaction.

If someone has time, it would be interesting what apple support has to say https://support.apple.com
 
bogdanw said:
So, software update is sending notifications for updates that don’t require user interaction.

If someone has time, it would be interesting what apple support has to say https://support.apple.com
Click to expand...
I will contact support, but probably tomorrow. Meanwhile, it would be interesting to know if XProtectPayloads updates are what triggers the problem for other users, or if other "background" installs do too. You can get the date and time of the last software update notification:
Code: 
$ defaults read com.apple.SoftwareUpdate UserNotificationDate
2024-08-21 12:08:54 +0000
That time is in UTC, but you can convert to your local time zone with this scary-looking command:
Code: 
$ date -jf "%Y-%m-%d %H:%M:%S %z" "$(defaults read com.apple.SoftwareUpdate UserNotificationDate)" +"%Y-%m-%d %H:%M:%S %z"
2024-08-21 06:08:54 -0600
Compare that to the time of the last software installation:
Code: 
$ system_profiler SPInstallHistoryDataType | tail -6
    XProtectPayloads:

      Version: 142
      Source: Apple
      Install Date: 8/21/24, 6:10 AM
You can see that in my case XProtectPayloads was installed roughly 1 minute after the notification. A mere coincidence, maybe, but I doubt it.
 
Apple support told me to run "sfltool resetbtm." I did, although I'm pretty sure it has absolutely nothing to do with the problem. After a reboot, my Open at Login and Allow in Background settings are unchanged.
 
tommiy said:
another one today. So does not look like it is going away. I'm not sure that sfitool resetbtm will make a difference after reading https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/.
Click to expand...
Thanks for the link. As I mentioned, my login and background items were unaffected by running 'sfltool resetbtm.' The sfltool man page is very close to being content-free, and I'm at a loss when it comes to guessing what these background items might have to do with the spurious notifications. Ours is not to wonder why :)

Could you look at my previous post to see if you can correlate the time of your notification with something being installed? Aside from running system_profiler, you can also see what's been installed lately in System Information, under Software -> Installations. Click the Install Date heading to sort in reverse time order to see the last thing installed at the top of the list (it's XProtectPayloads for me). Thanks!
 
I just got another spurious notification, but without a corresponding install. So, there goes that theory.
 
It's not a stuck Rosetta update for me. (It's happening on an Intel iMac.) I'm on 14.6.1, I get the dubious update notification, but /Volumes/Macintosh HD/Library/Updates only contains index.plist and ProductMetadata.plist.

14.6.1 was installed on 10 August. XProtectPayloads 142 was installed 21 August. I honestly can't remember now if I was getting false alerts prior to that being installed. I'm still getting them daily and the last software update (Goodnotes) was on 23 August, so it's not tied to a non-OS update notification.
 
Last edited:
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back