I Keep Getting This Message...

[Grumpus]

yes i have a rosetta update sitting there as well same shasum as the download. Can't install it as it fails if doing that with you don't have permissions.

Were you trying to install the RosettaUpdateAuto.pkg in /Library/Updates/Rosetta? I had no trouble installing the package downloaded from the link that @bogdanw provided above.

 

[tommiy]

I can install the downloaded one with no issues. However i want to remove the package in /Library/Updates/Rosetta. If I boot into recovery mode and goto /Volumes/Macintosh HD/Library there is no Updates directory there and hence I can not delete the rogue Rosetta directory.

Even though ls -alO does not show protected i tried disabling SIP. This did not change any thing. So my question is how do I delete the /Library/Updates/Rosetta directory as it does not seem visable even in recovery mode. I also did a find / -name Updates in recovery and that found 3 locations that did list updates but none contained the Rosetta directory. Any clues appreciated as I am obviously missing some thing.

Answered my own question really. Needed to mount the data volume to remove it. All good.

 

[Grumpus]

I can install the downloaded one with no issues. However i want to remove the package in /Library/Updates/Rosetta. If I boot into recovery mode and goto /Volumes/Machintosh HD/Library there is no Updates directory there and hence I can not delete the rogue Rosetta directory.

The Updates folder in question lives in the apfs volume 'Macintosh HD - Data' and that's not mounted in the recovery environment until you decrypt and mount it using a diskutil command, after which you can 'rm -rf' the Updates/Rosetta directory. That's how I did things, but since a simple typo can corrupt your disk, I suggest using the much safer approach mentioned by @bogdanw above, i.e. turn off SIP and then use Finder to remove the directory.

To turn off SIP, boot to recovery, open a terminal from the Utilities menu, and in it type

csrutil disable

Then use the Apple menu (upper left) to reboot. Log in and navigate to /Library/Updates in the Finder (use Go -> Go to Folder... in the Finder menu). Now drag the Rosetta folder to the trash and empty the trash. You'll probably want to turn SIP back on now, so boot again to recovery and open a terminal. In it type

csrutil enable

Use the Apple menu to reboot.

 

[tommiy]

well my updates directory now does not have any thing in there other than the plist but i just got the same popup that there are updates and when clicking on that get told no updates....so basically this does not fix the issue. Running softwareupdate says there is no updates. So guess this can be a Apple bug.

 

[Grumpus]

...so basically this does not fix the issue.

Too bad, but thanks for letting us know.

 

[Weaselboy]

Looks like the OS is saving all those old Rosetta installers in a hidden folder.

Here is a screenshot from Find Any File app.

 

[Grumpus]

Looks like the OS is saving all those old Rosetta installers in a hidden folder.

I couldn't find anything while booted normally, but in recovery I find 4 instances:

-bash-3.2# find /Volumes/Macintosh\ HD\ -\ Data/.com.apple.templatemigration.boot-install -name RosettaUpdateAuto.pkg -exec ls -l@ {} \;
-rw-------  1 _softwareupdate  _softwareupdate  384580 Aug  8 03:01 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/8AD33A0C-0EA6-4B87-B9E2-E9A6707660FE/RosettaUpdateAuto.pkg
-rw-------  1 _softwareupdate  _softwareupdate  384585 Jul 30 13:35 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/33257663-FFAD-453E-9C4B-C69FD17CCB41/RosettaUpdateAuto.pkg
-rw-------  1 root  wheel  383566 Jun  3 19:49 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/B92D7B55-947C-49B1-A84C-2003ABE8A5A7/RosettaUpdateAuto.pkg
-rw-------  1 _softwareupdate  _softwareupdate  383566 May 14 12:34 /Volumes/Macintosh HD - Data/.com.apple.templatemigration.boot-install/EC0800FA-BC5D-44C2-A042-D7B5C1F03512/RosettaUpdateAuto.pkg

Strange that one is owned by root, all the others by _softwareupdate.

I continue to be untroubled by the notifications after removing /Library/Updates/Rosetta, but if/when the problem returns I'll delete all of these (with fingers crossed).

Nice catch.

 

[Grumpus]

Doh! I just didn't look hard enough, no need for recovery, they're here:

$ ls -l /System/Volumes/Data/.com.apple.templatemigration.boot-install
total 0
drwxr-xr-x  3 root  wheel    96B Jul 30 07:46 33257663-FFAD-453E-9C4B-C69FD17CCB41
drwxr-xr-x  3 root  wheel    96B Aug  7 21:09 8AD33A0C-0EA6-4B87-B9E2-E9A6707660FE
drwxr-xr-x  3 root  wheel    96B Jun  3 13:54 B92D7B55-947C-49B1-A84C-2003ABE8A5A7
drwxr-xr-x  3 root  wheel    96B May 14 06:43 EC0800FA-BC5D-44C2-A042-D7B5C1F03512

I'll have to boot to recovery to clean them out, but I'm reluctant until I see another spurious update notification. Since another correspondent reported seeing a notification after removing /Library/Updates/Rosetta, I'm sure it's only a matter of time.

 

[bogdanw]

Just in case anybody wonders, it’s safe to delete all files and folders inside /Library/Updates. ProductMetadata.plist and index.plist will be recreated by macOS when searching for updates.

 

[arkitect]

Just happened again…
🤷🏻‍♂️

 

[Grumpus]

Just in case anybody wonders, it’s safe to delete all files and folders inside /Library/Updates. ProductMetadata.plist and index.plist will be recreated by macOS when searching for updates.

I received another notification this morning, so removing the Rosetta directory wasn't a cure. When I shut the laptop down last night, /Library/Updates contained only ProductMetadata.plist, but now there is also an index.plist. While the notification was on the screen, there was also a directory with a numeric name, but it disappeared at the same time as the notification and I wasn't able to look inside or make a copy. It's curious that ProductMetadata.plist is quarantined.

$ ls -l@ /Library/Updates
total 184
-rw-r--r--@ 1 root  wheel    87K Aug 21 06:26 ProductMetadata.plist
    com.apple.quarantine      15B
-rw-r--r--  1 root  wheel   222B Aug 21 06:10 index.plist

 

[bogdanw]

While the notification was on the screen, there was also a directory with a numeric name, but it disappeared at the same time as the notification and I wasn't able to look inside or make a copy.

Open the Updates folder, start a screen recording, trigger a search for updates from System Settings or Terminal and maybe you can identify the misbehaving update
If the folder name is 052-14079, it's the update mentioned in post 10.
There should be a record of the last update shown, but I can't remember now in which software update plist from /Library/Preferences or ~ /Library/Preferences

 

[Grumpus]

There should be a record of the last update shown, but I can't remember now in which software update plist from /Library/Preferences or ~ /Library/Preferences

I don't see any clues in the Preferences plist files, but maybe you will:

$ plutil -p /Library/Preferences/com.apple.SoftwareUpdate.plist                                                     
{
  "AutomaticallyInstallMacOSUpdates" => 0
  "AutomaticCheckEnabled" => 1
  "AutomaticDownload" => 0
  "ConfigDataInstall" => 1
  "CriticalUpdateInstall" => 1
  "LastAttemptBuildVersion" => "14.6.1 (23G93)"
  "LastAttemptSystemVersion" => "14.6.1 (23G93)"
  "LastBackgroundSuccessfulDate" => 2024-08-21 12:08:53 +0000
  "LastCatalogChangeDate" => 2023-08-10 17:35:16 +0000
  "LastFullSuccessfulDate" => 2024-08-21 13:12:43 +0000
  "LastRecommendedMajorOSBundleIdentifier" => ""
  "LastRecommendedUpdatesAvailable" => 0
  "LastResultCode" => 2
  "LastSessionSuccessful" => 1
  "LastSuccessfulDate" => 2024-08-21 13:12:46 +0000
  "LastUpdatesAvailable" => 0
  "PrimaryLanguages" => [
    0 => "en-US"
    1 => "en"
  ]
  "RecommendedUpdates" => [
  ]
}
$ plutil -p ~/Library/Preferences/com.apple.SoftwareUpdate.plist
{
  "MajorOSUserNotificationDate" => 2024-03-27 23:46:07 +0000
  "UserNotificationDate" => 2024-08-21 12:08:54 +0000
}

Xprotect Remediator was updated some time yesterday, so maybe that was it.

 

[bogdanw]

In ~/Library/Preferences/com.apple.preferences.softwareupdate.plist ProductKeysLastSeenByUser I have MSU_UPDATE_23G93_patch_14.6.1_minor. I didn't see any phantom notification so far in Sonoma 14.6.1 (23G93)

The folder for the current XProtect update is 062-54041, the link for the pkg https://swcdn.apple.com/content/dow...c7seo2e6tdwivhodil/XProtectPayloads_10_15.pkg The version is 142.

The are the updates installed on my MBA since 14.6

 

[Grumpus]

In ~/Library/Preferences/com.apple.preferences.softwareupdate.plist ProductKeysLastSeenByUser I have MSU_UPDATE_23G93_patch_14.6.1_minor. I didn't see any phantom notification so far in Sonoma 14.6.1 (23G93)

My softwareupdate.plist shows the same MSU_UPDATE_23G93_patch_14.6.1_minor, which corresponds to the last non-phantom software update notification on my MBP. The timestamp on the XProtectPayloads install corresponds closely with the appearance of a spurious notification this morning.

 

[Guacamole]

I'm having the same issues since the last update

 

[bogdanw]

The timestamp on the XProtectPayloads install corresponds closely with the appearance of a spurious notification this morning.

So, software update is sending notifications for updates that don’t require user interaction.

If someone has time, it would be interesting what apple support has to say https://support.apple.com

 

[Grumpus]

So, software update is sending notifications for updates that don’t require user interaction.

If someone has time, it would be interesting what apple support has to say https://support.apple.com

I will contact support, but probably tomorrow. Meanwhile, it would be interesting to know if XProtectPayloads updates are what triggers the problem for other users, or if other "background" installs do too. You can get the date and time of the last software update notification:

$ defaults read com.apple.SoftwareUpdate UserNotificationDate
2024-08-21 12:08:54 +0000

That time is in UTC, but you can convert to your local time zone with this scary-looking command:

$ date -jf "%Y-%m-%d %H:%M:%S %z" "$(defaults read com.apple.SoftwareUpdate UserNotificationDate)" +"%Y-%m-%d %H:%M:%S %z"
2024-08-21 06:08:54 -0600

Compare that to the time of the last software installation:

$ system_profiler SPInstallHistoryDataType | tail -6
    XProtectPayloads:

      Version: 142
      Source: Apple
      Install Date: 8/21/24, 6:10 AM

You can see that in my case XProtectPayloads was installed roughly 1 minute after the notification. A mere coincidence, maybe, but I doubt it.

 

[Grumpus]

Apple support told me to run "sfltool resetbtm." I did, although I'm pretty sure it has absolutely nothing to do with the problem. After a reboot, my Open at Login and Allow in Background settings are unchanged.

 

[tommiy]

another one today. So does not look like it is going away. I'm not sure that sfitool resetbtm will make a difference after reading https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/.

 

[Grumpus]

another one today. So does not look like it is going away. I'm not sure that sfitool resetbtm will make a difference after reading https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/.

Thanks for the link. As I mentioned, my login and background items were unaffected by running 'sfltool resetbtm.' The sfltool man page is very close to being content-free, and I'm at a loss when it comes to guessing what these background items might have to do with the spurious notifications. Ours is not to wonder why

Could you look at my previous post to see if you can correlate the time of your notification with something being installed? Aside from running system_profiler, you can also see what's been installed lately in System Information, under Software -> Installations. Click the Install Date heading to sort in reverse time order to see the last thing installed at the top of the list (it's XProtectPayloads for me). Thanks!

 

[bogdanw]

Apple's documentation:
Manage login items and background tasks on Mac https://support.apple.com/guide/deployment/depdca572563/web
"sfltool resetbtm: Resets login and background item data. If you use this command between tests, it’s recommended that users also restart their computer."

 

[Grumpus]

I just got another spurious notification, but without a corresponding install. So, there goes that theory.

 

[Jules L]

It's not a stuck Rosetta update for me. (It's happening on an Intel iMac.) I'm on 14.6.1, I get the dubious update notification, but /Volumes/Macintosh HD/Library/Updates only contains index.plist and ProductMetadata.plist.

14.6.1 was installed on 10 August. XProtectPayloads 142 was installed 21 August. I honestly can't remember now if I was getting false alerts prior to that being installed. I'm still getting them daily and the last software update (Goodnotes) was on 23 August, so it's not tied to a non-OS update notification.

 

[Washac]

We should not have to meddle with any of the above to fix this message from popping up, Apple should fix this issue.