I wanted to see if I could get a 10.9.2 installer for Mavericks from the Mac App Store that I could use to clean install a Mac without requiring a patch after installation, so I went to the MAS and downloaded, expecting
Install OS X Mavericks.app to land in
/Applications as usual.
After the download completed, I could not find the app in
/Applications, though it was clearly running.
lsof showed me an astonishing thing: it was running out of the archive folder in my home directory where I had moved the original 10.9 version of the Mavericks installer to prevent it from being deleted!
Further investigation revealed that what I thought was my old 10.9 installer actually had been updated at the time of the MAS download, and contained a new (valid) Apple code signature (verified with
It's been months, but I think I just
mv'd the original installer into my archive directory to prevent it from being deleted.
I've concluded that the MAS was able to find that original installer and decided to update it rather than putting a new copy into
/Applications. My question is: how? And is there a way to protect it short of external media or (hopefully) Time Machine?