I wanted to see if I could get a 10.9.2 installer for Mavericks from the Mac App Store that I could use to clean install a Mac without requiring a patch after installation, so I went to the MAS and downloaded, expecting Install OS X Mavericks.app to land in /Applications as usual.

After the download completed, I could not find the app in /Applications, though it was clearly running. lsof showed me an astonishing thing: it was running out of the archive folder in my home directory where I had moved the original 10.9 version of the Mavericks installer to prevent it from being deleted!

Further investigation revealed that what I thought was my old 10.9 installer actually had been updated at the time of the MAS download, and contained a new (valid) Apple code signature (verified with codesign -dvvv).

It's been months, but I think I just mv'd the original installer into my archive directory to prevent it from being deleted.

I've concluded that the MAS was able to find that original installer and decided to update it rather than putting a new copy into /Applications. My question is: how? And is there a way to protect it short of external media or (hopefully) Time Machine?

  • 2
    Answering as a comment because I don't know this to be fact. I believe the Mac App store uses the Spotlight index to check for MAS applications. If I have a Mac connected through target disk mode, and thus Spotlight indexing it while I work on it, I will often notice several new updates that could only be for apps installed on (or located on) the secondary Mac. With this in mind I'd imagine Spotlight indexed your archive directory, MAS checked Spotlight and found you just needed to update the app. I would exclude the directory from Spotlight via System Preferences and test. – Mr Rabbit Feb 26 '14 at 17:02
  • Interesting idea. I might test this theory sometime, but for right now, I've already downloaded 5 GB twice determining what I have thus far, not eager to do it again. 😉 – zigg Feb 26 '14 at 17:29
  • 1
    Potentially related: apple.stackexchange.com/questions/108229/… – zigg Feb 26 '14 at 20:08
  • I would call that invasion of privacy. It is still my computer. I had a copy of 10.9 installer (5 gig) saved and it was deleted after 10.9.2 update. How dare they do that. I am done with trusting Apple. Will save all my stuff on a removable drive from now on. – Ruskes Feb 26 '14 at 20:31

You must log in to answer this question.

Browse other questions tagged .