← back to Nas Setup

Option B finalizer: one-paste sudo installer to swap both backup root-daemons onto the signed launcher + kickstart-verify (TK-10547)

a6b1b267dc0d7b4057aa383708542343706d8ee1 · 2026-08-14 08:46:12 -0700 · Steve Abrams

Files touched

• A scripts/install-optionB-launcher.sh

Diff

commit a6b1b267dc0d7b4057aa383708542343706d8ee1
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Aug 14 08:46:12 2026 -0700

    Option B finalizer: one-paste sudo installer to swap both backup root-daemons onto the signed launcher + kickstart-verify (TK-10547)
---
 scripts/install-optionB-launcher.sh | 67 +++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)

diff --git a/scripts/install-optionB-launcher.sh b/scripts/install-optionB-launcher.sh
new file mode 100755
index 0000000..86987db
--- /dev/null
+++ b/scripts/install-optionB-launcher.sh
@@ -0,0 +1,67 @@
+#!/bin/bash
+# install-optionB-launcher.sh — TK-10547 Option B finalizer, ONE-PASTE run as root:
+#     sudo bash /Users/macstudio3/Projects/nas-setup/scripts/install-optionB-launcher.sh
+#
+# Faithful mechanization of the approved memo's Step 1 + Step 2 (Option B):
+#   - installs BOTH backup root-daemon plists from the repo (already repointed at the
+#     stable ad-hoc-signed launcher /usr/local/bin/nas-backup-sh) into /Library/LaunchDaemons
+#   - bootout + bootstrap both daemons so the new ProgramArguments[0] takes effect
+#   - kickstart both to test the FDA-granted launcher immediately
+#   - tail pull.log so you see [Henry] PASS (or the WARN if the FDA click hasn't landed yet)
+#
+# PRECONDITION (do FIRST, in System Settings — TCC is GUI-only, cannot be scripted):
+#   Privacy & Security > Full Disk Access > "+" > /usr/local/bin/nas-backup-sh  (toggle ON)
+#   (Cmd-Shift-G in the file picker, paste the path.)
+#
+# This script does NOT touch /opt/homebrew/bin/bash, does NOT re-sign the launcher
+# (already adhoc-signed by cycle 8), and is idempotent — safe to re-run.
+set -uo pipefail
+
+USER_HOME=/Users/macstudio3
+NAS=$USER_HOME/Projects/nas-setup
+LAUNCHER=/usr/local/bin/nas-backup-sh
+
+say(){ printf '\n=== %s ===\n' "$1"; }
+if [ "$(id -u)" -ne 0 ]; then echo "must run as root: sudo bash $0"; exit 1; fi
+
+# ── 0. sanity: launcher present + signed ──
+say "0. launcher preflight"
+if [ ! -x "$LAUNCHER" ]; then echo "FATAL: $LAUNCHER missing/not executable — run memo Step 0 (cp+codesign) first."; exit 1; fi
+codesign -dv "$LAUNCHER" 2>&1 | grep -q 'adhoc' && echo "OK — $LAUNCHER is ad-hoc signed" \
+  || { echo "FATAL: $LAUNCHER is not ad-hoc signed — re-run: sudo codesign -s - -f $LAUNCHER"; exit 1; }
+
+# ── 1. install + reload both root daemons ──
+for LABEL in com.steve.nas-dwdump-mirror-root com.steve.nas-realestate-dump-mirror-root; do
+  SRC=$NAS/launchd/$LABEL.plist
+  DST=/Library/LaunchDaemons/$LABEL.plist
+  say "1. install + bootstrap $LABEL"
+  # confirm the repo plist really points at the launcher (Option B invariant)
+  if ! /usr/libexec/PlistBuddy -c 'Print :ProgramArguments:0' "$SRC" 2>/dev/null | grep -q "$LAUNCHER"; then
+    echo "FATAL: $SRC ProgramArguments[0] is not $LAUNCHER — repo plist not repointed. Aborting."; exit 1
+  fi
+  install -m 644 -o root -g wheel "$SRC" "$DST" && echo "installed $DST"
+  launchctl bootout system/$LABEL 2>/dev/null && echo "booted out old $LABEL" || echo "(was not loaded)"
+  launchctl bootstrap system "$DST" && echo "bootstrapped $LABEL" || echo "WARN: bootstrap returned non-zero"
+  # verify the LOADED job now invokes the launcher, not brew bash
+  LOADED=$(launchctl print system/$LABEL 2>/dev/null | grep -m1 -oE '/usr/local/bin/nas-backup-sh|/opt/homebrew/bin/bash')
+  echo "loaded ProgramArguments[0] = ${LOADED:-<unknown>}"
+done
+
+# ── 2. kickstart both (tests the FDA-granted launcher NOW) ──
+say "2. kickstart both daemons (immediate FDA test)"
+launchctl kickstart -k system/com.steve.nas-dwdump-mirror-root       && echo "kicked dwdump"
+launchctl kickstart -k system/com.steve.nas-realestate-dump-mirror-root && echo "kicked realestate"
+echo "waiting 20s for the pulls to finish..."; sleep 20
+
+# ── 3. verdict ──
+say "3. result (pull.log tail)"
+tail -20 "$NAS/data/pull.log"
+echo
+if tail -40 "$NAS/data/pull.log" | grep -q '\[Henry\] PASS'; then
+  echo ">>> OPTION B SUCCESS — [Henry] PASS present. Durability upgrade live."
+  echo ">>> Next (durability gate): reboot at your convenience, then re-run daemon-health.sh"
+  echo ">>>   to confirm the FDA grant persisted across reboot (memo Step 0 gate)."
+else
+  echo ">>> NO [Henry] PASS yet. Almost always = the Full Disk Access toggle for"
+  echo ">>>   $LAUNCHER is not ON. Add it in System Settings and re-run this script."
+fi

← 204c335 Option B prep: repoint both backup root-daemon plists at /us  ·  back to Nas Setup  ·  Option B finalizer: drop pipefail + make signature preflight 217e950 →