quicksilver/Quicksilver — pull request #1159 by pjrobertson (2012-10-07 20:11:21+00:00)
Title: Allow non-admin accounts to update QS in protected directories. Fixes #521

Finally :)
Only took me all weekend…!

Background info on Auth:

Apple is deprecating everything under the sun that allows apps to run in a 'privileged' environment. The currently recommended way is to use a helper app and communicate with this app using XPC or similar (NSMachPorts). See the SMJobBless example project for a little more info.

I chose to use Sparkle to deal with our authentication problems as I thought I'd be an easy solution, unfortunately, they are also using the deprecated methods (as of 10.7) for authentication. Looks like they haven't gone down the route of privileged helper apps (which require independent code signing… ugh!) yet.
I've decided to stick with it. The methods are deprecated, but hopefully if we still close to Sparkle this method won't die too soon

Background on Sparkle:

Since Sparkle is such a large framework, and we only really need one method, I have removed the submodule and added only the required (and butchered) files.
The files have been modified as little as possible, just enough so we don't have to #import the whole project. Hopefully they're still mostly intact that we can easily alter them as Sparkle alter their files.

So background aside, this pull means non admin users can download an update of QS to a protected directory, and be prompted with a dialogue asking for an admin password.
You may notice that in QSUpdateController the following steps are taken

* Mount the .dmg in a temp folder
* Copy the Quicksilver.app file in the .dmg to a temp folder in `Application support/Quicksilver`
* Chown the Quicksilver.app file from step 2 to give it the right permissions
* Copy the file from step 2 over the current install

The reason for step 2 is that the .dmg temp folder is read-only, so chown and move methods don't work on it (What Sparkle uses)

-----------

To test this:

* Change the build number in Developer.xcconfig to say 3900
* build and install in /Applications
* Log in as a non admin user and run Quicksilver
* Update from in the app

Sorry for the epic pull message, just… there's a lot to say, and a lot of reasoning behind the few changes!