hoakley Macs, Technology

Taking manual control of macOS updates with softwareupdate

If you’re one of the many who would rather not leave Software Update to download and install macOS and its security data updates automatically, you have only two options: the softwareupdate command tool, or third-party utilities such as my free SilentKnight. This article looks at how you might use the first of those in macOS Ventura.

softwareupdate documentation

Neither the man page for softwareupdate nor its current usage information are complete or accurate, and they have remained in that state since at least macOS Sierra in 2016, seven years ago. The man page claims to have been last updated in 2012, 11 years ago, and the examples given there still refer to standalone EFI firmware updates, although it refers to Rosetta and Apple silicon Macs, demonstrating that it has actually been updated more recently. Examples include:

  • --include-config-data option isn’t mentioned in either man or usage;
  • -l or --list options don’t list all appropriate update labels or available updates as claimed by man and usage, even when used with the -a option;
  • “softwareupdate requires admin authentication for all commands except –list” in the man page is incorrect;
  • “Updates are downloaded to /Library/Updates” in the man page is incorrect, as macOS updates haven’t been since Big Sur.

If you were to rely on the man page or usage info, then you’d never find any security data updates, such as those to XProtect and XProtect Remediator, and those would remain out of date.

Listing available updates

The commands
softwareupdate -l
and
softwareupdate -la
will list available macOS updates, as well as some others, but results omit security data updates such as those to MRT (e.g. MRTConfigData_10_15-1.93), XProtect (e.g. XProtectPlistConfigData_10_15-2169), and XProtect Remediator (e.g. XProtectPayloads_10_15-109).

swupdate8

To obtain a full list of available updates, the correct command is
softwareupdate -l --include-config-data

This should return a list with labels for each available update, such as
Finding available software
Software Update found the following new or updated software:
* Label: MRTConfigData_10_15-1.93
Title: MRTConfigData, Version: 1.93, Size: 4595KiB, Recommended: YES,
* Label: XProtectPlistConfigData_10_15-2169
Title: XProtectPlistConfigData, Version: 2169, Size: 975KiB, Recommended: YES,
* Label: XProtectPayloads_10_15-109
Title: XProtectPayloads, Version: 109, Size: 18241KiB, Recommended: YES,
* Label: macOS Ventura 13.5.1-22G90
Title: macOS Ventura 13.5.1, Version: 13.5.1, Size: 1520555KiB, Recommended: YES, Action: restart,

Note that the labels given for security data updates contain no spaces, whereas that for the macOS update contains two spaces.

Downloading updates

Although just downloading updates isn’t recommended, security data updates still come as Installer packages, and could be installed conventionally. This is best performed individually if required, using the command
softwareupdate -d --include-config-data [label]
where the label is that given in the list of available updates. Trying this for a macOS update is likely to result in a password prompt before the download starts, but security data updates don’t require authentication.

Downloaded security data updates are then saved to folders inside /Library/Updates, but macOS updates are carefully hidden, and can only be installed using Software Update or softwareupdate with its install option.

swupdate9

Installing updates

If no macOS update is available, install all available updates using the command
softwareupdate -ia --include-config-data

Installing individual security data updates that are available can be performed using the command
softwareupdate -i --include-config-data [label]
where the label is that given in the list of available updates.

Other useful options

The following command lists available macOS installers:
softwareupdate --list-full-installers

Currently, that list includes:

  • Ventura 13.5.1, 13.5, 13.4.1, 13.4, 13.3.1, 13.3
  • Monterey 12.6.8, 12.6.7, 12.6.6, 12.6.5, 12.6.4
  • Big Sur 11.7.9, 11.7.8, 11.7.7, 11.7.6, 11.7.5, 11.6.6, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.5.2
  • Catalina 10.15.7 Build 19H15, 10.15.7 Build 19H2, 10.15.6
  • Mojave 10.14.6
  • High Sierra 10.13.6

You can then use a command like
sudo softwareupdate --fetch-full-installer --full-installer-version 11.7.7
to download the installer of your choice.

On Apple silicon Macs only, use the command
sudo softwareupdate --install-rosetta --agree-to-license
to download and install Rosetta 2 and avoid its normal installation dialog.