threads / discuss / 59770

Which macOS versions does Git support?

Subject: Which macOS versions does Git support?

## tl;dr

6 messages between May 19, 2023 and May 22, 2023.

replies: 5people: 4as markdown or json

M Hickford· May 19, 2023, 07:00 UTC · lore

Hi. Does anyone know which macOS versions are supported by Git?

Motivation: I spotted that git-credential-osxkeychain.c uses a
deprecated API. SecKeychainAddInternetPassword was deprecated in
2014's macOS 10.10 [1].  Replacement SecItemAdd was introduced in
2009's macOS 10.6 [2].

Further motivation: If I understand the documentation correctly, the new SecItemAdd API has better support for storing attributes alongside secrets, which might be handy for storing Git credential's new password_expiry_utc attribute (d208bfd, credential: new attribute password_expiry_utc, 2023-02-18).

[0] https://github.com/git/git/blob/master/contrib/credential/osxkeychain/git-credential-osxkeychain.c [1] https://developer.apple.com/documentation/security/1393322-seckeychainaddinternetpassword?language=objc [2] https://developer.apple.com/documentation/security/1401659-secitemadd?language=objc

Jeff King· May 19, 2023, 09:09 UTC · re: M Hickford · lore

Re: Which macOS versions does Git support?

On Fri, May 19, 2023 at 08:00:00AM +0100, M Hickford wrote:

> Hi. Does anyone know which macOS versions are supported by Git?

I don't think we have any formal decision here (or for any other platform; it is usually a cost/benefit for individual features we may want to depend on).

> Motivation: I spotted that git-credential-osxkeychain.c uses a
> deprecated API. SecKeychainAddInternetPassword was deprecated in
> 2014's macOS 10.10 [1].  Replacement SecItemAdd was introduced in
> 2009's macOS 10.6 [2].

+cc Taylor, who I know was looking into this recently.

I'd guess that anything older than 2009 is probably not worth worrying about.

Show 5 quoted lines

> Further motivation: If I understand the documentation correctly, the
> new SecItemAdd API has better support for storing attributes alongside
> secrets, which might be handy for storing Git credential's new
> password_expiry_utc attribute (d208bfd, credential: new attribute
> password_expiry_utc, 2023-02-18).

Yeah, that would be a nice bonus (in addition to avoiding a deprecated interface).

-Peff

Jeff Hostetler· May 19, 2023, 17:49 UTC · re: Jeff King · lore

Re: Which macOS versions does Git support?

On 5/19/23 5:09 AM, Jeff King wrote:

Show 28 quoted lines

> On Fri, May 19, 2023 at 08:00:00AM +0100, M Hickford wrote:
> 
>> Hi. Does anyone know which macOS versions are supported by Git?
> 
> I don't think we have any formal decision here (or for any other
> platform; it is usually a cost/benefit for individual features we may
> want to depend on).
> 
>> Motivation: I spotted that git-credential-osxkeychain.c uses a
>> deprecated API. SecKeychainAddInternetPassword was deprecated in
>> 2014's macOS 10.10 [1].  Replacement SecItemAdd was introduced in
>> 2009's macOS 10.6 [2].
> 
> +cc Taylor, who I know was looking into this recently.
> 
> I'd guess that anything older than 2009 is probably not worth worrying
> about.
> 
>> Further motivation: If I understand the documentation correctly, the
>> new SecItemAdd API has better support for storing attributes alongside
>> secrets, which might be handy for storing Git credential's new
>> password_expiry_utc attribute (d208bfd, credential: new attribute
>> password_expiry_utc, 2023-02-18).
> 
> Yeah, that would be a nice bonus (in addition to avoiding a deprecated
> interface).
> 
> -Peff

I had similar issues last year with older versions of the compiler tools and/or an API that I was using in FSMonitor.

https://lore.kernel.org/git/xmqqsfhtphpl.fsf@gitster.g/T/ https://lore.kernel.org/git/pull.1375.git.1665085395.gitgitgadget@gmail.com/

IIRC my API usage needs 10.6 or newer.

Jeff

Carlo Marcelo Arenas Belón· May 20, 2023, 00:37 UTC · re: Jeff King · lore

Re: Which macOS versions does Git support?

On Fri, May 19, 2023 at 05:09:17AM -0400, Jeff King wrote:

> 
> I'd guess that anything older than 2009 is probably not worth worrying
> about.

FWIW Mac OS X 10.5 (Leopard) was last updated in 2009 and also happens to be the last one that can run in PowerPC, so sadly there is a non zero number of users for it (MacPorts uses a minimum of 10.4 for that reason)

Carlo

M Hickford· May 20, 2023, 07:36 UTC · re: Carlo Marcelo Arenas Belón · lore

Re: Which macOS versions does Git support?

On Sat, 20 May 2023 at 01:37, Carlo Marcelo Arenas Belón <carenas@gmail.com> wrote:

Show 5 quoted lines

>
> On Fri, May 19, 2023 at 05:09:17AM -0400, Jeff King wrote:
> >
> > I'd guess that anything older than 2009 is probably not worth worrying
> > about.

Thanks Jeff, Jeff and Carlo for your replies.

>
> FWIW Mac OS X 10.5 (Leopard) was last updated in 2009 and also happens to
> be the last one that can run in PowerPC, so sadly there is a non zero
> number of users for it (MacPorts uses a minimum of 10.4 for that reason)

Interesting! https://ports.macports.org/port/git/details/ It looks like the most recent build is from 2021 https://ports.macports.org/port/git/builds/?builder_name__name=10.5_ppc_legacy . https://ports.macports.org/port/git/stats/?days=365&days_ago=0 shows 10 total PowerPC downloads in the past year between versions 10.4, 10.5 and 10.6

>
> Carlo

I don't have the equipment or expertise to develop on macOS, so I'll leave the API migration as a potential future #leftoverbits

Reading the keychain docs more carefully, the new API only supports a fixed set of attribute keys such as 'kSecAttrComment', so discount my original "further motivation" https://developer.apple.com/documentation/security/keychain_services/keychain_items/item_attribute_keys_and_values?language=objc

Jeff King· May 22, 2023, 19:24 UTC · re: M Hickford · lore

Re: Which macOS versions does Git support?

On Sat, May 20, 2023 at 08:36:58AM +0100, M Hickford wrote:

Show 10 quoted lines

> > FWIW Mac OS X 10.5 (Leopard) was last updated in 2009 and also happens to
> > be the last one that can run in PowerPC, so sadly there is a non zero
> > number of users for it (MacPorts uses a minimum of 10.4 for that reason)
> 
> Interesting! https://ports.macports.org/port/git/details/ It looks
> like the most recent build is from 2021
> https://ports.macports.org/port/git/builds/?builder_name__name=10.5_ppc_legacy
> .   https://ports.macports.org/port/git/stats/?days=365&days_ago=0
> shows 10 total PowerPC downloads in the past year between versions
> 10.4, 10.5 and 10.6

One nice thing here is that the credential helpers are pretty independent from the rest of Git. If new versions of the helper drop support for the old API, people on ancient systems can still use the old helper. We'd just have to make a decision about how much to help them:

  1. (least help) Tell them to dig it out of git.git history, build, and
     stuff the resulting binary somewhere.

  2. (most help) Support both, selected by an #ifdef and a Makefile
     knob, and maybe even turn the knob automatically based on "uname
     -r".

  3. (middle ground) Rewrite with the new API, but leave the old helper
     as contrib/osxkeychain-old or something. Still easy-ish to build,
     but carries less maintenance burden.

> I don't have the equipment or expertise to develop on macOS, so I'll
> leave the API migration as a potential future #leftoverbits

I'd probably do (3), but as I also lack equipment or expertise, I'm not planning on working on it myself (and I'd let whoever does decide to do that work have the final say on approach).

> Reading the keychain docs more carefully, the new API only supports a
> fixed set of attribute keys such as 'kSecAttrComment', so discount my
> original "further motivation"

Bummer. Thanks for looking into this, though.

-Peff