# Which macOS versions does Git support? 6 messages from 2023-05-19 to 2023-05-22. Participants: M Hickford, Jeff King, Jeff Hostetler, Carlo Marcelo Arenas Belón. Thread: https://gitlist.dev/t/59770 ## M Hickford, 2023-05-19 07:00 Subject: Which macOS versions does Git support? Message-ID: URL: https://gitlist.dev/e/CAGJzqsnS3SnoW__aPQ%2B13s%2B-b3a%2BmakCjWxR%3Dz6mjgBBnuKjLg%40mail.gmail.com ``` Hi. Does anyone know which macOS versions are supported by Git? Motivation: I spotted that git-credential-osxkeychain.c uses a deprecated API. SecKeychainAddInternetPassword was deprecated in 2014's macOS 10.10 [1]. Replacement SecItemAdd was introduced in 2009's macOS 10.6 [2]. Further motivation: If I understand the documentation correctly, the new SecItemAdd API has better support for storing attributes alongside secrets, which might be handy for storing Git credential's new password_expiry_utc attribute (d208bfd, credential: new attribute password_expiry_utc, 2023-02-18). [0] https://github.com/git/git/blob/master/contrib/credential/osxkeychain/git-credential-osxkeychain.c [1] https://developer.apple.com/documentation/security/1393322-seckeychainaddinternetpassword?language=objc [2] https://developer.apple.com/documentation/security/1401659-secitemadd?language=objc ``` ## Jeff King, 2023-05-19 09:09 Subject: Re: Which macOS versions does Git support? Message-ID: <20230519090917.GB3515410@coredump.intra.peff.net> URL: https://gitlist.dev/e/20230519090917.GB3515410%40coredump.intra.peff.net In-Reply-To: ``` On Fri, May 19, 2023 at 08:00:00AM +0100, M Hickford wrote: > Hi. Does anyone know which macOS versions are supported by Git? I don't think we have any formal decision here (or for any other platform; it is usually a cost/benefit for individual features we may want to depend on). > Motivation: I spotted that git-credential-osxkeychain.c uses a > deprecated API. SecKeychainAddInternetPassword was deprecated in > 2014's macOS 10.10 [1]. Replacement SecItemAdd was introduced in > 2009's macOS 10.6 [2]. +cc Taylor, who I know was looking into this recently. I'd guess that anything older than 2009 is probably not worth worrying about. > Further motivation: If I understand the documentation correctly, the > new SecItemAdd API has better support for storing attributes alongside > secrets, which might be handy for storing Git credential's new > password_expiry_utc attribute (d208bfd, credential: new attribute > password_expiry_utc, 2023-02-18). Yeah, that would be a nice bonus (in addition to avoiding a deprecated interface). -Peff ``` ## Jeff Hostetler, 2023-05-19 17:49 Subject: Re: Which macOS versions does Git support? Message-ID: <7778a454-fefd-5b8a-212b-ab46681ccfd4@jeffhostetler.com> URL: https://gitlist.dev/e/7778a454-fefd-5b8a-212b-ab46681ccfd4%40jeffhostetler.com In-Reply-To: <20230519090917.GB3515410@coredump.intra.peff.net> ``` On 5/19/23 5:09 AM, Jeff King wrote: > On Fri, May 19, 2023 at 08:00:00AM +0100, M Hickford wrote: > >> Hi. Does anyone know which macOS versions are supported by Git? > > I don't think we have any formal decision here (or for any other > platform; it is usually a cost/benefit for individual features we may > want to depend on). > >> Motivation: I spotted that git-credential-osxkeychain.c uses a >> deprecated API. SecKeychainAddInternetPassword was deprecated in >> 2014's macOS 10.10 [1]. Replacement SecItemAdd was introduced in >> 2009's macOS 10.6 [2]. > > +cc Taylor, who I know was looking into this recently. > > I'd guess that anything older than 2009 is probably not worth worrying > about. > >> Further motivation: If I understand the documentation correctly, the >> new SecItemAdd API has better support for storing attributes alongside >> secrets, which might be handy for storing Git credential's new >> password_expiry_utc attribute (d208bfd, credential: new attribute >> password_expiry_utc, 2023-02-18). > > Yeah, that would be a nice bonus (in addition to avoiding a deprecated > interface). > > -Peff I had similar issues last year with older versions of the compiler tools and/or an API that I was using in FSMonitor. https://lore.kernel.org/git/xmqqsfhtphpl.fsf@gitster.g/T/ https://lore.kernel.org/git/pull.1375.git.1665085395.gitgitgadget@gmail.com/ IIRC my API usage needs 10.6 or newer. Jeff ``` ## Carlo Marcelo Arenas Belón, 2023-05-20 00:37 Subject: Re: Which macOS versions does Git support? Message-ID: URL: https://gitlist.dev/e/k3dnos4h7i4sjxzotiqwhz47wc2qvuzpii4wgysgt6ywoi6dx3%402ggmoesxlqsi In-Reply-To: <20230519090917.GB3515410@coredump.intra.peff.net> ``` On Fri, May 19, 2023 at 05:09:17AM -0400, Jeff King wrote: > > I'd guess that anything older than 2009 is probably not worth worrying > about. FWIW Mac OS X 10.5 (Leopard) was last updated in 2009 and also happens to be the last one that can run in PowerPC, so sadly there is a non zero number of users for it (MacPorts uses a minimum of 10.4 for that reason) Carlo ``` ## M Hickford, 2023-05-20 07:36 Subject: Re: Which macOS versions does Git support? Message-ID: URL: https://gitlist.dev/e/CAGJzqsmJSVJYTtT41wQ5Cgsz%3DExMZ8y7qKPDh-7kt8RXY__NbQ%40mail.gmail.com In-Reply-To: ``` On Sat, 20 May 2023 at 01:37, Carlo Marcelo Arenas Belón wrote: > > On Fri, May 19, 2023 at 05:09:17AM -0400, Jeff King wrote: > > > > I'd guess that anything older than 2009 is probably not worth worrying > > about. Thanks Jeff, Jeff and Carlo for your replies. > > FWIW Mac OS X 10.5 (Leopard) was last updated in 2009 and also happens to > be the last one that can run in PowerPC, so sadly there is a non zero > number of users for it (MacPorts uses a minimum of 10.4 for that reason) Interesting! https://ports.macports.org/port/git/details/ It looks like the most recent build is from 2021 https://ports.macports.org/port/git/builds/?builder_name__name=10.5_ppc_legacy . https://ports.macports.org/port/git/stats/?days=365&days_ago=0 shows 10 total PowerPC downloads in the past year between versions 10.4, 10.5 and 10.6 > > Carlo I don't have the equipment or expertise to develop on macOS, so I'll leave the API migration as a potential future #leftoverbits Reading the keychain docs more carefully, the new API only supports a fixed set of attribute keys such as 'kSecAttrComment', so discount my original "further motivation" https://developer.apple.com/documentation/security/keychain_services/keychain_items/item_attribute_keys_and_values?language=objc ``` ## Jeff King, 2023-05-22 19:24 Subject: Re: Which macOS versions does Git support? Message-ID: <20230522192437.GB365027@coredump.intra.peff.net> URL: https://gitlist.dev/e/20230522192437.GB365027%40coredump.intra.peff.net In-Reply-To: ``` On Sat, May 20, 2023 at 08:36:58AM +0100, M Hickford wrote: > > FWIW Mac OS X 10.5 (Leopard) was last updated in 2009 and also happens to > > be the last one that can run in PowerPC, so sadly there is a non zero > > number of users for it (MacPorts uses a minimum of 10.4 for that reason) > > Interesting! https://ports.macports.org/port/git/details/ It looks > like the most recent build is from 2021 > https://ports.macports.org/port/git/builds/?builder_name__name=10.5_ppc_legacy > . https://ports.macports.org/port/git/stats/?days=365&days_ago=0 > shows 10 total PowerPC downloads in the past year between versions > 10.4, 10.5 and 10.6 One nice thing here is that the credential helpers are pretty independent from the rest of Git. If new versions of the helper drop support for the old API, people on ancient systems can still use the old helper. We'd just have to make a decision about how much to help them: 1. (least help) Tell them to dig it out of git.git history, build, and stuff the resulting binary somewhere. 2. (most help) Support both, selected by an #ifdef and a Makefile knob, and maybe even turn the knob automatically based on "uname -r". 3. (middle ground) Rewrite with the new API, but leave the old helper as contrib/osxkeychain-old or something. Still easy-ish to build, but carries less maintenance burden. > I don't have the equipment or expertise to develop on macOS, so I'll > leave the API migration as a potential future #leftoverbits I'd probably do (3), but as I also lack equipment or expertise, I'm not planning on working on it myself (and I'd let whoever does decide to do that work have the final say on approach). > Reading the keychain docs more carefully, the new API only supports a > fixed set of attribute keys such as 'kSecAttrComment', so discount my > original "further motivation" Bummer. Thanks for looking into this, though. -Peff ```