macOS removes and reinstalls Rosetta after every update

December 14 2022

I'd like to thank Mark Rowe (AKA bdash) for critical help in making this discovery.

After every macOS update, I see this dialog when I launch Xcode. I thought this happened to everyone — that is, everyone with Rosetta and Xcode installed — but I was wrong.

So why me? Do Apple engineers have a personal vendetta against me? Well, yes, but that's not the reason. I've discovered that macOS updates do remove Rosetta for everyone, but they also silently reinstall Rosetta. Or attempt to reinstall. The attempts always fail for me, because I have Little Snitch installed. My Little Snitch rules are pretty strict: a lot of my rules are designed to prevent macOS from "phoning home" to Cupertino. And that's what happens in this case.

For proof that macOS updates reinstall Rosetta (if you had Rosetta installed), open About This Mac, click System Report, select Installations under Software, and sort the installations reverse chronologically. If you have Rosetta installed, you should see RosettaUpdateAuto immediately after the macOS update. Mine is not immediately after the update, because Little Snitch blocked the reinstall, so I had to install manually.

In the /private/var/log/install.log log file, I was able to find references to Rosetta during the macOS update. For example:

system_installd[1116]: PackageKit: Will do receipt-based obsoleting for package identifier com.apple.pkg.RosettaUpdateAuto (prefix path=/)

system_installd[1116]: PackageKit: Executing script "postinstall" in /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/B5333BAD-00A1-4EDF-9038-1332B9597FA5.activeSandbox/Scripts/com.apple.pkg.RosettaUpdateAuto.8Ri2cm

root[5533]: Running Install Scripts . . .
root[5535]: Begin script: load_rosetta
system_installd[1116]: postinstall: 5538
root[5545]: End script: load_rosetta

The remaining mystery to me is if Rosetta needs to be updated after every macOS update, then why doesn't the macOS updater include the Rosetta installer? My theory is (1) Apple didn't anticipate their connection getting blocked, and (2) it's just easier to download the Rosetta installer, because the initial Rosetta install was already an optional download.

By the way, yesterday's macOS Monterey 12.6.2 update finally patched the 0-day vulnerability CVE-2022-40303 after more than a month.

Addendum

After publication of this article, I was made aware that the macOS Ventura 13.1 release notes from What's new for enterprise in macOS Ventura include this item:

• Resolves an issue in which Rosetta 2 was removed after a software update.

So this appears to be fixed now in Ventura! I'm still on Monterey, of course, because of System Settings.