HockeySDK 4.0 can disable backups of your Application Support folder

I discovered today that HockeySDK 4.0 for Mac and iOS excludes the entire Application Support folder from backups. If you’re a developer that uses the HockeyApp for Mac app, you probably want to paste this into Terminal:

xattr -d com.apple.metadata:com_apple_backup_excludeItem ~/Library/Application\ Support/

If you’ve shipped an app that uses HockeySDK 4.0 for Mac or iOS, you should probably figure out the best way to correct this problem for anyone using your app.

The developers have said they’re working on a fix.

How I figured this out

Buck Wilson asked how I found this problem and I thought it was worth sharing.

I was messing around with the new version of Hazel today, and I screwed up some of my rules, so I went looking for backups. Hazel stores data in ~/Library/Application Support/Hazel/. The entire Application Support folder was missing from my backups since around March 21st on both of my computers. Very strange.

OS X 10.11.4 was released March 21st, so I initially assumed that was the cause. It was backing up normally on my wife’s computer though. It was not in Time Machine’s list of exclusions in System Preferences, so I looked into what else can cause an item to be excluded from backups. I was pretty sure there was an extended attribute that could do this, and using ls -al@ in Terminal showed that yes, the com.apple.metadata:​com_apple_backup_excludeItem attribute was set. I used the command I mentioned above to remove it.

Then I started looking for things my two computers had in common. Presumably it was an app that was updated around that time. Adobe Creative Cloud came to mind based on their previous debacle. My wife still uses Creative Suite, so that made sense. But they seemed to be in the clear: the last update I’d installed was well before the problem started, over two months ago. I ruled out any Apple apps since they have their own exclusions file at /System/​Library/​CoreServices/​backupd.bundle/​Contents/​Resources/​StdExclusions.plist—they probably wouldn’t exclude files this way.

With a bit of searching I found this Mac OS X Hints article. As it mentions, the command sudo mdfind "com_apple_backup_excludeItem = 'com.apple.backupd'" will list files that have the attribute set. Interestingly, it also showed the Application Support folder for my app Deliveries. Since it’s sandboxed, it has its own folder.

While I was looking into that, Dave DeLong tweeted that it was “probably a misbehaving cross-platform app that’s blindly setting NSURLIsExcludedFromBackupKey on ‘its’ app support folder”. Good thinking. Just to make sure, I searched my own code to make sure I wasn’t using that anywhere. No results.

HockeySDK is one of the few third-party frameworks I use. I downloaded the HockeySDK source code and used BBEdit to search the whole thing for NSURLIsExcludedFromBackupKey. There it was, in the file BITPersistence.m part of the method createDirectoryStructureIfNeeded. It all made sense… well, almost. This explained why my own app’s sandboxed Application Support folder was excluded from backups, but not the main one. I was pretty sure I hadn’t run the app with sandboxing off. And wait a minute… I first downloaded HockeySDK 4.0 a few days ago. It could’ve been another app, but 4.0 was only released a week ago. This problem started over a month ago!

Then I noticed that HockeyApp’s Mac app was one of the few apps that was updated around March 21st. It was a few days before—it had a modified date of the 18th, and my Application Support folder being backed up then—but I may not have installed it right away. I right-clicked the app, chose “Show Package Contents” and dug around in HockeySDK.framework. Turns out they were using 4.0 in their own app a little early: the Info.plist file includes the version string 4.0.0-alpha.2.

Next was the final test: I quit HockeyApp, deleted the folder ~/Library/Application Support/com.microsoft.HockeyApp/ and then relaunched the app. I checked the Application Support folder again, and yes, the backup exclusion attribute had been set again. That was the last piece of the puzzle: the HockeyApp app isn’t sandboxed, so it caused the initial problem with my main Application Support folder. Then HockeySDK caused the problem in Deliveries—fortunately only in a beta version I haven’t shared with anyone yet.