macOS

The browser tags its download with the com.apple.quarantine extended attribute; curl does not. Gatekeeper only evaluates quarantined files, so the tagged copy is checked for a valid signature and notarization on first launch while the untagged copy simply runs.

An APFS container owns all the blocks of its partition, and every volume inside it allocates from that one shared free pool. Volumes therefore have no fixed size, and each reports the container's remaining space as its own available space.

Homebrew uses a separate /opt/homebrew prefix on Apple Silicon so an arm64 installation can coexist with an Intel one under /usr/local and so bottles are built for a known default prefix. That directory is not on the default PATH, so brew shellenv must add it.

XNU combines a Mach core providing tasks, threads, port-based IPC and virtual memory with a BSD layer providing POSIX syscalls, processes, VFS and the network stack, plus IOKit for drivers. All of it runs in one kernel address space, so it is hybrid in structure but monolithic in performance.

RunAtLoad is a start trigger: launchd runs the job once, immediately, when the job is loaded. KeepAlive is a restart policy: launchd keeps the job running and starts it again whenever it exits. Both default to false.

System Integrity Protection (SIP) is a kernel policy that marks paths such as /System, /bin, /sbin and /usr (excluding /usr/local) as restricted. The kernel denies writes there regardless of uid, so root has no special power.

The preferences daemon cfprefsd owns those files, caches each domain in memory, and flushes its own copy back to disk — overwriting a hand edit. Use the defaults command (or the CFPreferences API), which goes through cfprefsd, then restart the app that reads the setting.

APFS snapshots still reference the deleted files' blocks, so removing a file only unlinks it from the live volume and frees nothing. The space returns when the snapshots holding those blocks are thinned or deleted.

APFS made a clone: a second file record pointing at the same on-disk extents rather than a byte-for-byte copy. Space is only consumed later, block by block, as one of the two copies is modified and diverges.

Homebrew formulae are command-line packages that Homebrew builds or downloads as a prebuilt bottle into its own prefix and symlinks onto PATH. Casks are pre-built macOS applications and installers that Homebrew downloads and places in /Applications.

Darwin is the open-source core of macOS: the XNU kernel plus a BSD-derived userland. Because XNU is not Linux, POSIX code ports easily, but Linux-only interfaces such as /proc, epoll, inotify, cgroups and namespaces simply do not exist there.

Use sw_vers for the macOS product version and build, uname -m for the CPU architecture (arm64 on Apple Silicon, x86_64 on Intel), and system_profiler SPHardwareDataType for model, chip and serial number. Rosetta translation can make uname -m report x86_64 on an Apple Silicon machine.

APFS replaced HFS+ journaling with copy-on-write metadata, added clones, snapshots and volumes that share a container's free space, gave timestamps nanosecond resolution instead of one second, made encryption native and per-volume, and dropped support for directory hard links.

macOS ships a BSD userland, not GNU coreutils, and BSD sed requires an explicit backup-suffix argument after -i. It reads 's/foo/bar/' as that suffix and then tries to parse the filename as the script, so the command fails.

Apple made zsh the default login shell in macOS Catalina and kept bash only as a legacy interpreter, frozen at 3.2 because that is the last release under GPLv2 and Apple does not ship GPLv3 software. Scripts with a /bin/bash shebang therefore run on a 2007 bash.

A kext is code loaded into the XNU kernel's own address space, historically an IOKit driver or a filesystem. Because a defect there panics or compromises the whole machine, Apple deprecated third-party kexts in favour of System Extensions and DriverKit, which run the same logic as userspace processes.

cron simply misses the run: a sleeping machine has no cron tick, and the moment passes. launchd remembers, and runs the job when the Mac wakes. If several intervals were missed, launchd coalesces them into a single run rather than firing once per missed slot.

An entitlement is a key/value claim embedded in a program's code signature that the kernel and system services consult at runtime. The App Sandbox uses entitlements to widen a default-deny confinement; the Hardened Runtime uses them to relax protections it otherwise switches on.

On macOS /etc/resolv.conf is generated from the SystemConfiguration store, not read as the source of truth; the system resolver goes through mDNSResponder using per-interface settings. Change DNS with networksetup -setdnsservers (or the network settings UI) and inspect the real configuration with scutil --dns.

FileVault binds the APFS volume's encryption key to user credentials, so the data cannot be unlocked without someone authenticating. The hardware already encrypts at rest; without FileVault the keys are released without a password. It protects nothing on a running, unlocked machine.

The tools in /usr/bin are thin shims that locate the real binaries through xcrun in the active developer directory. A macOS upgrade removes or invalidates that directory, so the shims fail until the Command Line Tools are reinstalled or xcode-select points at a valid path.

On macOS the stable interface is libSystem, not the trap numbers. Apple reserves the right to change or renumber system calls between releases, so a binary that traps into the kernel directly can break on a future macOS version. Every macOS binary links libSystem dynamically; there is no supported static libc.

bootstrap and bootout are the domain-aware commands: you name the domain explicitly, such as system or gui/501, and launchctl loads or removes the job there. load and unload are the legacy spelling that infers the domain from context, and they are kept only for compatibility.

launchd keeps restarting it, but rate-limits the respawns: a job is not started more often than once per ThrottleInterval, ten seconds by default. So a crash loop shows up as a process reappearing roughly every ten seconds, not as a spinning CPU.

Apple Silicon requires every arm64 executable to carry a valid code signature. The kernel refuses to execute unsigned or signature-broken arm64 code and kills the process with SIGKILL at exec, before any of its code runs. An ad-hoc signature satisfies the requirement.

TCC — Transparency, Consent and Control — is blocking it. TCC gates access to protected user data by the identity of the responsible application, not by uid, so running as root does not help. The fix is granting Full Disk Access to the app that launched the script.

A configuration profile is a signed property-list document of typed payloads that macOS installs as managed policy. Since macOS 11 profiles cannot be installed from the command line — only by user approval or by an MDM — and some settings, notably privacy approvals and extension allowlists, are only honoured from a supervised, MDM-managed Mac.

That is Spotlight's metadata indexer reacting to the thousands of files a build creates and deletes. Use mdutil to check status and disable indexing per volume (mdutil -i off), and keep individual directories out of the index by naming them with a .noindex suffix or adding them to the Spotlight privacy list.

The two volumes form an APFS volume group joined by firmlinks, which splice Data-volume directories such as /Users into the read-only System tree. The System volume is cryptographically sealed, and macOS boots from a read-only snapshot of it whose seal is verified.