Anyway, if you want to continue walking on water after you move to snow country, look for the stepping stones in /var/db/receipts.
Ouch. Now that i see it in print, i recall that MicroMatTech3 did pass that information along in a (mid-September?) thread, but -- since i've haven't entered the Snowy landscape yet -- i totally forgot the fact. Sincere apologizes all around.
I list here one of those stepping stones:
defaults read /var/db/receipts/com.apple.pkg.Essentials
<snip>
"System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" = <cffc33a1 b351a828 36c2b44a cd7a6f00 033893c3>;
</snip>
Wow, thanks. [plists eh?... it all looks yummy.]
Just so you'll know: that's apparently the only checksum for ARDAgent, even though I'm now on 10.6.2:
find /var/db/receipts -name '*.plist' | while read x; do defaults read "${x%%.plist}" | grep ARDAgent && echo $VT_BOLD$x$VT_NORMAL; done
"System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" = <cffc33a1 b351a828 36c2b44a cd7a6f00 033893c3>;
/var/db/receipts/com.apple.pkg.Essentials.plist
In /var/db/receipts, next to each packagename.plist is the corresponding packagename.bom, which is presumably where the raw permissions can be found. There are no other files in the folder; that is, nothing like a.receiptsdb.
Okay cool. Hmm, so -- if we were to try and dig deeper into the
"how/why does the DURP warning come about?" question -- the next step might be to at least have a look at what sort of checksums folks are sporting on that file now:
openssl sha1 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent
Or perhaps you have some idea already [
?]. My guess is (obvious i suppose) that some subsequent update (prolly 10.6.2) installed a tweaked version of ARDAgent, and (as with 10.5) it simply didn't put the latest digest value somewhere that DURP could "see" it. But why not?
It does seem that -- despite the relocated receipt info -- the exact same problem has followed along from 10.5 to 10.6 . . . so then it's probably something they have in common. [i think peeking into some of the postflight installer scripts might provide a clue perhaps. idunno, maybe.]
-+-
I imagine folks would also get a "valid on disk" reply to this as well:
codesign -vvv /System/Library/CoreServices/RemoteManagement/ARDAgent.app
I.e., everything is just fine... and everyone except DURP knows it.
