Xcode xcodes

ID

xcodes

Home page

https://github.com/XcodesOrg/xcodes

Version requirement

>= 1

Platforms

🍎 macOS

Operations

installed · remove · sync

purl types

pkg:xcodes

CLI name

xcodes

Issues and PRs

📦 manager: xcodes

Source

meta_package_manager/managers/xcodes.toml

xcodes installs and manages Xcode versions on macOS (https://github.com/XcodesOrg/xcodes).

A package is one installed Xcode, identified by its marketing version exactly as the listing renders it: 16.2, but also 26.4 Release Candidate and 27.0 Beta 5. Those spaces are not a problem here, because mpm substitutes a package id as a single argv element and xcodes joins its version arguments back together either way. A build number cannot stand in as a space-free identifier: xcodes parses 17E192 as major 17 with a prerelease of e 192 and reports the version as not installed.

Note

The listing has two shapes, and mpm sees the machine-readable one. Written to a terminal, xcodes pads the version column to align it for a human; written anywhere else it separates the columns with a tab instead, a distinction its source has carried deliberately since 1.0.0 for the benefit of tools like this one. The tab is what the pattern below anchors on, which also rejects the legible errors xcodes prints to stdout rather than stderr.

Caution

No install, and it is not a matter of flags. Downloading an Xcode always authenticates against an Apple ID, on both data sources, and the prompts are real reads from standard input: XCODES_USERNAME and XCODES_PASSWORD exist but two-factor authentication has no environment path at all, being three further interactive reads, and a federated Apple ID opens a browser and waits for a pasted callback URL. A second prompt follows for the superuser password the post-install steps need. An unattended install is therefore not expressible, while everything below runs with no credentials whatsoever.

Warning

Never pass --data-source apple. The default source is a public feed served over plain HTTP, which is what keeps the catalog readable anonymously; that one flag routes the same reads through Apple’s authenticated endpoints and turns every one of them into a login prompt.

No outdated: knowing an Xcode is behind means joining the installed set against the catalog, which is two commands and a comparison rather than one argument list. No search either, the catalog listing accepting no query, and it is filtered to the host’s architecture by default, so its contents differ between machines. No upgrade of either kind exists, and no cleanup: the request to reclaim disk space has been open upstream since 2022.

sync maps to xcodes update, which despite its name refreshes the catalog rather than any installed Xcode. It prints the whole catalog while doing so, which is noise mpm does not read.

No escalation: the reads and the removal all run unprivileged, and only the install path xcodes cannot run unattended needs a superuser password.

What mpm adds to xcodes

mpm reaches across every manager at once, not xcodes alone: mpm installed and mpm outdated cover xcodes alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Operations

Operation

Supported

installed

✓

outdated

orphans

search

install

upgrade

upgrade_all

remove

✓

sync

✓

cleanup

doctor

Selecting and configuring xcodes

Deselect xcodes for a single run with --no-xcodes, or persist the choice in your configuration:

[mpm]
xcodes = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.xcodes]
timeout = 900

mpm config-template xcodes prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around xcodes, one mpm command each:

  • Snapshot and clone a machine: mpm --xcodes dump xcodes.toml, then mpm restore xcodes.toml on the next one.

  • Export a compliance SBOM: mpm --xcodes sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown

State of Xcode xcodes’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Apple developer downloads

  • Retraction: Vendor withdrawal only: releases are served from Apple’s developer downloads and catalogued by the community feed xcodes reads, so a version disappears when Apple stops serving it, with no yank or unlist surface exposed to anyone else

  • Publish date: ✅ the catalog feed records a release date per version, though mpm reads no release-age gate from it

Version probe

The version is probed by running:

$ xcodes version
2.0.3

and extracted with:

r"^(?P<version>\d+(?:\.\d+)+)$"

Reference traces

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Xcode xcodes well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ xcodes installed
15.4 (15F31d)	/Applications/Xcode-15.4.0.app
16.2 (16C5032a)	/Applications/Xcode-16.2.0.app
26.2 (17C52) [Apple Silicon]	/Applications/Xcode-26.2.0.app
26.4 Release Candidate (17E192)	/Applications/Xcode-26.4.0-Release.Candidate.app

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --xcodes installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

  • 7.7.0.dev0 (unreleased)

    • Add the xcodes Xcode version manager with installed, remove and sync support, shipped as a bundled definition. Listings read the tab-separated form xcodes emits when its output is not a terminal. It declares no install: downloading an Xcode always authenticates against an Apple ID, and two-factor authentication has no non-interactive path.