MacOS command-line security updates: equivalent for apt-get update all

bashcommand linehigh sierrasoftware-updateterminal

I am accustomed to updating systems with sudo apt get update and would like to ensure MacOS security updates are installed from the command line. This `software update' command was issued on my machine:

$ softwareupdate -l
Software Update Tool
Finding available software
No new software available.

The article indicates that the unix equivalent is:

sudo softwareupdate -r

The list command returned that no updates are available: Can I expect that if there were security updates for the OS, they would be listed for download? I do not want to be misinterpret the response and think that the box is updated when it is not updated.

Best Answer

Yes, security updates show up as recommended updates but softwareupdate -r at least on Mojave is invalid. Note softwareupdate will not install updates for things from the App Store.

If you run softwareupdate -l on a system that is due security updates you can see them prefixed with a * character in the --list output which means they are recommended and will be processed by the -r option.

This is from a system untouched for a month - as you can see there is a recommended Safari update and a recommended Security update that requires a restart.

Last login: Mon Dec  2 19:21:08 on ttys000
A1398% softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
   * Security Update -10.14.6
    Security Update  (10.14.6), 1531842K [recommended] [restart]
   * Safari13.0.4MojaveAuto-13.0.4
    Safari (13.0.4), 67332K [recommended]
A1398%

You may either list all available updates with -l (which is closest to sudo apt-get update in that it doesn't download or install packages), download with -d or download and install them with -i. The -r switch on its own is not accepted.

  • To download and install recommended updates use softwareupdate -i -r. From man softwareupdate : 
 -i | --install
             Each update specified by args is downloaded and installed.  args can be one of the
             following:

            -r | --recommended
                         All updates that are recommended for your system. These are prefixed
                         with a * character in the --list output.

A1398% softwareupdate -i -r
Software Update Tool

Finding available software

Downloaded Security Update
Downloaded Safari
Installing Security Update , Safari
Done with Safari
Done.

You have installed one or more updates that requires that you restart your computer.
Please restart immediately.
To automate the restart process with softwareupdate(8), use --restart.
A1398%

In this case the security update required a restart and this was advised. The -R (capital) or --restart option can automate this but you would want to check user session status before forcing a restart and potentially losing session state/unsaved changes/etc. Passing --restart requires root privilege so the command in this case would be sudo softwareupdate -irR

  • Optionally you can download and not install recommended software using softwareupdate -d -r
 -d | --download
             Each update specified by args is downloaded but not installed. The values of args
             are the same as for the --install command.

A1398% softwareupdate -d -r
Software Update Tool

Finding available software

Downloaded Security Update
Downloaded Safari
Done.
A1398%

If you wanted all instead of recommended you would replace -r with -a. 

             -a | --all  All updates that are applicable to your system, including those non-
                         recommended ones, which are prefixed with a - character in the --list
                         output. (Non-recommended updates are uncommon in any case.)

Note that sudo on Mojave is required only for the --restart option but this rather old man page indicates that it was also required for installation in the past. 

-i
--install
   Each update specified by args is downloaded, unarchived, and
   installed.  This command requires root.
Related Question