Allow agent self-update on macOS

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ### Added
 
-* **macOS support** on EC2 Mac, macOS 15 and later (Apple silicon, aarch64). The agent ships as a `.pkg` and runs as a launchd LaunchDaemon. Deployments use AppSpec `os: linux`. AppSpec `permissions` entries that set `acls` or `context` are rejected before the install runs; `owner`, `group` and `mode` apply. Agent self-update is not available on macOS yet.
+* **macOS support** on EC2 Mac, macOS 15 and later (Apple silicon, aarch64). The agent ships as a `.pkg` and runs as a launchd LaunchDaemon. Deployments use AppSpec `os: linux`. AppSpec `permissions` entries that set `acls` or `context` are rejected before the install runs; `owner`, `group` and `mode` apply. Agent self-update installs the `.pkg` on macOS.
 * **Optional parallel S3 bundle downloads.** Setting `s3_download_max_concurrency` above 1 (max 64) downloads a bundle in parallel HTTP range requests of `s3_download_chunk_size` bytes (default 8MiB, minimum 64KiB). Every range is pinned to the object's ETag, or to its version when one is set, so an object replaced mid-download fails the deployment. The default of 1 keeps the single-request download.
 
 ### Fixed

src/host_command/command_dispatcher.rs

@@ -389,9 +389,6 @@ mod tests {
         assert!(result.is_ok());
     }
 
-    // Split by platform: on macOS UpdateAgentCommand refuses before the S3 check
-    // (UNSUPPORTED_PLATFORM_MESSAGE), so the S3-error assertion only holds elsewhere.
-    #[cfg(not(target_os = "macos"))]
     #[test]
     fn update_deployment_agent_returns_error_without_s3() {
         let dir = tempfile::TempDir::new().unwrap();
@@ -408,24 +405,6 @@ mod tests {
         assert!(result.unwrap_err().to_string().contains("S3 client not configured"));
     }
 
-    // On macOS self-update is refused before the S3 check (see update_agent.rs).
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn update_deployment_agent_refuses_on_macos() {
-        let dir = tempfile::TempDir::new().unwrap();
-        let dispatcher = CommandDispatcher::new(
-            test_archives(&dir),
-            None,
-            HashMap::new(),
-            "us-east-1",
-            None,
-            Arc::new(AgentConfig::default()),
-        );
-        let result = dispatcher.execute_command("UpdateDeploymentAgent", &test_spec());
-        assert!(result.is_err());
-        assert!(result.unwrap_err().to_string().contains("not supported on macOS"));
-    }
-
     #[test]
     fn update_deployment_agent_never_noop() {
         let dir = tempfile::TempDir::new().unwrap();

src/host_command/commands/update_agent.rs

@@ -26,13 +26,6 @@ const SHELL: &str = "/bin/sh";
 /// Package-type arg: `auto` tells the script to detect the package manager.
 const PACKAGE_TYPE_ARG: &str = "auto";
 
-/// Why self-update is refused on macOS. The bucket install script has no
-/// `pkg` package type yet; until it does, running it on macOS would
-/// only fail inside the script after the download.
-#[cfg(target_os = "macos")]
-pub(crate) const UNSUPPORTED_PLATFORM_MESSAGE: &str = "Agent self-update is not supported on macOS yet. \
-     Install the latest .pkg from the regional aws-codedeploy-<region> bucket instead.";
-
 pub struct UpdateAgentCommand {
     region: String,
     s3_client: Option<S3Client>,
@@ -77,8 +70,6 @@ impl UpdateAgentCommand {
     pub fn execute(&self) -> io::Result<Vec<String>> {
         info!("UpdateDeploymentAgent command received");
 
-        Self::check_platform()?;
-
         let s3 = self
             .s3_client
             .as_ref()
@@ -99,25 +90,6 @@ impl UpdateAgentCommand {
     }
 }
 
-impl UpdateAgentCommand {
-    /// Refuse self-update on platforms the bucket install script cannot
-    /// install on. Called before any credential, IMDS or S3 use so the
-    /// refusal is immediate and needs no network access.
-    ///
-    /// # Errors
-    /// `ErrorKind::Unsupported` on macOS. `Ok` elsewhere.
-    pub fn check_platform() -> io::Result<()> {
-        #[cfg(target_os = "macos")]
-        {
-            Err(io::Error::new(io::ErrorKind::Unsupported, UNSUPPORTED_PLATFORM_MESSAGE))
-        }
-        #[cfg(not(target_os = "macos"))]
-        {
-            Ok(())
-        }
-    }
-}
-
 /// Construct the S3 bucket name for agent packages.
 fn s3_bucket_name(region: &str) -> String {
     format!("aws-codedeploy-{region}")
@@ -288,24 +260,6 @@ mod tests {
         assert!(debug.contains("us-east-1"));
     }
 
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn check_platform_refuses_macos_before_any_network_use() {
-        let err = UpdateAgentCommand::check_platform().unwrap_err();
-        assert_eq!(err.kind(), io::ErrorKind::Unsupported);
-        assert!(err.to_string().contains("not supported on macOS"));
-        // execute() must return the same refusal even with no S3 client.
-        let cmd = UpdateAgentCommand::new("us-east-1".into(), None);
-        assert_eq!(cmd.execute().unwrap_err().kind(), io::ErrorKind::Unsupported);
-    }
-
-    #[cfg(not(target_os = "macos"))]
-    #[test]
-    fn check_platform_allows_non_macos() {
-        assert!(UpdateAgentCommand::check_platform().is_ok());
-    }
-
-    #[cfg(not(target_os = "macos"))]
     #[test]
     fn execute_without_s3_client_errors() {
         let cmd = UpdateAgentCommand::new("us-east-1".into(), None);

src/main.rs

@@ -686,13 +686,6 @@ const VALID_FILE_EXISTS_BEHAVIORS: &[&str] = &["DISALLOW", "OVERWRITE", "RETAIN"
 fn run_update(config: &AgentConfig) {
     use codedeploy_agent::host_command::commands::UpdateAgentCommand;
 
-    // Refuse unsupported platforms (macOS) before touching
-    // credentials, IMDS or S3 — same shape as the Windows branch above.
-    if let Err(e) = UpdateAgentCommand::check_platform() {
-        eprintln!("{e}");
-        process::exit(1);
-    }
-
     // Resolve credentials + region exactly as the worker / S3 deploy path do:
     // on-premises config region first, then AWS_REGION env / IMDS.
     let mut credentials = match Credentials::load(&config.on_premises_config_file) {