IBM/mac-ibm-migration-tool v-2.0.0-b-296-b1

Version 2.0.0 Beta 1 (296)

on GitHub

Device Pairing & Security

Enhancements

• Migrated the device pairing/transfer channel from TLS 1.2 to TLS 1.3. Since TLS 1.3 removed Network.framework's external-PSK mode, the destination Mac now serves an ephemeral, in-memory-only self-signed certificate (never written to the keychain) purely to get an encrypted, forward-secret transport.
• Peer verification now happens at the application layer via a CPace-style password-authenticated key exchange (PAKE), derived from the 6-digit pairing code and bound to the TLS channel's exporter secret. This prevents a relay/man-in-the-middle attack even from an attacker holding valid TLS certificates on both legs of the connection.
• The destination Mac must now explicitly accept or decline each incoming pairing request before its verification code can be used, rather than displaying the code to any device that discovers it on the network.
• Repeated incorrect verification code attempts now lock pairing on the destination device until a new code is generated, mitigating brute-force guessing of the 6-digit code.

Migration Security

Enhancements

• The destination Mac now validates every path and symbolic link received from the source: unknown sources, absolute or ..-containing paths, and anything resolving (through existing or dangling symlinks) outside the user's home folder and /Applications are refused.
• Received file attributes are reduced to permission bits (without setuid/setgid/sticky) and dates; ownership and flags from the peer are ignored.
• Jamf Self Service is now launched with /usr/bin/open via an argument vector instead of an AppleScript shell command, so no value is ever parsed by a shell.
• The storePath setting (and Jamf's self_service_app_path) is now only honored if it is an absolute path to an existing .app bundle without control characters; managed Jamf values must be forced by a configuration profile.

Bug Fixes

• Fixed files with read-only permissions, and directories whose owner access came only from an ACL (e.g. ~/Public), failing to be written on the destination.
• Fixed app support files located in otherwise-excluded folders (e.g. ~/Library) being skipped even though discovery had selected them; files that cannot be scanned are now listed in the migration report.
• Fixed the file count of the selection not being updated when files, apps or preferences are selected or deselected.

Migration

Enhancements

• Pause & Resume: The source Mac can now pause a running migration, finishing the in-flight data first so the devices can be disconnected (e.g. to move or sleep them). The destination keeps its state and automatically accepts the source's reconnection when the migration is resumed, continuing from the same point. A resume that cannot reach the destination within 60 seconds returns to the paused screen so it can be retried (Close #13 ).
• Items that exist only as placeholders (dataless files and folders, e.g. iCloud Drive items removed by "Optimize Mac Storage") are no longer read during a migration, so they are not downloaded from the cloud on the source Mac; they are skipped and logged.
• Cache and temporary folders that apps regenerate on their own (Library/Caches in the user library, Containers and Group Containers, and a container's Data/tmp) are no longer migrated, reducing transfer size and time. This also applies to app support files.

Bug Fixes

• Fixed the exclusion rules (excluded file extensions and name prefixes, such as a nested node_modules, .DS_Store or VM disk images) only being applied to the first levels of a selected folder: they are now applied at every depth, and sizes and file counts match what is actually transferred. As a result, matching items deeper inside a selected folder are no longer migrated. Application bundles (.app) are always copied whole, so an app's own node_modules or cache folders are never removed.
• Fixed the app freezing on the source Mac during the migration of an application's support files when they contain named pipes (e.g. the *.cv and *.note pipes of Realm databases): opening a named pipe for reading blocks forever. Named pipes, sockets and device files are now skipped and logged.
• Fixed scanning an app's support files running on the main thread, which made the interface unresponsive while large folders were being listed.
• Fixed large read-only files (e.g. Git *.pack files) failing to be written on the destination Mac when they are transferred in several parts.
• Fixed the size calculation of applications occupying the threads shared by all background tasks, which could make it extremely slow or appear to never finish on Macs with many large applications; each application is now measured in a single pass on its own thread.

User Interface

Enhancements

• Adopted the Liquid Glass effect conditionally on supported macOS versions, falling back to the previous appearance elsewhere.

Preferences Migration

Enhancements

• Granular Preferences Selection: Data Shift now discovers macOS system preferences on the source Mac - grouped into categories such as Dock, Finder, Keyboard, Trackpad/Mouse, Appearance, Accessibility, Language & Region, Menu Bar/Control Center, Sound Effects, Screenshots, Screen Saver, Terminal, Mission Control, Stage Manager, Keyboard Shortcuts, and Hot Corners - and lets users review and individually select which groups to migrate.
• Each preference group shows a human-readable description of exactly which settings it carries, plus the number of discovered keys and estimated payload size.
• Preference values are read and written through CFPreferences instead of copying .plist files directly, so migrated values reflect cfprefsd's live cache, and existing values on the destination are backed up before being overwritten.
• Preferences migration can be toggled independently via the new migratePreferences managed setting.
  (Close #9 )

Migration Setup

Enhancements

• Customizable Migration Presets: Administrators can now replace the built-in Lite/Complete options with their own named presets - combining categories (Desktop, Documents, full user folder, Applications, Preferences) and additional custom paths - via the new migrationPresets managed setting (Close #36 ).
• Automatic app support file discovery and migration can now be toggled independently via the new migrateAppSupportFiles managed setting.
• The Recap screen now shows the same expandable, per-app support file breakdown (categories and counts) already available in the Advanced Selection view.
• Administrators can now completely exclude the Applications folder from migration — regardless of what a preset or the Advanced option includes — via the new excludeApplicationsFolder managed setting (default: false). The exclusion covers all Applications folder locations (/Applications, ~/Applications, /System/Applications) and is enforced both during migration option setup (no apps are loaded) and at the file-scanner level (the folders are added to the URL exclusion list), so they cannot enter through a full user-folder preset either (Close #38 ).

Application Migration

Enhancements

• Automatic App Support File Discovery: Data Shift now automatically discovers and migrates all application-related support files including (Close #42 ):
  • Application Support folders
  • Sandboxed Containers
  • Group Containers
  • Preference files (.plist)
• Enhanced UI: Advanced Selection view now displays discovered support files per app with expandable disclosure groups showing file categories and counts
• Performance Optimization: Implemented FileSizeCache for efficient size calculations, reducing redundant operations by 58%

Performance & Reliability

Enhancements

• File discovery now caches directory listings shared across apps (Application Support, Containers, Group Containers, Preferences), avoiding redundant disk scans when discovering support files for many apps in the same session.
• Group Container matching now also inspects shared, vendor-wide containers (e.g. a single Office container shared by every Microsoft app) one level deeper for an app-specific subfolder, instead of migrating the entire shared container when a more precise match exists.
• Added a connection-health watchdog that detects when the network connection stops making progress (no throughput for 2 minutes, or a message that exhausts all of its send retries) and automatically attempts to repair the connection, instead of letting the migration silently stall or repeatedly retry subsequent items against a dead connection.
• Writing received files and file chunks to disk during migration now happens off the network connection's queue, so a slow or unresponsive destination volume can no longer delay delivery of connection state and keepalive events.
• Replaced the internal semaphore used to limit concurrent network send operations with a non-blocking implementation, removing a potential thread-starvation deadlock under concurrent load.
• Adopted Swift 6 language mode with complete concurrency checking across the app, compiler-enforced to eliminate data races.

Bug Fixes

• Fixed an issue where a circular symbolic link encountered during migration could permanently stop the destination device from processing any further incoming data, silently stalling the migration with no error shown.
• Fixed a tight retry loop that could flood the log with repeated network receive errors (and contend with an in-progress reconnection attempt) during the brief window after a connection drops but before Network.framework reports it as failed.

Accessibility

Enhancements

• Improved Dynamic Type support, VoiceOver hints, and high-contrast appearance across the app's views.

Logging

Enhancements

• Standardized and categorized internal logging (e.g. Migration, Network, Pairing, Discovery, Report, Device) for clearer filtering in Console.app, and reduced excessive log verbosity.

General Updates

Bug Fixes

• Fixed a typo in the setup instructions localized label.

Close #81 #72 #44 #10 #7 #2