← Field Notes
Rosetta 2 · Tool

I found 27 Intel-only apps on one Mac: a fleet view for the Rosetta wind-down

R Rob Flanagan · · 3 min read

Apple is winding Rosetta down. Jamf inventories applications by name and version; this Extension Attribute adds a fleet-wide architecture signal and fails closed instead of handing you a false zero.

I scanned one Mac and found 27 Intel-only apps still installed. Apple is winding Rosetta 2 down, and that count is one most Mac admins don't have across a whole fleet yet.

General-purpose Rosetta stays available through macOS 27. From macOS 28 it narrows to a subset of older, unmaintained games. macOS already notifies a user when an Intel app won't work with a future release, which is fair warning to someone sitting at their Mac. It lands per-machine, at launch time, one warning at a time. The fleet question is the one Apple doesn't answer: across every Mac, which apps still carry Intel-classified status, and which are they? Jamf's built-in application inventory can identify applications by name and version; this EA adds a locally calculated architecture signal for Smart Group criteria.

The design is in how it runs

So I built the fleet view as a Jamf Extension Attribute, and how it runs is half the point. A full application scan isn't instant, so the EA doesn't scan. A background LaunchDaemon runs the scan on its own timer, caches the result to a root-only file, and the EA reads that file in well under a second. The default interval is seven days, one install parameter you set to match your own migration deadlines.

Two things I wanted to get right, because they are where this kind of tool usually breaks.

Classify on the field, not the label

The obvious approach is to grep system_profiler for Kind: Intel. That label is localized. On a non-English Mac the English string doesn't match, the count silently reads zero, and you would never know. This reads the observed arch_kind field underneath the label instead, from system_profiler -json SPApplicationsDataType. Anything it doesn't recognize is reported as Unknown, not assumed native.

Fail closed when the tool can't tell

A timeout or empty system_profiler result can look clean if an inventory script trusts only the result shape, so this tool marks it Unknown and Partial instead.

A complete-looking list is its own trap. system_profiler can hand back a well-formed inventory that quietly omits bundles. So a Complete result isn't trusted on its own. It gets reconciled against a direct scan of the bundles on disk, and if the two disagree, the read is Partial. That is the belt-and-suspenders habit: a false "you're clean" is worse than an honest "I'm not sure."

The 27 on my test Mac came from that fallback path. In the 2026-07-14 verification run on macOS 15.4.1 (24E263, arm64), with Spotlight disabled, system_profiler returned an empty array in 0.19 seconds. The direct bundle scan completed the full run in 4.97 seconds:

IntelOnly:27;Universal:109;AppleSilicon:28;iOS:6;Other:5;Unknown:0;ScanStatus:Complete;DetectionSource:DirectBundleScan;RosettaRuntimePresent:Yes;Arch:arm64;Scope:/Applications,/Applications/Utilities

Those timings are one dated run, not a performance promise. The thin EA reader only stats and reads the cache, so that part stays off the scan's clock.

One reader, three signals

The EA surfaces the count summary, the Intel-only app list, or both. Each is a single value you can Smart-group on. A migrated Mac reads IntelOnly: 0, but only when the scan is Complete, Unknown is 0, and the read isn't stale, uncollected, or malformed. Zero on its own isn't enough to trust, and the reader flags NOT_COLLECTED, STALE, and MALFORMED_CACHE rather than reporting a missing, stale, or corrupt cache as a clean result.

The source value is part of that evidence. Current code emits six: SystemProfiler, DirectBundleScan, SystemProfiler+DirectReconciled, SystemProfiler+DirectMismatch, SystemProfiler+ReconcileUnavailable, and SystemProfiler+FallbackFailed. I reran the pinned public test suite on 2026-07-29: 179 assertions passed and none failed.

Go64 already provides a per-Mac architecture check. I wanted the fleet answer as a Jamf EA and couldn't find one, so it is open source and MIT-licensed in the macadmin-toolbox repo. Scope is application bundles under the paths you set; it classifies the top-level architecture, not nested helpers or frameworks, and not whether anything has actually run. The README covers deploying it across a fleet and the questions that come up first.

That same Extension Attribute and Smart Group pattern also makes an inventory-first shadow AI rollout practical: collect a trustworthy signal before you scope a control.

Sources

Sources retrieved 2026-07-29. Implementation and test claims are pinned to macadmin-toolbox commit ce661c1; the test suite was rerun from that commit:

← Back to Field Notes