Mystery volume mounted on my Macs...

I have the very nifty utility Growl. It provides "useful notifications that you control". I run several growl aware apps and an add-on utility called "HardwareGrowler" which is quite awsome. It gives you a growl notification when a device is plugged in or unplugged, for example, when I plug my network drop in, I get a notificaiton that the EN0 device became active, further it tells me that it's 100Mb, etc. I have growl set to automatically remove notices after a few seconds if the machine is not idle. But idle notices stick around until I close them.

Yesterday I had a growl notification that said "Volume Mounted Keystoen-1.0.1.340" which was strange, because a volume doesn't show up in the finder.

rwhiffen-macbook:networker rwhiffen$ df -k

Filesystem 1K-blocks Used Avail Capacity Mounted on

/dev/disk0s2 116753840 61716172 54781668 53% /

devfs 118 118 0 100% /dev

fdesc 1 1 0 100% /dev

map -hosts 0 0 0 100% /net

map auto_home 0 0 0 100% /home

/dev/disk1s2 1348 548 800 41% /Volumes/Keystone-1.0.1.340

/dev/disk2s3 97554672 60569148 36985524 62% /Volumes/external

rwhiffen-macbook:networker rwhiffen$

So now I see a new volume /Volumes/Keystone-1.0.1.340 and it has two files: Keystone.tbz install.py. And install.py has a header that says the following:



#!/usr/bin/python

# Copyright 2008 Google Inc. All rights reserved.



"""This script will install Keystone in the correct context

(system-wide or per-user). It can also uninstall Keystone. is run by

KeystoneRegistration.framework.



Example command lines for testing:

Install: install.py --install=/tmp/Keystone.tbz --root=/Users/fred

Uninstall: install.py --nuke --root=/Users/fred



Example real command lines, for user and root install and uninstall:

install.py --install Keystone.tbz

install.py --nuke

sudo install.py --install Keystone.tbz

sudo install.py --nuke



For a system-wide Keystone, the install root is "/". Run with --help

for a list of options. Use --no-processes to NOT start background

processes (e.g. launchd item).



Errors can happen if:

- we don't have write permission to install in the given root

- pieces of our install are missing



On error, we print an message on stdout and our exit status is

non-zero. On success, we print nothing and exit with a status of 0.

"""

So it seems a google product has mounted a volume with a python module in it. Funny thing is, if I google for it, I get zero hits. So I was a bit concerned about what it is exactly. If you bzip2 -d the tbz file and tar tvf the tar file it has a lot of files in it:

drwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/drwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/drwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/drwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/lrwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/GoogleShared -> Versions/Current/GoogleSharedlrwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/Resources -> Versions/Current/Resourcesdrwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/Versions/drwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/Versions/A/-rwxr-xr-x macbuild/staff 221032 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/Versions/A/GoogleShareddrwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/Versions/A/Resources/-rw-r--r-- macbuild/staff 884 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/Versions/A/Resources/Info.plistlrwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/GoogleShared.framework/Versions/Current -> Adrwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/Keystone.framework/lrwxr-xr-x macbuild/staff 0 2008-06-04 19:36:38 GoogleSoftwareUpdate.bundle/Contents/Frameworks/Keystone.framework/Keystone -> Versions/Current/Keystone



So it seems that the Google Software Update app launched itself and downloaded some kind of update. Funny thing is, I don't recall ever telling Google it was OK for it's app to do this. So I go into Google Updater and I find out that I 'kind of did'



So I don't have the "notify me" box checked, which is why I didn't get told about it. Strange stuff. Not sure I like it.