Google Chrome: Autoupdating accumulates older versions - how to delete

we created an EA that records the number of versions (i.e. count the folders) then have a policy that simply deletes the entire folder and reinstall Chrome direct from Google. I think it's based on this script.

Could you post your script on here? We're seeing the same issue occur over here.

@echalupka Certainly. Here you go:

#!/usr/bin/env python

# clean_chrome_versions.py
#
# Manavendra Thakur
# International Monetary Fund
# mthakur@imf.org
#
# v1.0
# 2018-07-05

# ChangeLog
# v1.0 2018-07-05
# Initial version

# Credits

# Derived from
# https://cs.chromium.org/chromium/src/chrome/tools/build/mac/clean_up_old_versions.py
# Retained copyright and license notice:
# Copyright 2016 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Code portions borrowed from:
# chrome-enable-autoupdates.py
# https://github.com/hjuutilainen/adminscripts
# Created by Hannes Juutilainen, hjuutilainen@mac.com

import optparse
import os
import shutil
import sys
import plistlib
import pwd
import stat

default_chrome_path = "/Applications/Google Chrome.app"
default_umask = 0o022


def clean_app_versions(path_to_app, app_keep_version):
  """Delete all Google Chrome versions except keep version"""
  versions_dir = os.path.join(path_to_app, 'Contents', 'Versions')
  if os.path.exists(versions_dir):
    for version in os.listdir(versions_dir):
      if version != app_keep_version:
        path_to_delete = os.path.join(versions_dir, version)
        print "Removing %s" % (path_to_delete)
        shutil.rmtree(path_to_delete)
  else:
    print >> sys.stderr, "Error: Path %s does not exist." % (versions_dir)
    return 1

def chrome_installed(chrome_path):
    """Check if Chrome is installed"""
    if os.path.exists(chrome_path):
        return True
    else:
        return False

def installed_chrome_version(chrome_path):
    """Returns Chrome version"""
    info_plist_path = os.path.realpath(os.path.join(chrome_path, 'Contents/Info.plist'))
    info_plist = plistlib.readPlist(info_plist_path)
    bundle_short_version = info_plist["CFBundleShortVersionString"]
    return bundle_short_version

def clean_user_level_keystone_updates(disable_current_updates, block_future_updates, umask):
    """Disables Google Keystone in user home folders"""
    # For each user on computer...
    for p in pwd.getpwall():
        user_id = p.pw_uid
        group_id = p.pw_gid
        user_home_dir = p.pw_dir
        # Exclude system accounts
        if user_home_dir.startswith("/var/") or user_home_dir.startswith("/private/") or user_home_dir.startswith("/Library/"):
            continue
        google_dir = os.path.join(user_home_dir, "Library/Google")
        googlesoftwareupdate_dir = os.path.join(google_dir, "GoogleSoftwareUpdate")
        # If ~/Library/Google/GoogleSoftwareUpdate exists...
        if os.path.exists(googlesoftwareupdate_dir):
            flags = os.stat(googlesoftwareupdate_dir).st_flags
            # Make no changes if folder is locked, even though sudo user can override
            mutable = not bool(flags & stat.UF_IMMUTABLE)
            if mutable:
                if disable_current_updates:
                    # Delete contents of ~/Library/Google/GoogleSoftwareUpdate
                    for filename in os.listdir(googlesoftwareupdate_dir):
                        filepath = os.path.join(googlesoftwareupdate_dir, filename)
                        try:
                            shutil.rmtree(filepath)
                        except OSError:
                            os.remove(filepath)
                if block_future_updates:
                    # Lock folder to prevent future Keystone update attempts
                    os.chflags(googlesoftwareupdate_dir, flags | stat.UF_IMMUTABLE)
        else:
            # ~/Library/Google/GoogleSoftwareUpdate does not exist
            if block_future_updates:
                # Create ~/Library/Google/GoogleSoftwareUpdate
                old_umask = os.umask(umask)
                if os.path.exists(google_dir):
                    os.mkdir(googlesoftwareupdate_dir)
                    os.chown(googlesoftwareupdate_dir, user_id, group_id)
                else:
                    os.makedirs(googlesoftwareupdate_dir)
                    os.chown(google_dir, user_id, group_id)
                    os.chown(googlesoftwareupdate_dir, user_id, group_id)
                # Lock folder to prevent future Keystone update attempts
                flags = os.stat(googlesoftwareupdate_dir).st_flags
                os.chflags(googlesoftwareupdate_dir, flags | stat.UF_IMMUTABLE)
                os.umask(old_umask)

def Main():
  """The main routine."""
  Usage = """%prog [options] [Chrome path] [keep version]

      Deletes non-current (both older and newer) versions of Google
      Chrome that can accumulate in the /Applications/Google
      Chrome.app/Contents/Versions folder over time if Google Chrome
      auto-update is enabled for all users.

      Optional Arguments: Specify path to Google Chrome app and
      version to keep intact.
      Defaults to "/Applications/Google Chrome.app" and installed
      version.

      This script must be run with admin privilegs.

      Examples:

      Clean Chrome versions from "/Applications/Google
      Chrome.app/Contents/Versions" folder:
      sudo clean_chrome_versions.py

      Same as above, and delete current Keystone updates, and block
      future Keystone updates:
      sudo clean_chrome_versions.py -a

      Same as above, but with umask of 077 (i.e. "drwx------"
      permissions on any created folders):
      sudo clean_chrome_versions.py -a -u 077

      Specify nonstandard path and specific version to keep:
      sudo clean_chrome_versions.py "/Path/To/Google Chrome.app" 1.2.3.4
      """

  parser = optparse.OptionParser(usage=Usage)
  parser.add_option('-a', '--all', action='store_true', help=("Disable both current and future Google Keystone updates for existing users, except system accounts. Same as specifying -d and -b."))
  parser.add_option('-d', '--disable-current', action='store_true', help=("Disable current Google Keystone updates for existing users, except system accounts, by deleting contents of ~/Library/Google/GoogleSoftwareUpdate."))
  parser.add_option('-b', '--block-future', action='store_true', help=(
     "Block future Google Keystone updates for existing users, except system accounts, by locking the ~/Library/Google/GoogleSoftwareUpdate folder, creating this folder if it doesn't exist."))
  parser.add_option('-u', '--umask', type="int", help=(
     "Umask used while creating Keystone update folders. Defaults to %s." % oct(default_umask)))
  opts, args = parser.parse_args()
  if len(args) != 2:
    chrome_path = default_chrome_path
    keep_version = installed_chrome_version(chrome_path)
  else:
    chrome_path = args[0]
    keep_version = args[1]

  all = opts.all or False
  disable_current = opts.disable_current or all or False
  block_future = opts.block_future or all or False
  umask = opts.umask or default_umask

  # Check for root
  if os.geteuid() != 0:
    print >> sys.stderr, "Error: This script must be run as root"
    return 1

  if not chrome_installed(chrome_path):
    print >> sys.stderr, "Error: Chrome path %s does not exist." % (chrome_path)
    return 1

  clean_app_versions(chrome_path, keep_version)
  if disable_current or block_future:
    clean_user_level_keystone_updates(disable_current, block_future, umask)
  return 0

if __name__ == '__main__':
  sys.exit(Main())

@echalupka Please invoke the code from the command line as follows:

Clean Chrome versions from "/Applications/Google Chrome.app/Contents/Versions" folder:
$ sudo clean_chrome_versions.py

Same as above, and delete current Keystone updates, and block future Keystone updates:
$ sudo clean_chrome_versions.py -a

Same as above, but with umask of 077 (i.e. "drwx------" permissions on any created folders):
$ sudo clean_chrome_versions.py -a -u 077

Specify nonstandard path and specific version to keep:
$ sudo clean_chrome_versions.py "/Path/To/Google Chrome.app" 1.2.3.4

Thanks a bunch @mthakur !

I had to make a few changes to get this working on macOS Big Sur 11.5.x with modern versions of Chrome (test with 91.x+).

Full updated version:

Silly reply submission making me do a duplicate post since the first one didn't show up, and then the second didn't either for quite some time.