Open Radar

 
Summary:
`mdfind 'kMDItemContentType=public.unix-executable'` should report Unix executables, but fails to detect them in certain scenarios and, conversely, fails to detect when they're _no longer_ executable.

Curiously, the problem seems related to whether or not a new executable file is created AND made executable on the SAME LINE of a shell command line.

Steps to Reproduce:
Scenario 1: Create a new Unix executable

* Open Terminal, create a new temp, directory and change to it.
* Run the following commands:

    rm -f foo; echo 'echo foo' > foo # create and fill file 'foo', but DO NOT make executable YET
    chmod +x foo                           # make executable on SEPARATE LINE
    sleep 5      # give Spotlight some time to update its database
    mdfind -onlyin .  'kMDItemContentType=public.unix-executable'  # at this point, ./foo SHOULD be reported, but isn't

Scenario 2: Remove the executable permissions from a Unix executable previously recognized by Spotlight:

* In the same temp. directory created in scenario 1, run the following commands:

    rm -f foo; echo 'echo foo' > foo; chmod +x foo # create, fill, AND make the file executable on the SAME LINE
    sleep 5      # give Spotlight some time to update its database 
    mdfind -onlyin .  'kMDItemContentType=public.unix-executable'  # at this point, ./foo WILL be reported.

Now, REMOVE the executable permission from 'foo' and see if Spotlight - against expectation - STILL reports it as executable:

    chmod a-x foo  # remove executable permission for all security principals
    sleep 5      # give Spotlight some time to update its database 
    mdfind -onlyin .  'kMDItemContentType=public.unix-executable'  # at this point, ./foo SHOULD NO LONGER be reported, but is




Expected Results:
Scenario 1:

The `mdfind` command SHOULD report the equivalent of  ./foo (using an absolute path).

Scenario 2:

The `mdfind` command SHOULD NOT (no longer) report the equivalent of ./foo

Actual Results:
Scenario 1:

`mdfind` NEVER reports ./foo, no matter how long you wait.

Scenario 2:

The `mdfind` command STILL reports the equivalent of ./foo, even though ./foo is no longer executable.