.dmg notarising and 'future' macOS

Targets macOS
42

FWW … same issue still happens with macOS 10.15 Beta 3
Also, my feedback case was today closed … again ‘By design’.

  • Or we do something wrong when notarising (although Apple sends a mail it is ready for distribution).
  • Or there is still a bug in beta 3. Seeing Apple closed my case with ‘by design’ this is likely not the case (read: no bug).

So I think switch to .pkg to distribute my apps for now.

43

Out of curiosity, try https://beaconapp.cc/download/ on Catalina. I don’t have a good way to install it myself yet. It is notarized with the typical sign/dmg/sign/notarize workflow, so it’ll probably have the same unidentified developer issue. But I am curious since I wrote the notarization script myself.

44

Yep,same issue.

FFW do not install beta 3: It is very unstable. I tried to install it on my second iMac system and it does not even pass the download stage.
So when you are running beta 2 … keep it for now.
Apple is really making a mess of this. :confused:

45

I just updated from beta 2 to beta 3 without issues (on a 2013 Macbook Air), so YMMV. I will say however that catalina in general is very buggy overall.

46

I filed 10 reports with Apple in regards to the degraded experience that end users are facing with 3rd party apps downloaded from the internet. Some highlights include.

  1. When GateKeeper rejects the Notarized DMG, there are 3 places you can check for a rejection reason. Two report "Assertion Failed’ (or failure), while the 3rd showed "Analysis report: ". With no known way to reveal what , I can’t proceed further. My requests to find out how to view this information, so far have not been answered.
  2. Out of the 3 Apple published techniques for validating a code signed DMG, two report “Accepted: Notarized Developer ID”, the 3rd reports “Invalid Context”. I could find no documentation on this error and what it means, and I’ve had no response from Apple yet.
  3. Misleading “Warning app is trying to access downloads folder” dialog. This occurred when I dragged a folder from a DMG into my application. This gives the impression that the application is snooping around in a folder without the users consent, which is false.
  4. The installation process from a Notarized PKG file is horrible. Multiple “Warning this application is trying to access” dialogs when installing, this is Apple’s 1st party installer for crying out loud, not a custom solution that users may actually need to worry about.
  5. Installed apps from Notarized PKG files do not show up in Apple’s LaunchPad, again giving the wrong impression of a 3rd Party application before it even gets opened.
  6. Again when installing the application from a Notarized PKG file, my own internal code sign verification code reports a failure. Which doesn’t occur from a DMG file.

So in conclusion; if you put aside that Apple have now shipped a 3rd Beta which can’t open code signed & Notarized DMG files, @Christoph De Vocht repeatedly closed reports on this; you can see that in the name of security, our apps are given a negative first impression by Apple. Unless of course, our apps come from the Mac App Store. While I don’t like to believe that this is intentional, I can’t shake this feeling.

47

Sam, that’s the same thing I think, it’s a way of slowly pushing everyone into the AppStore or else getting out !

48

I’ve been experimenting with pkg files at bit yesterday. I’ve never ever seen the installer app crash before. Not the installed app, but the installer itself.

49

I’m seeing in the Apple developers forum that people are saying Notarized DMG files are working with beta 3.

Also this is the command that one of the respondents is using verify the DMG file; I haven’t tried it myself.

spctl --assess --verbose --ignore-cache --type open --context "context:primary-signature" <path-to-dmg>
50 
  sudo log config --mode "private_data:on"
51

My signed and notarized DMGs are now working with beta 3.

52

[quote=443869:@Michael Diehr] sudo log config --mode "private_data:on" [/quote]
When I tried it with beta 2; it didnt work.

53

I just tried this on beta 3; and got "Invalid modes ‘private_data:on’.

My DMG opened in b3; however I didn’t a Gate Keeper dialog at all. I’ve even re-downloaded it; so I can only assume that the OS has tagged somewhere that I’ve manually opened this DMG in the past.

54

I see reports that it stopped working with beta 2. I’ll look for more info.

When you say “gatekeeper dialog” - do you mean the dialog that says “verifying…” and has a progress bar? Or some other dialog.
If it is remembering which DMGs you’ve opened, I wonder where it’s stored and if there’s a way to reset that?

Edit to add: I just ran a test using the latest Xojo alpha (which is notarized). On both 10.14 and 10.15 (beta 3), when I double click the DMG I get two dialog windows, first “Verifying…” and then “Opening.” After ejecting the DMG and repeating it, I see pretty much the same thing: on both 10.14 and 10.15 there are again two windows (although the “opening…” one seems faster). So I’m not seeing evidence that the OS is caching or remembering the DMG and bypassing any checks on a second open.

55

[quote=444110:@Michael Diehr]When you say “gatekeeper dialog” - do you mean the dialog that says “verifying…” and has a progress bar? Or some other dialog.
If it is remembering which DMGs you’ve opened, I wonder where it’s stored and if there’s a way to reset that?[/quote]
I mean the “This application was downloaded from the internet.”

I’m preparing some DMGs now to test with Catalina later.

I filed a bug report with Apple over this, as I find it absurd that we’re not allowed to read the log files on our own computer. Also it’s worth noting this was never officially documented, and probably the security nuts were not happy when this option leaked.

56

So to be perfectly clear- are you saying that when you download a notarized DMG, you get 3 separate dialogs:

  • This application was downloaded from the internet.
  • Verifiying
  • Opening

Or does the “this application was downloaded” happen third? I’m a litle confused by what you are seeing as I’m not seeing that.

57

I have been able to notarize my pkg installer which has a main app and 2 helper apps on 10.15 beta 3 running on Parallels.
Thank you to all the very helpful posts to help me get through this rather complex process.

Not sure why the installer.app needs permissions in access files on the desktop though. Isn’t that a macOS app?

58

@Michael Diehr This is the dialog I meant.

I have now seen it on Catalina, but curiously Apple have removed the text about it been checked/verified by Apple.

59

[quote=443736:@Christoph De Vocht]Yep,same issue.

FFW do not install beta 3: It is very unstable. I tried to install it on my second iMac system and it does not even pass the download stage.
So when you are running beta 2 … keep it for now.
Apple is really making a mess of this. :/[/quote]
So I just installed Catalina to confirm the issue for myself and my results are different than yours. Using both the shipping version and a beta I published today, both launch just fine. No unidentified developer warnings or anything like that, just the “app was downloaded from the internet” dialog that Sam just posted. That’s exactly what I would expect. Using codesign -dvv /path.app prints out all the valid signing data, and spctl --verbose --assess --type execute -v /path.app confirms it is accepted by Gatekeeper:

/Volumes/Beacon/Beacon.app: accepted source=Notarized Developer ID origin=Developer ID Application: Thom McGrath (E3JM6H56CP)

So maybe a minor update was pushed since your test, but I can’t replicate a failure.

60

I already said macOS 10.15 beta 3 fixes the .dmg issue.
Unfortunately there are other issues (like the folderitem.temporaly).

61

[quote=444362:@Christoph De Vocht]I already said macOS 10.15 beta 3 fixes the .dmg issue.
Unfortunately there are other issues (like the folderitem.temporaly).[/quote]
Actually you said [quote=443722:@Christoph De Vocht]FWW … same issue still happens with macOS 10.15 Beta 3
Also, my feedback case was today closed … again ‘By design’[/quote]
That’s why I was interested in testing myself.