search

amaxwell / tlutility

TeX Live Utility, a Mac OS GUI for the TeX Live Manager
http://amaxwell.github.io/tlutility/
BSD 3-Clause "New" or "Revised" License
305 stars 17 forks source link

MacOS: signature problem? #102

Closed mouse07410 closed 3 years ago

mouse07410 commented 3 years ago

MacOS 10.15.7, Xcode-12.3. MacTeX-2020. TeX Live Utility 1.36.

Attempt to auto-upgrade to 1.40 failed.

Subsequent update attempts show

. . . . .
2021-01-08 14:05:23 +0000 Notice -[TLMMainWindowController _isCorrectDatabaseVersionAtURL:][71111]  Checking database version in case preferences have been changed…
2021-01-08 14:05:23 +0000 Notice -[TLMMainWindowController _updateAllPackagesFromRepository:][71111]    Beginning update of all packages from https://mirror.las.iastate.edu/tex-archive/systems/texlive/tlnet
2021-01-08 14:05:23 +0000 Notice -[TLMAuthorizedOperation main][71111]  Checking code signature before running tlu_ipctask as root…
2021-01-08 14:05:23 +0000 Notice -[TLMAuthorizedOperation main][71111]  *** ERROR *** The tlu_ipctask has been modified after signing!
Refusing to run child process with invalid signature.
2021-01-08 14:05:23 +0000 Notice -[TLMAuthorizedOperation main][71111]  The tlu_ipctask helper application may have been tampered with.
2021-01-08 14:05:25 +0000 Notice -[TLMLogWindowController awakeFromNib][71111]  Loaded log window controller

Re-signing the entire app did not help - the very same error message as shown above. OS seems to believe that the signature is correct:

$ codesign -dvv /Applications/TeX/TeX\ Live\ Utility.app
Executable=/Applications/TeX/TeX Live Utility.app/Contents/MacOS/TeX Live Utility
Identifier=com.googlecode.mactlmgr.tlu
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=8155 flags=0x0(none) hashes=249+3 location=embedded
Signature size=4818
Authority=Apple Development: uri@mit.edu (7TWWJNH7TG)
Authority=Apple Worldwide Developer Relations Certification Authority
Authority=Apple Root CA
Signed Time=Jan 8, 2021 at 09:08:00 
Info.plist entries=35
TeamIdentifier=36P8NK7X52
Sealed Resources version=2 rules=13 files=177
Internal requirements count=1 size=188
$ codesign -dvv /Applications/TeX/TeX\ Live\ Utility.app/Contents/MacOS/tlu_ipctask 
Executable=/Applications/TeX/TeX Live Utility.app/Contents/MacOS/tlu_ipctask
Identifier=com.googlecode.mactlmgr.tlmgr_cwrapper
Format=Mach-O thin (x86_64)
CodeDirectory v=20200 size=774 flags=0x0(none) hashes=19+2 location=embedded
Signature size=4818
Authority=Apple Development: uri@mit.edu (7TWWJNH7TG)
Authority=Apple Worldwide Developer Relations Certification Authority
Authority=Apple Root CA
Signed Time=Jan 8, 2021 at 09:08:00 
Info.plist entries=6
TeamIdentifier=36P8NK7X52
Sealed Resources=none
Internal requirements count=1 size=200
$
mouse07410 commented 3 years ago

Entire log:

2021-01-08 14:04:24 +0000 Notice -[TLMAppController handleGetURLEvent:withReplyEvent:][71111]   Requesting listing from location https://mirror.las.iastate.edu/tex-archive/systems/texlive/tlnet
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment initialize][71111]    Welcome to TeX Live Utility 1.36, running under Mac OS X Version 10.15.7 (Build 19H114) with 4/4 processors active and 8.0 GB physical memory.
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment _checkProcessUmask][71111]    Process umask = 022
2021-01-08 14:04:24 +0000 Notice __TLMCheckWgetrc[71111]    *** WARNING *** ~/.wgetrc exists. If you encounter problems, ensure that it does not conflict with system proxy settings.
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment updateEnvironment][71111] Setting up a new environment for /usr/local/texlive/2020…
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment updatePathEnvironment][71111] Using PATH = "(
    "/Library/TeX/texbin",
    "/Library/TeX/texbin",
    "/opt/local/bin",
    "/usr/bin",
    "/bin",
    "/usr/sbin",
    "/sbin"
)"
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment _checkSystemPythonMajorVersion:minorVersion:][71111]  Using python at '/opt/local/bin/python'
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment _checkSystemPythonMajorVersion:minorVersion:][71111]  Python version is 3.8.7 (default, Dec 24 2020, 15:25:42) 
[Clang 12.0.0 (clang-1200.0.32.28)]
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment updatePathEnvironment][71111] *** WARNING *** Unsupported python version. Attempting to work around.
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment _checkSystemPythonMajorVersion:minorVersion:][71111]  Using python at '/opt/local/bin/python'
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment _checkSystemPythonMajorVersion:minorVersion:][71111]  Python version is 3.8.7 (default, Dec 24 2020, 15:25:42) 
[Clang 12.0.0 (clang-1200.0.32.28)]
2021-01-08 14:04:24 +0000 Notice +[TLMEnvironment updateEnvironment][71111] Nothing to update for /usr/local/texlive/2020
2021-01-08 14:04:24 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Checking the repository version.  Please be patient.
2021-01-08 14:04:24 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Downloading at least 2048 bytes of tlpdb for a version check…
2021-01-08 14:04:24 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Downloaded 65536 bytes of tlpdb for version check
2021-01-08 14:04:25 +0000 Notice -[TLMDatabase texliveYear][71111]  parse_tlpdb.py noted the following problems: /Applications/TeX/TeX Live Utility.app/Contents/MacOS/parse_tlpdb.py:418: DeprecationWarning: The writePlistToBytes function is deprecated, use dumps() instead
  bytes_output = plistlib.writePlistToBytes(plist)

2021-01-08 14:04:25 +0000 Notice -[TLMEnvironment initWithInstallDirectory:][71111] Looks like you're using TeX Live 2020
2021-01-08 14:04:25 +0000 Notice -[TLMEnvironment _checkForRootPrivileges][71111]   Recursive check of installation privileges. This will happen once per launch, and may be slow if /usr/local/texlive/2020 is on a network filesystem…
2021-01-08 14:04:25 +0000 Notice +[TLMEnvironment _logEnvironment][71111]   Current environment from /usr/bin/env:
__CF_USER_TEXT_ENCODING=0x1F5:0x0:0x0
CC_FOR_BUILD=no_compiler_found
DBUS_LAUNCHD_SESSION_BUS_SOCKET=/private/tmp/com.apple.launchd.tophNFRspS/unix_domain_listener
DISPLAY=/private/tmp/com.apple.launchd.WlWhmV1Bsq/org.macosforge.xquartz:0
HOME=/Users/uri
LOGNAME=uri
PATH=/Library/TeX/texbin:/Library/TeX/texbin:/opt/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
SHELL=/bin/bash
SQLITE_EXEMPT_PATH_FROM_VNODE_GUARDS=/Users/uri/Library/WebKit/Databases
SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.z3yJbuAntT/Listeners
TMPDIR=/var/folders/pd/mxn5kp_55jg23x7jjd10gtwm0000gn/T/
USER=uri
VERSIONER_PYTHON_VERSION=2.6
XPC_FLAGS=0x0
XPC_SERVICE_NAME=0
2021-01-08 14:04:25 +0000 Notice -[TLMDatabase _reloadFromLocalFile][71111] Reloading local tlpdb from file:///usr/local/texlive/2020/tlpkg/texlive.tlpdb
2021-01-08 14:04:28 +0000 Notice -[TLMDatabase _reloadFromLocalFile][71111] parse_tlpdb.py noted the following problems: /Applications/TeX/TeX Live Utility.app/Contents/MacOS/parse_tlpdb.py:418: DeprecationWarning: The writePlistToBytes function is deprecated, use dumps() instead
  bytes_output = plistlib.writePlistToBytes(plist)

2021-01-08 14:04:28 +0000 Notice -[TLMDatabase _reloadFromLocalFile][71111] Took 3.51 seconds to reload local tlpdb
2021-01-08 14:04:28 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Checking the repository version.  Please be patient.
2021-01-08 14:04:28 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Downloading at least 2048 bytes of tlpdb for a version check…
2021-01-08 14:04:29 +0000 Notice -[TLMDatabase connection:willSendRequest:redirectResponse:][71111] redirected request to http://ctan.mirrors.hoobly.com/systems/texlive/tlnet/tlpkg/texlive.tlpdb
2021-01-08 14:04:29 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Downloaded 14211 bytes of tlpdb for version check
2021-01-08 14:04:30 +0000 Notice -[TLMDatabase texliveYear][71111]  parse_tlpdb.py noted the following problems: /Applications/TeX/TeX Live Utility.app/Contents/MacOS/parse_tlpdb.py:418: DeprecationWarning: The writePlistToBytes function is deprecated, use dumps() instead
  bytes_output = plistlib.writePlistToBytes(plist)

2021-01-08 14:04:30 +0000 Notice -[TLMEnvironment _getValidServerURL:repositoryYear:fromURL:][71111]    Repository version appears to be 2020; a mature TeX Live
2021-01-08 14:04:30 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Checking the repository version.  Please be patient.
2021-01-08 14:04:30 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Downloading at least 2048 bytes of tlpdb for a version check…
2021-01-08 14:04:31 +0000 Notice -[TLMDatabase _downloadDatabaseHead][71111]    Downloaded 32768 bytes of tlpdb for version check
2021-01-08 14:04:31 +0000 Notice -[TLMDatabase texliveYear][71111]  parse_tlpdb.py noted the following problems: /Applications/TeX/TeX Live Utility.app/Contents/MacOS/parse_tlpdb.py:418: DeprecationWarning: The writePlistToBytes function is deprecated, use dumps() instead
  bytes_output = plistlib.writePlistToBytes(plist)

2021-01-08 14:04:31 +0000 Notice -[TLMMainWindowController _refreshUpdatedPackageListFromLocation:][71111]  Refreshing list of updated packages…
2021-01-08 14:04:32 +0000 Notice +[TLMEnvironment updateEnvironment][71111] Nothing to update for /usr/local/texlive/2020
2021-01-08 14:04:36 +0000 Notice -[TLMEnvironment _checkForRootPrivileges][71111]   /usr/local/texlive/2020/texmf-dist/doc/man/man does not exist; ignoring permissions
2021-01-08 14:04:39 +0000 Notice -[TLMOperation main][71111]    Successfully executed `/Library/TeX/texbin/tlmgr --machine-readable --repository http://www.preining.info/tlgpg/ update --list --all`
2021-01-08 14:04:39 +0000 Notice -[TLMOperation main][71111]    start load http://www.preining.info/tlgpg/
finish load http://www.preining.info/tlgpg/
2021-01-08 14:04:39 +0000 Notice -[TLMMainWindowController _handleListGPGUpdatesFinishedNotification:][71111]   Found 0 tlgpg packages to update from http://www.preining.info/tlgpg/
2021-01-08 14:04:47 +0000 Notice -[TLMOperation main][71111]    Successfully executed `/Library/TeX/texbin/tlmgr --machine-readable --repository https://mirror.las.iastate.edu/tex-archive/systems/texlive/tlnet update --list --all`
2021-01-08 14:04:47 +0000 Notice -[TLMOperation main][71111]    start load https://mirror.las.iastate.edu/tex-archive/systems/texlive/tlnet
finish load https://mirror.las.iastate.edu/tex-archive/systems/texlive/tlnet
2021-01-08 14:05:03 +0000 Notice -[TLMEnvironment _checkForRootPrivileges][71111]   Recursive check completed in 38.2 seconds.  Root privileges not required.
2021-01-08 14:05:23 +0000 Notice -[TLMMainWindowController _isCorrectDatabaseVersionAtURL:][71111]  Checking database version in case preferences have been changed…
2021-01-08 14:05:23 +0000 Notice -[TLMMainWindowController _updateAllPackagesFromRepository:][71111]    Beginning update of all packages from https://mirror.las.iastate.edu/tex-archive/systems/texlive/tlnet
2021-01-08 14:05:23 +0000 Notice -[TLMAuthorizedOperation main][71111]  Checking code signature before running tlu_ipctask as root…
2021-01-08 14:05:23 +0000 Notice -[TLMAuthorizedOperation main][71111]  *** ERROR *** The tlu_ipctask has been modified after signing!
Refusing to run child process with invalid signature.
2021-01-08 14:05:23 +0000 Notice -[TLMAuthorizedOperation main][71111]  The tlu_ipctask helper application may have been tampered with.
2021-01-08 14:05:25 +0000 Notice -[TLMLogWindowController awakeFromNib][71111]  Loaded log window controller
2021-01-08 14:11:01 +0000 Notice -[TLMMainWindowController _isCorrectDatabaseVersionAtURL:][71111]  Checking database version in case preferences have been changed…
2021-01-08 14:11:01 +0000 Notice -[TLMMainWindowController _updateAllPackagesFromRepository:][71111]    Beginning update of all packages from https://mirror.las.iastate.edu/tex-archive/systems/texlive/tlnet
2021-01-08 14:11:01 +0000 Notice -[TLMAuthorizedOperation main][71111]  Checking code signature before running tlu_ipctask as root…
2021-01-08 14:11:01 +0000 Notice -[TLMAuthorizedOperation main][71111]  *** ERROR *** The tlu_ipctask has been modified after signing!
Refusing to run child process with invalid signature.
2021-01-08 14:11:01 +0000 Notice -[TLMAuthorizedOperation main][71111]  The tlu_ipctask helper application may have been tampered with.
amaxwell commented 3 years ago

Well, that's not good at all, and I'm baffled. Does it run if you download manually? https://github.com/amaxwell/tlutility/releases/tag/1.40

mouse07410 commented 3 years ago

Does it run if you download manually?

Hmm... Thankfully, it does!!

So, my immediate problem is addressed - installed the 1.40 manually, and it ran the update successfully.

But I'm still concerned about the failure of the auto-updater.

JuanCab commented 3 years ago

Yeah I got an error with the manually downloaded 1.40 when attempting to launch it that it "can’t be opened because Apple cannot check it for malicious software." Appears to be a signature problem. When I control clicked the Finder icon and opened it, I was able to approve running it just like unsigned software.

amaxwell commented 3 years ago

@JuanCab: the "malicious software" alert is because it's not notarized. Did the Sparkle update fail for you, as well?

JuanCab commented 3 years ago

I thought I had auto-updated using Sparkle... not absolutely certain (I had to update three computers, one running Mojave, another High Sierra, and this one Big Sur), sometimes I download the update via MacUpdate.com links and update via the package though. Not sure what I did this time. Sorry I can't be more precise.

amaxwell commented 3 years ago

@mouse07410 Since I sign tlu_ipctask with a kill setting (so the process that runs as root cannot run if it is tampered with), I'm not sure if it can be re-signed, or if Apple can somehow track that. I switched to distributing a .dmg so Apple's Gatekeeper garbage would work more reliably, but apparently it can still break, and I have no idea how.

JuanCab commented 3 years ago

Do you think reinstalling from .dmg would fix it or do you think that is the source of the problem? Can I grab an older version, force an auto-update, and have this be resolved? Actually, its not an issue since I was able to get it running now, but just curious.

amaxwell commented 3 years ago

No. Notarization is something that requires me paying Apple $100 annually for the privilege of volunteering my time to develop free software that I distribute on GitHub. This will probably happen in the future due to the generosity of the MacTeX group, but it's a sore point for me.

JuanCab commented 3 years ago

Yeah, that sucks. It is amazing to me that Apple can't figure out some way to offer free notarization... or doesn't appear to try. OK, thanks for the clarification.

mouse07410 commented 3 years ago

Update from 1.40 to 1.41 also failed. Manual downloaded pre-built binary got installed fine and worked OK.

amaxwell commented 3 years ago

Do you have a corporate/institutional firewall that might unpack things for virus scanning? That's kind of a long shot, as I can't see why it would only break the CLI tool.

Looking at the Xcode project, I wonder if the Xcode 10 "upgrade" broke code signing, when I stupidly let it switch to the new build process and it broke a bunch of stuff. Maybe I should codesign it manually.

mouse07410 commented 3 years ago

Do you have a corporate/institutional firewall that might unpack things for virus scanning?

Well, several arguments against this theory: (a) same problem on my home machine, and (b) previous versions seemed to update automatically, regardless of the firewall.

Looking at the Xcode project, I wonder if the Xcode 10 "upgrade" broke code signing, when I stupidly let it switch to the new build process and it broke a bunch of stuff. Maybe I should codesign it manually.

I don't really know. Maybe worth an experiment for the next upgrade?

amaxwell commented 3 years ago

I've updated the Sparkle framework and the next version will be notarized, so I'm closing this report. Reopen or file a new one if it crops up again. Beta available here: https://github.com/amaxwell/tlutility/releases/download/1.42b19/TeX.Live.Utility.app-1.42b19.dmg