search

jart / cosmopolitan

build-once run-anywhere c library
ISC License
18.36k stars 630 forks source link

help with 'macOS cannot verify that this app is free from malware' #147

Closed markhdavid closed 3 years ago

markhdavid commented 3 years ago

This seems like a never-ending battle, but I just tried downloading a cosmopolitan file (redbean.com), then did chmod +x redbean.com, then tried to run. MacOS 10.15.7 just puts up an alert:

"redbean.com" cannot be opened because the developer cannot be verified.
macOS cannot verify that this app is free from malware.

I tried the workaround of right-clicking and then doing open, but it says

There is no application set to open the document “redbean-now.com”.

It seems this has gotten harder, but perhaps I missed the latest advice. Can someone point to any solution or workaround?

niutech commented 3 years ago

According to this article, you have to click with Control key and choose Open. You should also go to System Preferences > Security & Privacy >General > Allow apps...., as said in this article. Also check that the file has executable permission: chmod a+x redbean-now.com.

jart commented 3 years ago

Did you follow the install instructions recommended on the website? 

curl https://justine.lol/redbean/redbean-latest.com >redbean.com
curl https://justine.lol/redbean/redbean-latest.com.dbg >redbean.com.dbg
chmod +x redbean.com
./redbean -v
bash -c './redbean.com -v'  # zsh/fish workaround (we upstreamed patches!)

Right now what you can do to verify that a binary came from me, is to check the VirusTotal service, and look for an upvote from howishexeasier. That's the closest thing we have to multi-platform portable code-signing. I don't have much knowledge about the restrictions that XNU uses, but the curl command above might help.

markhdavid commented 3 years ago

Instructions almost work: you have to use ./redbean.com on the 4th line. Thanks.

jart commented 3 years ago

Thanks for pointing that out. I've updated the website!