“Sloth.app” can’t be opened because Apple cannot check it for malicious software.

[nd7]

Trying to open the app following warning is shown.

I know the workaround - right click, open

It will be good to notarize and update the app so that this warning does not come up and user experience becomes better

[mehas]

I'm able to replicate in OSX v13.2.1

[rdanilin]

Same. I have Monterey 12.6.2 (21G320).

[sveinbjornt]

This is expected behaviour since the app is not notarized.

[arielallon]

Unfortunately, I cannot use the known workaround due to policies enforced on my work laptop. Notarizing if possible would make the difference for me.

[rdanilin]

@sveinbjornt Do you have a workaround or now how not fix that?

[iAmWillShepherd]

@nd7

Try opening Security and Privacy in system preferences after trying to open. You should see a button beneath the Allow apps downloaded from section of the pane.

[riclf]

That's certainly how it was. On Ventura today, it looks different, as in my graphic, and unfortunately the "App Store and identified developers" selection is not the trick to do it. But in the Applications folder, if you right-click on sloth.app it gives the option to open it.

[mehas]

I have "App Store and identified developers" selected

if you right-click on sloth.app it gives the option to open it

Sadly, this still gives me the same warning, I am unable to open the app. Same problem with the "Open Anyway" button:

Result:

running OSX Ventura 13.2.1 (22D68)

[sveinbjornt]

@mehas Sloth is decidedly not from an unidentified developer. I reluctantly pay Apple their obnoxious $100 tax every year just to be able to sign my free software, incl. Sloth.

[riclf]

I hear you! I make the same payment. Irks me but it is the toll required to play in their code yard. Grrrr.

-Ric

Richard Fink Belvedere CA 94920 M: 415.302.7317 (World) H: 415.435.1227 (Marin) H: 415.409.6396 (SF)

From: Sveinbjorn Thordarson @.> Reply-To: sveinbjornt/Sloth @.> Date: Friday, February 24, 2023 at 10:10 AM To: sveinbjornt/Sloth @.> Cc: Richard Fink @.>, Comment @.***> Subject: Re: [sveinbjornt/Sloth] “Sloth.app” can’t be opened because Apple cannot check it for malicious software. (Issue #24)

@mehashttps://github.com/mehas Sloth is decidedly not from an unidentified developer. I reluctantly pay Apple their obnoxious $100 tax every year just to be able to sign my free software.

[Screen Shot 2023-02-24 at 18 09 01]https://user-images.githubusercontent.com/654045/221256804-95593b76-82a6-4b28-aa5a-55548cefb475.png

— Reply to this email directly, view it on GitHubhttps://github.com/sveinbjornt/Sloth/issues/24#issuecomment-1444172650, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AABE7WGCLORAJ3L5N6NU24TWZD2SXANCNFSM6AAAAAAU76Y22Y. You are receiving this because you commented.Message ID: @.***>

[mehas]

Thanks for the update @sveinbjornt I didn't mean to imply otherwise. Just hoping to help by describing how to reproduce the bug. (I've heard similar frustrations from other iOS devs.)

[AndresReyesDev]

To fix it you just need to write this command in to the Terminal:

xattr -r -d com.apple.quarantine /Applications/Sloth.app/

And voilà!

[PicoMitchell]

Curious why not go ahead a notarize since the app is already signed? I think Xcode can notarize automatically but even if you have a custom build process it's not very hard to manually notarize using notarytool.

Here some simple shell example code for how to sign and notarize an app:

echo 'Code Signing App...'
codesign -fs 'Developer ID Application' -o runtime --strict [PATH TO APP]

echo 'Zipping App for Notarization...'
ditto -ckvV --keepParent [PATH TO APP] [PATH TO TEMPORARY ZIPPED APP]

echo 'Notarizing App...'
xcrun notarytool submit [PATH TO TEMPORARY ZIPPED APP] --keychain-profile [NOTARYTOOL APP-SPECIFIC PASSWORD NAME] --wait
rm -f [PATH TO TEMPORARY ZIPPED APP]

echo 'Stapling Notarization Ticket to App...'
xcrun stapler staple [PATH TO APP]

The "hardest" part is initially setting up the app-specific password for notarytool, but you can read about how to do that here:

• https://scriptingosx.com/2021/07/notarize-a-command-line-tool-with-notarytool/
• https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow

PS. If Sloth (or any of your other apps) require entitlement exemptions for hardened runtime signing, that adds another little step to the process but still pretty simple. If that's the case I can share some example code for that as well.

[sveinbjornt]

@PicoMitchell Thank you for the feedback, sample code and links. I may look into this notarization business at some point in the future.

That being said, I have very limited time to work on these old macOS software projects of mine, time that is probably better spent improving them and fixing bugs rather than getting a headache working around Apple's disgusting and unconscionable gatekeeping, which is perpetually changing and getting more suffocating with every OS release. I'm already fuming over paying them 100 USD a year for the privilege of maintaining free, open source software.

Ctrl-click Open on the app isn't exactly rocket science, and most of my software is aimed at power-users who know this. The bad initial user experience is entirely on Apple and their attempt to slowly and surely push everything into the Mac App Store ... which I do not use and never will.