From: Zbigniew D. <z....@gm...> - 2012-08-23 06:31:27
|
An user of my starpacked public domain Tcl/Tk 8.5.11 application wrote that it can't be launched on the new Lion Mountain and that a dialog box recommends to put it in the trash. Apparently this issue is caused by the new gatekeeper which will prevent to start programs that are not encrypted with a licensed Apple developer ID. A workaround is not to doubleclick the application but to rightclick and "open" it despite the warning message but this is just a workaround. Has anyone solved this issue? I wonder if a registration fee has to be payed and I have no idea how to encrypt a starpack with this developer ID. |
From: Kevin W. <kw...@co...> - 2012-08-23 10:31:39
|
On 8/23/12 2:31 AM, Zbigniew Diaczyszyn wrote: > An user of my starpacked public domain Tcl/Tk 8.5.11 application wrote > that it can't be launched on the new Lion Mountain and that a dialog box > recommends to put it in the trash. > > Apparently this issue is caused by the new gatekeeper which will prevent > to start programs that are not encrypted with a licensed Apple developer ID. > > A workaround is not to doubleclick the application but to rightclick and > "open" it despite the warning message but this is just a workaround. > > Has anyone solved this issue? > > I wonder if a registration fee has to be payed and I have no idea how to > encrypt a starpack with this developer ID. The default setting in 10.8 won't allow an app to run without being signed by an Apple Developer ID. There are a couple of solutions: 1. Pay $99, join Apple's developer program, and get a developer ID. 2. Tell users to adjust the security settings on their machines to allow unsigned apps to run. Gatekeeper is actually a nice compromise between no security at all (harder to justify these days) and the App Store, which not only imposes signing requirements but also requires major compromises in functionality to operate in a sandboxed environment. (I have a couple of apps in the App Store, and some outside of it, for this reason.) If you decide to go the Developer ID route, it's not hard to sign an app with your certificate--it can be done from the command line using the "codesign" tool. Hope this helps, Kevin -- Kevin Walzer Code by Kevin http://www.codebykevin.com |
From: Tim J. <tj...@to...> - 2012-08-23 15:31:25
|
On Aug 23, 2012, at 3:31 AM, Kevin Walzer wrote: > There are a couple of solutions: > > 1. Pay $99, join Apple's developer program, and get a developer ID. > 2. Tell users to adjust the security settings on their machines to allow > unsigned apps to run. 3. Tell the user to right-click on the app and they will be prompted with a different dialog allowing them to open the app. That should only be required the first time. But, Kevin's point 1 is still the best solution. Tim |
From: Zbigniew D. <z....@gm...> - 2012-08-26 08:23:14
|
Kevin and Tim, thank you for your hints Zbigniew |
From: Wojciech K. <woj...@ko...> - 2012-08-26 08:58:56
|
2012/8/23 Kevin Walzer <kw...@co...>: > If you decide to go the Developer ID route, it's not hard to sign an app > with your certificate--it can be done from the command line using the > "codesign" tool. Question about that part - were you able to sign a tclkit binary - i.e. one with actual binary data and VFS at the end? Maybe you are doing it differently than I am - and I have made something wrong. For me codesign rejected this, and what is more interesting (and scary), doing sdx mksplit, signing the head and packaging the binary back worked - so only the head (binary code) is signed and modifying VFS does not require signing again. That is fine since OSX accepts it, but it is scary since anyone grabbing my binary can modify VFS (i.e. throw in their application instead) and still ship it as signed by me. Again, I expect I am doing something wrong rather than signing the head only being the right way to go. |
From: Kevin W. <kw...@co...> - 2012-08-26 11:19:45
|
On 8/26/12 4:28 AM, Wojciech Kocjan wrote: > 2012/8/23 Kevin Walzer <kw...@co...>: >> If you decide to go the Developer ID route, it's not hard to sign an app >> with your certificate--it can be done from the command line using the >> "codesign" tool. > > Question about that part - were you able to sign a tclkit binary - > i.e. one with actual binary data and VFS at the end? I'm not using a tclkit, but rather a standalone build of Wish (the Mac version supports this type of deployment), and I don't run into this issue--but what you're reported is interesting. I'm not sure there's another way to proceed other than the way you've found. -- Kevin Walzer Code by Kevin http://www.codebykevin.com |
From: Zbigniew D. <z....@gm...> - 2012-08-27 10:22:26
|
Am 23.08.2012 12:31, schrieb Kevin Walzer: > The default setting in 10.8 won't allow an app to run without being > signed by an Apple Developer ID. > > There are a couple of solutions: > > 1. Pay $99, join Apple's developer program, and get a developer ID. Ah, I don't know if it is the right account but I have got if for free: https://developer.apple.com/programs/register/ So I will make some experiments with the tool "codedesign" ... |
From: Zbigniew D. <z....@gm...> - 2012-08-27 15:23:32
|
Am 27.08.2012 12:22, schrieb Zbigniew Diaczyszyn: > Am 23.08.2012 12:31, schrieb Kevin Walzer: >> The default setting in 10.8 won't allow an app to run without being >> signed by an Apple Developer ID. >> >> There are a couple of solutions: >> >> 1. Pay $99, join Apple's developer program, and get a developer ID. > > Ah, I don't know if it is the right account but I have got if for free: > > https://developer.apple.com/programs/register/ > > So I will make some experiments with the tool "codedesign" ... No, there won't be experiments. When I try to get a certificate Apple tells me: "You do not have access to this page. Either you not part of the program or do not have required priviliges to access this page" Clicking further on I have been informed that enrolling to the Mac developer program needs $99 to be payed as annual fee. On the long run no good perspective for public domain applications ... |