Hammerspoon: "internal.so" cannot be opened because the developer cannot be verified

[snowe2010]

I'm encountering '"internal.so" cannot be opened because the developer cannot be verified' for the hammerspoon _asm spaces module. Unsure what could be causing it. This is a new computer, but I had just set this all up on another new computer last month and it worked fine.

Discussion on irc:

08:46:37
asked this yesterday, but think my client messed up, so lost all the history. 
Unable to find anything in the github issues, but I'm encountering '"internal.so" cannot be opened because the developer cannot be verified' for the hammerspoon _asm spaces module. Unsure what could be causing it. This is a new computer, but I had just set this all up on another new computer last month and it worked fine.this is on Catalina btw.
Ng
08:47:22
snowe2010: that's macOS being secure at you :/
where did you put the internal.so?
snowe2010
08:47:54
it's just in my dotfiles, then I symlink the hammerspoon folder. let me link my layout. 
https://github.com/snowe2010/dotfiles/tree/master/hammerspoon/hammerspoon.symlink
Ng
08:48:14
hmm, I thought we specified that we wanted to be able to load arbitrary library files
snowe2010
08:50:19
internal.so is here https://github.com/snowe2010/dotfiles/tree/master/hammerspoon/hammerspoon.symlink/hs/_asm/undocument...
snowe2010
09:02:36
here's the full error:
2020-08-10 17:06:48: *** ERROR: error loading module 'hs._asm.undocumented.spaces.internal' from file '/Users/tyler.thrailkill/.hammerspoon/hs/_asm/undocumented/spaces/internal.so':   dlopen(/Users/tyler.thrailkill/.hammerspoon/hs/_asm/undocumented/spaces/internal.so, 6): no suitable image found.  Did find:    /Users/tyler.thrailkill/.hammerspoon/hs/_asm/undocumented/spaces/internal.so: code signature in (/Users/tyler.thrailkill/.hammerspoon/hs/_asm/undocumented/spaces/internal.so) not valid for use in process using Library Validation: library load disallowed by system policystack traceback:  [C]: in ?   [C]: in function 'rawrequire'   ...app/Contents/Resources/extensions/hs/_coresetup/init.lua:579: in function 'require'  ...ilkill/.hammerspoon/hs/_asm/undocumented/spaces/init.lua:8: in main chunk    [C]: in function 'rawrequire'   ...app/Contents/Resources/extensions/hs/_coresetup/init.lua:579: in function 'require'  ...thrailkill/.hammerspoon/Spoons/MoveSpaces.spoon/init.lua:26: in main chunk   [C]: in function 'rawrequire'   ...app/Contents/Resources/extensions/hs/_coresetup/init.lua:579: in function 'require'  ...app/Contents/Resources/extensions/hs/_coresetup/init.lua:259: in field 'loadSpoon'   ...oon.app/Contents/Resources/extensions/hs/spoons/init.lua:240: in function 'hs.spoons.use'    ...railkill/.hammerspoon/Spoons/SpoonInstall.spoon/init.lua:386: in function 'SpoonInstall.andUse'  /Users/tyler.thrailkill/.hammerspoon/init.lua:49: in main chunk [C]: in function 'xpcall'   ...app/Contents/Resources/extensions/hs/_coresetup/init.lua:630: in function 'hs._coresetup.setup'  (...tail calls...)
agh. I should have used pastebin. give me a sec
https://pastebin.com/z4KsKEwz
snowe2010
10:02:37
Ng, anything I can dig into here to figure out why this is happening?
Ng
10:04:09
snowe2010: sorry, I'm not sure. I know why this is happening, I'm just surprised that it is
we moved to the new macOS hardened runtime, but I'm sure I applied the setting for "allow loading unsigned libraries"
your easiest option would be to downgrade to HS 0.9.75
but there may also be things you can do to break HS' code signature, thus disabling some of these checks
snowe2010
10:28:16
hm.. found the same issue here, https://developer.apple.com/forums/thread/115451, where it sounds like they did the same thing but had the same error.
snowe2010
10:30:27
I install using homebrew, maybe that's part of the issue? that makes it more difficult to downgrade though.
Ng
10:47:54
ah interesting
it could be that asm's build is too old
Ng
10:49:17
snowe2010: could you run: otool -l /Users/tyler.thrailkill/.hammerspoon/hs/_asm/undocumented/spaces/internal.so | grep -B 1 -A 3 LC_VERSION_MIN
snowe2010
10:49:40
❯ otool -l /Users/tyler.thrailkill/.hammerspoon/hs/_asm/undocumented/spaces/internal.so | grep -B 1 -A 3 LC_VERSION_MINLoad command 8      cmd LC_VERSION_MIN_MACOSX  cmdsize 16  version 10.10      sdk 10.12
blargh, that looks bad. need me to post in pastebin? I'm using kiwi right now as this is a brand new computer and don't have weechat setup...
Ng
10:50:49
no that's fine
but it blows that theory out of the window, because 10.10 should be new enough
snowe2010
10:52:07
:(
Ng
11:00:53
snowe2010: would you mind opening a github issue? in the worst case, I'm happy to codesign asm's build

❯ otool -l /Users/tyler.thrailkill/.hammerspoon/hs/_asm/undocumented/spaces/internal.so | grep -B 1 -A 3 LC_VERSION_MIN

Load command 8
      cmd LC_VERSION_MIN_MACOSX
  cmdsize 16
  version 10.10
      sdk 10.12

Versions:

macOS Catalina 10.15.6
Hammerspoon 0.9.78 (5164)

[cmsj]

@asmagill any objections if I sign a copy of the spaces dylib as a quick workaround for this?

[asmagill]

Yeah, go ahead.

Is this because they're using the Hammerspoon release? I've not run into this issue myself, but I'm usually running a development build. Speaking of which, what's your expected target for the next release? I can finish up axuielement in the next day or so, but if it's going to be a while, I may have a couple of others to add as well... OTOH, it has been a while, and until we do the next release, those of us with third party modules need to maintain a lua 5.3 and a lua 5.4 version (if we offer precompiled versions, that is)...

This may be the thing that finally pushes me to get a developer cert for myself... been waffling back and forth, but if Apple's finally locking things down such that even our releases now require external libraries to be signed, it may be time for me to just bite the bullet.

[snowe2010]

I'm using brew to install Hammerspoon. then did an update from there.

[cmsj]

Yes, it's a release build, but this is very weird because I specifically enabled the "allow loading unsigned binaries" entitlement when I enabled the Hardened Runtime, specifically because of this use case.

I don't currently have a target for a release - I'm currently spending a lot of time playing with SwiftUI for iOS apps which is distracting me from HS 😬

[cmsj]

Hmm, is there a public build of spaces that works with 0.9.78?

[asmagill]

Hmm, so the coroutine fix is also newer than our latest release... I guess it has been long enough that I had forgotten that...

And now that I recall, prior to that I hadn't made precompiled binaries for as many modules as I do now, so I don't even find one in the history that I deleted prematurely.

I've just compiled a version against the formal release and confirmed that it loads. Can't test it much further on this machine without undoing a major amount of Hammerspoon configuration, but I'll try it on another machine (that currently doesn't have Hammerspoon installed, so it will be pristine) but won't have time until later today or tomorrow. If you want to check it out sooner, visit https://github.com/asmagill/hs._asm.undocumented.spaces and download spaces-v0.2.release.tar.gz.

---

I get it about spending time on other projects... I recently purchased a 3d printer and am still in the tweaking/honeymoon phase, and I'm restoring an old Heathkit Hero JR RT-1, so... a bit distracted myself 😁 But I'm trying to avoid the long separation from Hammerspoon that I went through last year by poking at it at least once a week... I'm mostly succeeding 😜

[snowe2010]

I recently purchased a 3d printer ... But I'm trying to avoid the long separation from Hammerspoon that I went through last year by poking at it at least once a week

Good luck 😂

---

Anyway, so I should try replacing my module with the new v0.2 release you provided?

[cmsj]

@snowe2010 give that a try, and if it still doesn't load, I'll sign it.

[snowe2010]

@cmsj @asmagill Still doesn't load. Same error.

[cmsj]

@snowe2010 try this signed version:

internal.so.zip

@asmagill if this works, you're welcome to put this in your repo, and if you want me to sign any other modules, just let me know :)

[snowe2010]

@cmsj hm. now I'm getting

"internal.so" can't be opened because Apple cannot check it for malicious software.
This software needs to be updated. Contact the developer for more information.

Tried holding option/command/control (each separately) and right-clicking then Open but same error no matter what.

[cmsj]

ugh, that's because it's not notarized and I don't think I'm allowed to upload a standard .so for that :/

[snowe2010]

so @asmagill will need to do something?

[cmsj]

Unfortunately there's nothing he can do, only I can get the app notarised, because it's signed by my developer account. I'll look into whether I can figure another way around this

[asmagill]

How does Homebrew install Hammerspoon? I tested loading against the application in the zip file found at https://github.com/Hammerspoon/hammerspoon/releases/tag/0.9.78 and had no issues with loading the module.

[snowe2010]

Here's the code for the cask, I will try uninstalling and reinstalling. Maybe something got borked in my setup.

https://github.com/Homebrew/homebrew-cask/blob/master/Casks/hammerspoon.rb

[snowe2010]

@asmagill using your newest spaces zip? I installed straight from github (no brew) and still get the same error using the newer internal.so

[asmagill]

The only other thing I can think of at the moment is to check your settings in the Security & Privacy preferences panel... is "Allow apps downloaded from:" set to "App store and identified developers"?

And maybe under the same preferences panel, check the "Privacy" tab and check under "Full Disk Access" for Hamemrspoon. If its not there, you might be able to add it with the "+" button (and then fully restart Hammerspoon to make sure it takes effect).

Otherwise, I'm going to have to think and probably defer to @cmsj's expertise since he's the one with the cert and experience in this area... even if I get one (which I'm considering), it will take some time for me to fully understand what it can and can't do wrt Hammerspoon.

[snowe2010]

thanks for all the help. I've had to approve a lot of stuff in that spot, no clue why I didn't go look there for this one...

[cmsj]

Glad we got it figured out. I would not have thought to look there for approving a dylib!