Julia: mac binaries not codesigned for 1.2

[ViralBShah]

The mac binaries are not code signed for 1.2. I believe the 1.3 binaries for mac are also not code signed.

@ararslan suggests that in the builder, we should probably error out if the code signing step fails (or have some other solution to make mac signing more robust).

[dgleich]

Note that this throws an "unidentified developer" error on macOS, which is what I was googling and searching for to see if anyone had reported this already. (https://discourse.julialang.org/t/julia-1-2-not-signed-correctly-on-macos/28396)

More specifically, the full error is (for future Google-ability)

“Julia-1.2” can’t be opened because it is from an unidentified developer.

Your security preferences allow installation of only apps from the App Store and identified developers.

Also, note that you can still launch Julia by using Finder to browse to the Applications directory. Then right click on Julia, and click Open. This will allow you to override the unidentified developer prompt.

---

For what it's worth, I agree with erroring in the build if this fails. There have been enough man-in-the-middle attacks on open source projects on various platforms (e.g. look at the Handbrake scenario a few years ago -- https://blog.malwarebytes.com/threat-analysis/mac-threat-analysis/2017/05/handbrake-hacked-to-drop-new-variant-of-proton-malware/), that this really did make me worry I had a tampered download.

[ararslan]

Apparently the issue is that our code signing certificate expired.

[ViralBShah]

Cc @mdpradeep

[ViralBShah]

@staticfloat @ararslan Please close this if new signed binaries are up.

[ViralBShah]

The 1.0.5 binaries also say "can't be opened because it is from an unidentified developer".

[ararslan]

That's bizarre, because I checked the signing for 1.0.5 before uploading. 😕

[staticfloat]

Did you clear the fastly cache? The curl -X PURGE thing?

On Sat, Sep 14, 2019 at 09:04 Alex Arslan [e-mail] wrote:

That's bizarre, because I checked the signing for 1.0.5 before uploading.
😕

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/JuliaLang/julia/issues/33141?email_source=notifications&email_token=AAA762AHBKEX5NPRMRETEDTQJUDPJA5CNFSM4ITDVFVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6W6UXQ#issuecomment-531491422,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAA762FRU3OAN2LQRSKNEDLQJUDPJANCNFSM4ITDVFVA
.

[ararslan]

I did for all 1.0-latest URLs, yeah

[staticfloat]

Okay, I think I uploaded the unsigned 1.0.5 after signing it. I've re-uploaded a properly signed .dmg; try again.

[mbauman]

This is now fixed — both the 1.0 and 1.2 binaries are properly signed (but folks on 10.15 Catalina will start seeing issue #33331).

[conradwt]

I just tried it with Julia 1.3.0 and it does not work at this time. Does the Julia Core Team have a long term strategy to properly sign these application bundles for macOS 10.15 and newer because I really don't like clicking Open Anyway?

[ararslan]

@conradwt, that's https://github.com/JuliaLang/julia/issues/33331. See discussion there for details.