Howdy all,
The newest version of macOS, 10.15 "Catalina", is out and with it comes a new "Notarization" requirement for applications, etc:
https://developer.apple.com/documentation/xcode/notarizing_your_app_before_d... https://developer.apple.com/documentation/xcode/notarizing_your_app_before_distribution?language=objc
As far as I can tell, applications do not need to be built via Xcode, but need to be screened and Notarized by Apple. I'm not 100% certain if this applies only to applications signed by a Developer ID or for *all* applications. Regardless of whether we approve of this security step or not (I don't), the practical matter is that Pd *may* suddenly not run for users on 10.15 as it is not notarized or signed. OTOH software that is not signed and is installed "from the wild" *may* still be launched via Right Click -> Open on first run... although I'm not sure.
Apple has made the Notarization requirement optional until January 2020 to ease the transition.
At this point, it would be helpful to hear from someone who has the new OS if Pd runs and if there are any warning dialogs.
In the worst case, we will need an Apple developer account ($100 a year) to signed Pd for distribution and notarization. This also requires using the Xcode 10+ developer tools which rules out Miller's 10.6 build system for this step. it could be integrated as a makefile step. I have a dev account and can do some testing, when needed.
In the best case, Right Click -> Open on first run still works. :)
-------- Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
I could try and install it in a new partition and check it out, but it'll have to wait at least 10 days ;)
Em ter, 8 de out de 2019 às 04:46, Dan Wilcox danomatika@gmail.com escreveu:
Howdy all,
The newest version of macOS, 10.15 "Catalina", is out and with it comes a new "Notarization" requirement for applications, etc:
https://developer.apple.com/documentation/xcode/notarizing_your_app_before_d...
As far as I can tell, applications do not need to be built via Xcode, but need to be screened and Notarized by Apple. I'm not 100% certain if this applies only to applications signed by a Developer ID or for *all* applications. Regardless of whether we approve of this security step or not (I don't), the practical matter is that Pd *may* suddenly not run for users on 10.15 as it is not notarized or signed. OTOH software that is not signed and is installed "from the wild" *may* still be launched via Right Click -> Open on first run... although I'm not sure.
Apple has made the Notarization requirement optional until January 2020 to ease the transition.
At this point, it would be helpful to hear from someone who has the new OS if Pd runs and if there are any warning dialogs.
In the worst case, we will need an Apple developer account ($100 a year) to signed Pd for distribution and notarization. This also requires using the Xcode 10+ developer tools which rules out Miller's 10.6 build system for this step. it could be integrated as a makefile step. I have a dev account and can do some testing, when needed.
In the best case, Right Click -> Open on first run still works. :)
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com robotcowboy.com
Pd-dev mailing list Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
Hi there,
I have been running the 10.15 beta for the past while and I have no problems running Pd; I usually launch it from the command line, I can’t remember if I had to do anything extra in the Security System Preferences to get it running the first time or not.
-Chris
On Oct 8, 2019, at 5:45 AM, Dan Wilcox danomatika@gmail.com wrote:
Howdy all,
The newest version of macOS, 10.15 "Catalina", is out and with it comes a new "Notarization" requirement for applications, etc:
https://developer.apple.com/documentation/xcode/notarizing_your_app_before_d... https://developer.apple.com/documentation/xcode/notarizing_your_app_before_distribution?language=objc
As far as I can tell, applications do not need to be built via Xcode, but need to be screened and Notarized by Apple. I'm not 100% certain if this applies only to applications signed by a Developer ID or for *all* applications. Regardless of whether we approve of this security step or not (I don't), the practical matter is that Pd *may* suddenly not run for users on 10.15 as it is not notarized or signed. OTOH software that is not signed and is installed "from the wild" *may* still be launched via Right Click -> Open on first run... although I'm not sure.
Apple has made the Notarization requirement optional until January 2020 to ease the transition.
At this point, it would be helpful to hear from someone who has the new OS if Pd runs and if there are any warning dialogs.
In the worst case, we will need an Apple developer account ($100 a year) to signed Pd for distribution and notarization. This also requires using the Xcode 10+ developer tools which rules out Miller's 10.6 build system for this step. it could be integrated as a makefile step. I have a dev account and can do some testing, when needed.
In the best case, Right Click -> Open on first run still works. :)
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Pd-dev mailing list Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
Once you install the release version, can you test with a newer Pd build? Perhaps Pd-0.50.1-netobject-updates.zip http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50.1-netobject-updates.zip.
On Oct 8, 2019, at 9:46 PM, Chris Niven cjniven@gmail.com wrote:
Hi there,
I have been running the 10.15 beta for the past while and I have no problems running Pd; I usually launch it from the command line, I can’t remember if I had to do anything extra in the Security System Preferences to get it running the first time or not.
-Chris
On Oct 8, 2019, at 5:45 AM, Dan Wilcox <danomatika@gmail.com mailto:danomatika@gmail.com> wrote:
Howdy all,
The newest version of macOS, 10.15 "Catalina", is out and with it comes a new "Notarization" requirement for applications, etc:
https://developer.apple.com/documentation/xcode/notarizing_your_app_before_d... https://developer.apple.com/documentation/xcode/notarizing_your_app_before_distribution?language=objc
As far as I can tell, applications do not need to be built via Xcode, but need to be screened and Notarized by Apple. I'm not 100% certain if this applies only to applications signed by a Developer ID or for *all* applications. Regardless of whether we approve of this security step or not (I don't), the practical matter is that Pd *may* suddenly not run for users on 10.15 as it is not notarized or signed. OTOH software that is not signed and is installed "from the wild" *may* still be launched via Right Click -> Open on first run... although I'm not sure.
Apple has made the Notarization requirement optional until January 2020 to ease the transition.
At this point, it would be helpful to hear from someone who has the new OS if Pd runs and if there are any warning dialogs.
In the worst case, we will need an Apple developer account ($100 a year) to signed Pd for distribution and notarization. This also requires using the Xcode 10+ developer tools which rules out Miller's 10.6 build system for this step. it could be integrated as a makefile step. I have a dev account and can do some testing, when needed.
In the best case, Right Click -> Open on first run still works. :)
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Pd-dev mailing list Pd-dev@lists.iem.at mailto:Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
-------- Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Will do, downloading it right now.
On Oct 10, 2019, at 10:10 AM, Dan Wilcox danomatika@gmail.com wrote:
Once you install the release version, can you test with a newer Pd build? Perhaps Pd-0.50.1-netobject-updates.zip http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50.1-netobject-updates.zip.
On Oct 8, 2019, at 9:46 PM, Chris Niven <cjniven@gmail.com mailto:cjniven@gmail.com> wrote:
Hi there,
I have been running the 10.15 beta for the past while and I have no problems running Pd; I usually launch it from the command line, I can’t remember if I had to do anything extra in the Security System Preferences to get it running the first time or not.
-Chris
On Oct 8, 2019, at 5:45 AM, Dan Wilcox <danomatika@gmail.com mailto:danomatika@gmail.com> wrote:
Howdy all,
The newest version of macOS, 10.15 "Catalina", is out and with it comes a new "Notarization" requirement for applications, etc:
https://developer.apple.com/documentation/xcode/notarizing_your_app_before_d... https://developer.apple.com/documentation/xcode/notarizing_your_app_before_distribution?language=objc
As far as I can tell, applications do not need to be built via Xcode, but need to be screened and Notarized by Apple. I'm not 100% certain if this applies only to applications signed by a Developer ID or for *all* applications. Regardless of whether we approve of this security step or not (I don't), the practical matter is that Pd *may* suddenly not run for users on 10.15 as it is not notarized or signed. OTOH software that is not signed and is installed "from the wild" *may* still be launched via Right Click -> Open on first run... although I'm not sure.
Apple has made the Notarization requirement optional until January 2020 to ease the transition.
At this point, it would be helpful to hear from someone who has the new OS if Pd runs and if there are any warning dialogs.
In the worst case, we will need an Apple developer account ($100 a year) to signed Pd for distribution and notarization. This also requires using the Xcode 10+ developer tools which rules out Miller's 10.6 build system for this step. it could be integrated as a makefile step. I have a dev account and can do some testing, when needed.
In the best case, Right Click -> Open on first run still works. :)
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Pd-dev mailing list Pd-dev@lists.iem.at mailto:Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev https://lists.puredata.info/listinfo/pd-dev
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Just got 10.15 installed and I did get the initial warning about Apple not being able to verify the software, but right clicking and selecting Open works fine for me.
On Oct 10, 2019, at 10:10 AM, Dan Wilcox danomatika@gmail.com wrote:
Once you install the release version, can you test with a newer Pd build? Perhaps Pd-0.50.1-netobject-updates.zip http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50.1-netobject-updates.zip.
On Oct 8, 2019, at 9:46 PM, Chris Niven <cjniven@gmail.com mailto:cjniven@gmail.com> wrote:
Hi there,
I have been running the 10.15 beta for the past while and I have no problems running Pd; I usually launch it from the command line, I can’t remember if I had to do anything extra in the Security System Preferences to get it running the first time or not.
-Chris
On Oct 8, 2019, at 5:45 AM, Dan Wilcox <danomatika@gmail.com mailto:danomatika@gmail.com> wrote:
Howdy all,
The newest version of macOS, 10.15 "Catalina", is out and with it comes a new "Notarization" requirement for applications, etc:
https://developer.apple.com/documentation/xcode/notarizing_your_app_before_d... https://developer.apple.com/documentation/xcode/notarizing_your_app_before_distribution?language=objc
As far as I can tell, applications do not need to be built via Xcode, but need to be screened and Notarized by Apple. I'm not 100% certain if this applies only to applications signed by a Developer ID or for *all* applications. Regardless of whether we approve of this security step or not (I don't), the practical matter is that Pd *may* suddenly not run for users on 10.15 as it is not notarized or signed. OTOH software that is not signed and is installed "from the wild" *may* still be launched via Right Click -> Open on first run... although I'm not sure.
Apple has made the Notarization requirement optional until January 2020 to ease the transition.
At this point, it would be helpful to hear from someone who has the new OS if Pd runs and if there are any warning dialogs.
In the worst case, we will need an Apple developer account ($100 a year) to signed Pd for distribution and notarization. This also requires using the Xcode 10+ developer tools which rules out Miller's 10.6 build system for this step. it could be integrated as a makefile step. I have a dev account and can do some testing, when needed.
In the best case, Right Click -> Open on first run still works. :)
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Pd-dev mailing list Pd-dev@lists.iem.at mailto:Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev https://lists.puredata.info/listinfo/pd-dev
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
I just discovered the huge headache of the notarization system under Catalina: the OS will prevent loading of every non-notarized *external* that you try to load. This appears to be a 3-part ordeal per external:
macOS’ first message is thrown the first time you open a patch with a non-notarized external:
“myexternal~.pd_darwin” cannot be opened because the developer cannot be verified. macOS cannot verify that this app is free from malware.
The buttons accompanying this message are Move to Trash (!) and Cancel.
There are probably other ways, but to fix this, I had to go to System Preferences > Security & Privacy and click the button that allows authorization for the last binary that was prevented from launching.
I then had to quit and restart Pd. Opening a patch containing the offending external, I’m greeted with an error message similar to the first:
macOS cannot verify the developer of “myexternal~.pd_darwin”. Are you sure you want to open it? By opening this app, you will be overriding system security which can expose your computer and personal information to malware that may harm your Mac or compromise your privacy.
You get Move to Trash, Open, and Cancel buttons this time. If you say Open, your external is allowed to load from this point on. But note that you have to do this 3-step process for every external, and only at the time that they’re first loaded, meaning we’re going to have to go through this whenever we first load up some old patch with a (64-bit) external we haven’t used in a while : \
Kevin
On Oct 8, 2019, at 2:45 AM, Dan Wilcox danomatika@gmail.com wrote:
Howdy all,
The newest version of macOS, 10.15 "Catalina", is out and with it comes a new "Notarization" requirement for applications, etc:
https://developer.apple.com/documentation/xcode/notarizing_your_app_before_d... https://developer.apple.com/documentation/xcode/notarizing_your_app_before_distribution?language=objc
As far as I can tell, applications do not need to be built via Xcode, but need to be screened and Notarized by Apple. I'm not 100% certain if this applies only to applications signed by a Developer ID or for *all* applications. Regardless of whether we approve of this security step or not (I don't), the practical matter is that Pd *may* suddenly not run for users on 10.15 as it is not notarized or signed. OTOH software that is not signed and is installed "from the wild" *may* still be launched via Right Click -> Open on first run... although I'm not sure.
Apple has made the Notarization requirement optional until January 2020 to ease the transition.
At this point, it would be helpful to hear from someone who has the new OS if Pd runs and if there are any warning dialogs.
In the worst case, we will need an Apple developer account ($100 a year) to signed Pd for distribution and notarization. This also requires using the Xcode 10+ developer tools which rules out Miller's 10.6 build system for this step. it could be integrated as a makefile step. I have a dev account and can do some testing, when needed.
In the best case, Right Click -> Open on first run still works. :)
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Pd-dev mailing list Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
We might need to add an entitlements file which specifies which things are "allowed," one of which is loading non-signed external libs. I ran into this with a project at work which uses libpd and loads a couple externals.
On Dec 11, 2019, at 9:56 PM, Kevin Haywood khaywood@ucsd.edu wrote:
I just discovered the huge headache of the notarization system under Catalina: the OS will prevent loading of every non-notarized *external* that you try to load. This appears to be a 3-part ordeal per external:
macOS’ first message is thrown the first time you open a patch with a non-notarized external:
“myexternal~.pd_darwin” cannot be opened because the developer cannot be verified. macOS cannot verify that this app is free from malware.The buttons accompanying this message are Move to Trash (!) and Cancel.
There are probably other ways, but to fix this, I had to go to System Preferences > Security & Privacy and click the button that allows authorization for the last binary that was prevented from launching.
I then had to quit and restart Pd. Opening a patch containing the offending external, I’m greeted with an error message similar to the first:
macOS cannot verify the developer of “myexternal~.pd_darwin”. Are you sure you want to open it? By opening this app, you will be overriding system security which can expose your computer and personal information to malware that may harm your Mac or compromise your privacy.You get Move to Trash, Open, and Cancel buttons this time. If you say Open, your external is allowed to load from this point on. But note that you have to do this 3-step process for every external, and only at the time that they’re first loaded, meaning we’re going to have to go through this whenever we first load up some old patch with a (64-bit) external we haven’t used in a while : \
Kevin
-------- Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Looks like the solution (as listed at https://cutecoder.org/programming/shared-framework-hardened-runtime/ https://cutecoder.org/programming/shared-framework-hardened-runtime/) is either:
1. sign the Pd app and disable plugin validation; or 2. use externals built for a min version of macOS 10.9
I've tried option 1 by "ad-goc" signing Millers Pd 0.50-2 build with the library validation entitlement disabled:
http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50-2-signed.zip http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50-2-signed.zip
Please test.
On Dec 11, 2019, at 11:23 PM, Dan Wilcox danomatika@gmail.com wrote:
We might need to add an entitlements file which specifies which things are "allowed," one of which is loading non-signed external libs. I ran into this with a project at work which uses libpd and loads a couple externals.
On Dec 11, 2019, at 9:56 PM, Kevin Haywood <khaywood@ucsd.edu mailto:khaywood@ucsd.edu> wrote:
I just discovered the huge headache of the notarization system under Catalina: the OS will prevent loading of every non-notarized *external* that you try to load. ...
-------- Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
That appears to work!
I opened patches with a couple of older dsp externals that I hadn’t validated yesterday, and they all ran fine. Only got this message upon launch of your app, which I guess is just the Catalina version of this old message, since it could be bypassed as before by launching the app with a right-click and choosing “Open”:
“Pd-0.50-2-signed” can’t be opened because Apple cannot check it for malicious software. This software needs to be updated. Contact the developer for more information.
Kevin
On Dec 12, 2019, at 2:58 AM, Dan Wilcox danomatika@gmail.com wrote:
Looks like the solution (as listed at https://cutecoder.org/programming/shared-framework-hardened-runtime/ https://cutecoder.org/programming/shared-framework-hardened-runtime/) is either:
- sign the Pd app and disable plugin validation; or
- use externals built for a min version of macOS 10.9
I've tried option 1 by "ad-goc" signing Millers Pd 0.50-2 build with the library validation entitlement disabled:
http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50-2-signed.zip http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50-2-signed.zip
Please test.
On Dec 11, 2019, at 11:23 PM, Dan Wilcox <danomatika@gmail.com mailto:danomatika@gmail.com> wrote:
We might need to add an entitlements file which specifies which things are "allowed," one of which is loading non-signed external libs. I ran into this with a project at work which uses libpd and loads a couple externals.
On Dec 11, 2019, at 9:56 PM, Kevin Haywood <khaywood@ucsd.edu mailto:khaywood@ucsd.edu> wrote:
I just discovered the huge headache of the notarization system under Catalina: the OS will prevent loading of every non-notarized *external* that you try to load. ...
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Ok cool. So the workaround is ok and can be added to the .app bundle build stage.
As for the initial app warning, as far as I can tell, the only way to remove it is to sign the app with a developer ID. This requires an account and $100 a year.
enohp ym morf tnes ----------- Dan Wilcox danomatika.com robotcowboy.com
On Dec 12, 2019, at 6:24 PM, Kevin Haywood khaywood@ucsd.edu wrote:
That appears to work!
I opened patches with a couple of older dsp externals that I hadn’t validated yesterday, and they all ran fine. Only got this message upon launch of your app, which I guess is just the Catalina version of this old message, since it could be bypassed as before by launching the app with a right-click and choosing “Open”:
“Pd-0.50-2-signed” can’t be opened because Apple cannot check it for malicious software. This software needs to be updated. Contact the developer for more information.
Kevin
On Dec 12, 2019, at 2:58 AM, Dan Wilcox danomatika@gmail.com wrote:
Looks like the solution (as listed at https://cutecoder.org/programming/shared-framework-hardened-runtime/) is either:
- sign the Pd app and disable plugin validation; or
- use externals built for a min version of macOS 10.9
I've tried option 1 by "ad-goc" signing Millers Pd 0.50-2 build with the library validation entitlement disabled:
http://docs.danomatika.com/pdbuilds/0.51/Pd-0.50-2-signed.zip
Please test.
On Dec 11, 2019, at 11:23 PM, Dan Wilcox danomatika@gmail.com wrote:
We might need to add an entitlements file which specifies which things are "allowed," one of which is loading non-signed external libs. I ran into this with a project at work which uses libpd and loads a couple externals.
On Dec 11, 2019, at 9:56 PM, Kevin Haywood khaywood@ucsd.edu wrote:
I just discovered the huge headache of the notarization system under Catalina: the OS will prevent loading of every non-notarized *external* that you try to load. ...
Dan Wilcox @danomatika danomatika.com robotcowboy.com
On 12.12.19 18:40, Dan Wilcox wrote:
As for the initial app warning, as far as I can tell, the only way to remove it is to sign the app with a developer ID. This requires an account and $100 a year.
Unfortunately there are some more hidden costs: One also needs a Mac for the XCode toolchain. For the payment you need enable two-factor authorization in your account (for which you need an iPhone) Both devices need to run recent OS versions, so they can't be hardware which Apple deprecated. If you register a "corporate" account with apple you will have to apply for a D.U.N.S Number. If you live in Germany, Dun & Bradstreet will sell your Address Data to the GEZ and you'll have to pay another 69,96 Euros a year for public radio and TV.
Think Different! :D
-
Alexandre Torres Porres -
Chris Niven -
Dan Wilcox -
Kevin Haywood -
Max