NVidia WebDriver-387.10.10.10.40.140 Signature/Certificate invalid. GPU Kexts unable to install/load.

[Ashok.Vardhan]

Those coming in now to find a solution try these steps:

1. Download the GPU & CUDA Driver combo FullerFun shared in post #602: https://forums.macrumors.com/thread...idia-webdrivers-anymore.2346445/post-31186645

2. Boot into Safe Mode by holding SHIFT during the boot up process.

3. Open System Preferences.

4. Open "NVIDIA Driver Manager" to uninstall your existing GPU driver. If "NVIDIA Driver Manager" preference pane opens proceed to step 5. If not go to step 6.

5. Once you enter "NVIDIA Driver Manager" preference pane, on the lower right hand corner you will find the "Open Uninstaller" button. Click that, and follow its instruction to uninstall your GPU driver. Proceed to step. 8.

6. If you get an error message asking you to reinstall the driver, then it means that the certificate is revoked and macOS is unable to load the associated files. You will have to manually uninstall your GPU driver (proceed from step 7 for that).

7. Open Terminal (found under "utilities" in your applications folder) and run the following commands to manually uninstall GPU driver:

(a) pkgutil --expand /Library/PreferencePanes/NVIDIA\ Driver\ Manager.prefPane/Contents/MacOS/NVIDIA\ Web\ Driver\ Uninstaller.app/Contents/Resources/NVUninstall.pkg /tmp/foo

(b) sudo /tmp/foo/Scripts/postinstall 0 0 /
(c) Enter your password when prompted. Wait for the process to complete.

8. Uninstall your existing certificate revoked CUDA drivers.

(a) Here are some typical CUDA driver uninstallation steps. You will have to run these commands in Terminal (found under "utilities" in your applications folder):

How to remove CUDA driver:

Type each command in the Terminal (when prompted enter your password):

• sudo rm -rf /Library/Extensions/CUDA.kext
• sudo rm -rf /Library/Frameworks/CUDA.framework
• sudo rm -rf /Library/LaunchAgents/com.nvidia.CUDASoftwareUpdate.plist
• sudo rm -rf /System/Library/StartupItems/CUDA
• sudo rm -rf /usr/local/cuda

How to remove CUDA preference pane:

1. Open System Preferences.
2. Right-click on CUDA.
3. Click Remove CUDA Preference pane.

(b) Refer to the "uninstall" notes, which are contained in the "installation guide" for your respective version in the archive here: https://developer.nvidia.com/cuda-toolkit-archive

For example, for version 10.2 this is the link: https://docs.nvidia.com/cuda/archive/10.2/cuda-installation-guide-mac-os-x/index.html#uninstall

(c) Or search on Google for an appropriate tutorial to manually uninstall your CUDA driver. (What I have observed is that any driver (GPU or CUDA) once their certificates are revoked, their respective uninstallers--which might have been installed during the past installation process--might not work. You have to go about the process manually using terminal and/or finder, or a combination of both.)

9. Install the GPU & CUDA Driver combo downloaded in step-1.

10. Reboot (into normal mode)

11. Most likely everything should work fine.

Enjoy!



Original Post:

Since June 01st the drivers for my Titan-X (Maxwell) PCI-e GPU were not working anymore. When I tried to reinstall using WebDriver-387.10.10.10.40.140 it appears that the certificate is not valid anymore.

The preference pane panels for both CUDA and NVIDIA Driver Manager were not working:

I managed to reinstall CUDA drivers by using the following commands in terminal on the CUDAMacOSXInstaller.app file:

sudo spctl --master-disable
sudo codesign --force --deep --sign - /Users/AshokVardhan/Desktop/CUDAMacOSXInstaller.app
xattr -cr /Users/AshokVardhan/Desktop/CUDAMacOSXInstaller.app

However, the same procedure was not working for WebDriver-387.10.10.10.40.140.pkg file.

Initially it would give the error message:

Once I performed these actions in terminal:


sudo spctl --master-disable
sudo codesign --force --deep --sign - /Users/AshokVardhan/Desktop/WebDriver-387.10.10.10.40.140.pkg
xattr -cr /Users/AshokVardhan/Desktop/WebDriver-387.10.10.10.40.140.pkg

The installer starts to run, however, during the last step it fails and this the error message I am getting:

SIP was disabled in recovery mode using Command-R during bootup by using this command in terminal:

csrutil disable

How do I fix this??

The drivers were working fine till the end of May, 2022. No changes were done to the system.

Thanks in advance.

 

[nikolaidc]

Hey, I have the same issue. I just contacted nvidia live chat about it, customer care told me to wait 24 hours and I'll get a reply in email.

 

[bogdanw]

Repack it:

pkgutil --expand ~/Desktop/WebDriver-387.10.10.10.40.140.pkg ~/Desktop/WebDriver_temp

pkgutil --flatten ~/Desktop/WebDriver_temp ~/Desktop/WebDriver-repack.pkg

 

[tonidrbn]

Repack it:

pkgutil --expand ~/Desktop/WebDriver-387.10.10.10.40.140.pkg ~/Desktop/WebDriver_temp

pkgutil --flatten ~/Desktop/WebDriver_temp ~/Desktop/WebDriver-repack.pkg

This made the installer work on my machine, still got a black screen with a loading circle animation after restart though.

 

[nikolaidc]

Yep, kexts still cannot load properly

 

[Ashok.Vardhan]

Yep, kexts still cannot load properly

I took all this one step further. I used Pacifist, loaded the installer into it, identified all the individual kexts and preference pane entries the installer makes.

I used the codesign command: (sudo codesign --force --deep --sign - /"Path to Kext and PreferencePane entry/) to replace the individual signatures of every kext and file installed in the various folders:

~\Library\Extensions
~\Library\PreferencePanes
~\System\Library\Extensions

Still made no difference. Something more regarding the kext signatures is happening that is beyond my current scope of understanding.

I have been reading the issues other people were having in regards to being signed out of iCloud/Apple ID and unable to use it because of related certificate issues. Wonder if both of them are related?

There seems to be solutions for the iCloud/Apple ID issue, just not sure if it will help fix this one as well.

Anyone with more deeper insight into system architecture please do comment.

The strange thing is that Pacifist shows the installer as having a valid certificate.

Individually injecting/installing them through Pacifist seems to work, however, the kexts are not loading properly once injected/installed.

The "install" option (i.e. Pacifist automated install option on top-left corner) also does not work:

So I don't know where the issue lies?

 

[bogdanw]

According to Apple, disabling SIP should allow even unsigned extensions to be loaded.
“Kernel extensions with System Integrity Protection
If System Integrity Protection (SIP) is enabled, the signature of each kext is verified before being included in the AuxKC.
If SIP is disabled, the kext signature isn’t enforced.
This approach allows Permissive Security flows for developers or users who aren’t part of the Apple Developer Program to test kexts before they are signed.”

System and kernel extensions in macOS

Kernel extensions (kexts) risk the integrity and reliability of the operating system, and so users should prefer solutions that donʼt require extending the kernel and use system extensions instead.

support.apple.com

 

[tonidrbn]

According to Apple, disabling SIP should allow even unsigned extensions to be loaded.
“Kernel extensions with System Integrity Protection
If System Integrity Protection (SIP) is enabled, the signature of each kext is verified before being included in the AuxKC.
If SIP is disabled, the kext signature isn’t enforced.
This approach allows Permissive Security flows for developers or users who aren’t part of the Apple Developer Program to test kexts before they are signed.”

System and kernel extensions in macOS

Kernel extensions (kexts) risk the integrity and reliability of the operating system, and so users should prefer solutions that donʼt require extending the kernel and use system extensions instead.

support.apple.com

I have SIP partially disabled for kexts and still doesnt work

 

[Ashok.Vardhan]

Repack it:

pkgutil --expand ~/Desktop/WebDriver-387.10.10.10.40.140.pkg ~/Desktop/WebDriver_temp

pkgutil --flatten ~/Desktop/WebDriver_temp ~/Desktop/WebDriver-repack.pkg

Tried this. Installer runs fine, however, in the last stage I get the same error I got earlier when using the codesign terminal commands:

 

[Ashok.Vardhan]

According to Apple, disabling SIP should allow even unsigned extensions to be loaded.
“Kernel extensions with System Integrity Protection
If System Integrity Protection (SIP) is enabled, the signature of each kext is verified before being included in the AuxKC.
If SIP is disabled, the kext signature isn’t enforced.
This approach allows Permissive Security flows for developers or users who aren’t part of the Apple Developer Program to test kexts before they are signed.”

System and kernel extensions in macOS

Kernel extensions (kexts) risk the integrity and reliability of the operating system, and so users should prefer solutions that donʼt require extending the kernel and use system extensions instead.

support.apple.com

I had a feeling someone would indicate this to me.

In my initial post I had forgotten to indicate it (now I have updated it). I thought disabling SIP should do it too.

The terminal "codesign" method, Pacifist method and your "pkgutil" method were all performed when SIP was disabled:

Still made no difference?

 

[flyproductions]

I also started a thread to this topic. Experiencing all the same probs. Tried a different "solution" by unsigning each and everything in the more os independent 387.10.10.15.15.108 package and installing manually. Also blocked one attempt of NV calling home with little snitch.

All with no success. How can one company suck so big? We all have payed hundreds of bucks for our cards and now they are all "expired" if this can not be fixed.

 

[CobMac]

I also started a thread to this topic. Experiencing all the same probs. Tried a different "solution" by unsigning each and everything in the more os independent 387.10.10.15.15.108 package and installing manually. Also blocked one attempt of NV calling home with little snitch.

All with no success. How can one company suck so big? We all have payed hundreds of bucks for our cards and now they are all "expired" if this can not be fixed.

Well, lets write to Nvidia support. The more of us write them the bigger hope they fix it. I agree thats terrible, I am stucked with my only job now, hoping someone will find solution soon..

 

[flyproductions]

I had a feeling someone would indicate this to me.

Yes, SIP ist disabled, gatekeeper too. These are the first things to do in cases like this.

 

[flyproductions]

I also tried removing all the "Apple"-NV-drivers only keeping what the webdriver package installs. Also with no success.

 

[Ammok]

I have the same problem (High Sierra)

 

[bogdanw]

387.10.10.15.15.108 package and installing manually.

What happens when you use kextload? Any error message?

 

[tonidrbn]

What happens when you use kextload? Any error message?

 

[bogdanw]

Anyone tried to remove the signature with codesign --remove-signature?

 

[Ashok.Vardhan]

Also blocked one attempt of NV calling home with little snitch.

Now that you mention Little Snitch, I am wondering if being connected to the internet is making the difference. Let me explain why.

I wiped out the OS drive and restored a previously working CC image on the system drive. For this process, I had removed the LAN cable, which falls short when the system is laid flat on the table to access GPUs, to remove the Titan-X (as it was not working anymore) and install the original Apple flashed ATI Radeon HD 5770 GPU into the system.

The system booted fine into this restored image and the drivers were able to work without any issue. So I connected back the LAN cable.

Though I have Little Snitch installed, in it's rules NVidia has permission to access internet to check for updates (in retrospect I guess I should have disabled it since anyway NVidia is not releasing anything since a few years?) and I noticed after the first reboot since connecting to the internet the drivers stopped working again.

So definitely web connectivity is affecting the kexts in some way and their security certificates become "expired".

I also have a clean install image in CC for bare OS deployments (no apps--just bare macOS install). Even after this restore--while connected to the internet--the web drivers package did not install on a clean install.

Definitely web-connection has an impact on the signature/certificates expiring.

 

[tonidrbn]

Anyone tried to remove the signature with codesign --remove-signature?

 

[bogdanw]

View attachment 2012552

Disable SIP, csrutil disable, not some undocumented "partial" disable.

 

[garibaldo]

nVidia surely knows expiration date of the certification or notarial, right?

 

[Softnoise]

The same solution for 1080ti 17g14042 Nvidia web driver 10.13.6 high Sierra

 

[sv1cec]

Same issue with the original poster, but with a few more issues. I use a MacPro 5,1 with an NVidia GTX 680, running High Sierra.

Everything was working fine, until a few days ago, when Screen Sharing started showing a black screen, when connecting to other compuuters (be it other Macs or Centos machines). Screen sharing connects to the other machine, it just shows a black screen, if I grab the lower right edge of the window and pull it, the connected machine screen shows up, but then the black screen reappears, when I let go. Screen Sharing works fine from another Mac Pro 1,1 connecting to all other machines.

I had a backup boot disk from before the problem started, when I first booted from that disk, everything worked OK, so I used SuperDuper to copy it to my main boot disk. When I rebooted from the main disk again, the problem returned. Additionally, if I rebooted from the backup disk, it also does not work any more.

In addition to the Screen Sharing acting up, Google Chrome is also acting up, messing the shown web page.

I need to have my system working as before, so I would appreciate any suggestions.

P.S.: Found another backup I had, from May 28th. I copied that disk to my normal boot disk, same issues, Screen Sharing produces a black screen! How can I stop this checking?!?!?!?!?!

P.S.2: I obviously couldn't care less about Google Chrome not working, but I do care about Screen Sharing!

 

[Ashok.Vardhan]

Same issue with the original poster, but with a few more issues. I use a MacPro 5,1 with an NVidia GTX 680, running High Sierra.

There is another active thread with some solutions there, not sure which ones are "permanent", do check it out and try them to see if they help your situation:

https://forums.macrumors.com/threads/cannot-install-or-use-nvidia-webdrivers-anymore.2346445/