Unsigned/Self-Signed App Permissions

[rothnd]

Hello all. I am using some 3rd party software that is unsigned on my Mac. The developer’s install notes say to self-sign it with: codesign --force --deep -s - /Applications/AppName.app && xattr -rd com.apple.quarantine /Applications/AppName.app

This works fine except I’m getting double permissions requests. Once on initial start and again (same request) on handling/moving a file from my Downloads folder. This is despite giving the app Full Disk Access. Any ideas? Am I missing something? Thanks!

 

[bogdanw]

Apple’s support page “If you want to open an app that hasn’t been notarized or is from an unidentified developer”https://support.apple.com/HT202491

If you are sure that the app is not malware, you can remove the quarantine attribute, then sign it.

xattr -rd com.apple.quarantine /Applications/AppName.app

codesign --force --deep --sign - /Applications/AppName.app

codesign documentation
https://developer.apple.com/library...l/CodeSigningGuide/Procedures/Procedures.html
https://keith.github.io/xcode-man-pages/codesign.1.html

If it is publicly available, please share the link for that app.

 

[rothnd]

Hello all. I am using some 3rd party software that is unsigned on my Mac. The developer’s install notes say to self-sign it with: codesign --force --deep -s - /Applications/AppName.app && xattr -rd com.apple.quarantine /Applications/AppName.app

This works fine except I’m getting double permissions requests. Once on initial start and again (same request) on handling/moving a file from my Downloads folder. This is despite giving the app Full Disk Access. Any ideas? Am I missing something? Thanks!

Thanks for the pretty organization of the commands I already stated I use.

 

[thebart]

Thanks for the pretty organization of the commands I already stated I use.

The command given is different from yours. Different order and no -s flag

 

[rothnd]

The command given is different from yours. Different order and no -s flag

Ah yes, I missed that, I’m sorry! OK cool. The apps are the Starr suite - basically any app from: https://wiki.servarr.com/

 

[bogdanw]

I’ve just tried Radarr in Sonoma and Apple’s instructions work, no need for Terminal commands.
“you can control-click the app, choose Open from the menu, then click Open in the dialog that appears.”

If Full Disk Access doesn’t work as expected for an app, you could reset it from Terminal for the app or for all the apps, then grant the permission again.

Reset for Radarr

tccutil reset SystemPolicyAllFiles com.osx.radarr.video

reset for all apps that have been granted Full Disk Access

tccutil reset SystemPolicyAllFiles

 

[rothnd]

No kidding? That is very nice! And very appreciated!
So the usual right-click truck will handle ordinary opening/running - what about the oddities of app updates? The updates seem to go through but they fail when trying to restart the app..

 

[rothnd]

Also, just so I understand you, these terminal commands - specifically the one that says to ‘sign’ it - that’s not necessary if the secondary open thing works?

 

[bogdanw]

The updates seem to go through but they fail when trying to restart the app..

Do the apps auto-update? Just right-click & open the app after the update.

Also, just so I understand you, these terminal commands - specifically the one that says to ‘sign’ it - that’s not necessary if the secondary open thing works?

Yes, the Terminal commands are not necessary, just right-click & open the app.
I’ve just tried Lidarr in Sonoma 14.3 and it works in this way.
And you don’t have to give Full Disk Access to the app. Use the “Add Root Folder” menu to select the media folder(s). If required, you will be asked to give permission for access.

 

[rothnd]

Do the apps auto-update? Just right-click & open the app after the update.

They should but I can't seem to get it to go through. Thanks for looking at this! Here's some 'extra' instructions if you want to research the update mechanism.
Radarr for example. When you download from the servarr wiki you're getting the 'master' branch. If you install this and then go into Settings<General (Show Advanced at top) you can change the Branch to something updated more frequently e.g. nightly, click save, go to System<Updates, this page will tell you what's new/version/etc. You should be able to just click a button to update from there but when I do it gets to its last stage (restarting) and doesn't do the restart so the update doesn't take.

 

[bogdanw]

I don’t have time right now for more tests, but the links from wiki.servarr.com redirect to github, so you can get previous, and obviously latest , versions of the apps from there. Radarr https://github.com/Radarr/Radarr/releases

 

[rothnd]

Yea I'm aware how to do the manuals 👍. Just trying to 'automate' this supposedly 'automated' software.

 

[bogdanw]

My point was to use a previous release to troubleshoot automatic updates. But it seems to be a known problem on macOS https://github.com/Radarr/Radarr/issues/4535 and ad-hoc signing should fix it.

 

[rothnd]

Ah. I see. Yes it’s known, I’ve been all over the discord for this kind of stuff. I noticed this (attached picture). What do you think of running this command for the suggested ‘self-sign’? Looks like this command is more like yours (—sign) but is directed inside the app instead of the ‘whole’ app.. Is this what you mean when you say ‘ad-hoc signing’? Thank you!

 

[rothnd]

And, I'm not saying it 'known' to be a jerk. Just saying that Mac stuff is not given much attention on their end. Every time I bring it up on the discord I get "well get better hardware'...

 

[bogdanw]

The updated components are not signed and may lead to errors.
I think you should re-sign after every update the whole app, not just the executable as in the image.

codesign --force --deep --sign - /Applications/Radarr.app

Don’t use sudo, as it might fail to update.

 

[rothnd]

Sounds like sound advice! I’ll let ya know if I see anything odd down the road. Thanks!

 

[arinamichel911]

Reset the permissions on the app and then reinstall it. Might be it works