Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

macOS 64 bit Version: 7.0.1 of Daedalus Wallet not working on Big Sur version 11.7.10 #3263

Open
kirk-bit opened this issue Dec 11, 2024 · 21 comments
Open

macOS 64 bit Version: 7.0.1 of Daedalus Wallet not working on Big Sur version 11.7.10 #3263

kirk-bit opened this issue Dec 11, 2024 · 21 comments

Comments

@kirk-bit
Copy link

macOS 64-bit Version: 7.0.1 of Daedalus Wallet not working on Big Sur version 11.7.10

Model: 2019 MacBookPro 16
Memory: 16 GB
Processor Name: 8-Core Intel Core i9
Processor Speed: 2.3 GHz
Free Space: 725 GB

Please see the attached error msg

Screen Shot 2024-12-11 at 4 43 30 PM
@michalrus
Copy link
Member

Hey @kirk-bit,

we received a few more reports about this. Apparently, the code signature is not trusted on older macOS. We're probably missing a few certs in the certificate chain used for codesigning.

As a workaround, you can hold the Option key, and right click on the installer, and select "Open", and then trust it. There are no reports from newer macOS, so that's some assurance for you, that it's not malicious.

Would you like to help me investigate? 🤲

If so, could you run these commands on the PKG file in a terminal? I'm assuming the installer is in ~/Downloads/, but please adjust if needed:

❯ cd ~/Downloads/

❯ shasum -a256 daedalus-7.0.1-71715-mainnet-28179e85e-x86_64-darwin.pkg

❯ pkgutil --check-signature daedalus-7.0.1-71715-mainnet-28179e85e-x86_64-darwin.pkg

The SHA-256 sum is just to make sure there was no download error, but I'm more interested in the --check-signature output, i.e. why doesn’t your system trust our signature.

@Nearrain
Copy link

Nearrain commented Dec 19, 2024 •
edited
Loading

Hi,
I have the same problem.
I can't get the "trust" option to code signature to be trusted on my computer.
can you describe procedure if this is the solution of the problem.

thank you

Hey @kirk-bit,

we received a few more reports about this. Apparently, the code signature is not trusted on older macOS. We're probably missing a few certs in the certificate chain used for codesigning.

As a workaround, you can hold the Option key, and right click on the installer, and select "Open", and then trust it. There are no reports from newer macOS, so that's some assurance for you, that it's not malicious.

Would you like to help me investigate? 🤲

If so, could you run these commands on the PKG file in a terminal? I'm assuming the installer is in ~/Downloads/, but please adjust if needed:

❯ cd ~/Downloads/

❯ shasum -a256 daedalus-7.0.1-71715-mainnet-28179e85e-x86_64-darwin.pkg

❯ pkgutil --check-signature daedalus-7.0.1-71715-mainnet-28179e85e-x86_64-darwin.pkg

The SHA-256 sum is just to make sure there was no download error, but I'm more interested in the --check-signature output, i.e. why doesn’t your system trust our signature.

@kirk-bit
Copy link
Author

kirk-bit commented Dec 19, 2024 via email

@Nearrain
Copy link

is that just decription of the problem, or solution ?

@kirk-bit
Copy link
Author

kirk-bit commented Dec 19, 2024 via email

@kirk-bit
Copy link
Author

kirk-bit commented Dec 19, 2024 via email

@Nearrain
Copy link

did you managed to solve the problem ?

@kirk-bit
Copy link
Author

kirk-bit commented Dec 19, 2024 via email

@michalrus
Copy link
Member

Okay, thanks for confirming this, so for some reason, the output of pkgutil --check-signature is missing the following line on your macOS:

   Notarization: trusted by the Apple notary service

That's why the trust error is shown. For reference, here's my output (on macOS Sequoia 15.2):

❯ pkgutil --check-signature daedalus-7.0.2-71760-mainnet-331049f3e-x86_64-darwin.pkg 
Package "daedalus-7.0.2-71760-mainnet-331049f3e-x86_64-darwin.pkg":
   Status: signed by a developer certificate issued by Apple for distribution
   Notarization: trusted by the Apple notary service
   Signed with a trusted timestamp on: 2024-12-12 14:16:59 +0000
   Certificate Chain:
    1. Developer ID Installer: Input Output HK Limited (89TW38X994)
       Expires: 2027-02-01 22:12:15 +0000
       SHA256 Fingerprint:
           AD B3 2F 8C 6F D0 2D 1F 0C 97 7C B2 92 1E 18 37 3B 45 03 4D 25 EA 
           D1 26 68 1B CB 0F B9 42 8E 4E
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2027-02-01 22:12:15 +0000
       SHA256 Fingerprint:
           7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03 
           F2 9C 88 CF B0 B1 BA 63 58 7F
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C 
           68 C5 BE 91 B5 A1 10 01 F0 24

If you want to help investigate this, could you try opening the following installer (link below)? Is it trusted?

I have created an installer with the notarization stapled to it, e.g. for offline use. Normally, without a stapled notarization, macOS has to consult Apple's servers. So my idea was that maybe an older OS will accept stapled notarization?

The new installer to test can be downloaded from our Google Drive:

daedalus-7.0.2-71760-mainnet-331049f3e-x86_64-darwin-stapled.pkg

It is also signed with the IOHK key (89TW38X994), so the source of the download doesn’t matter, in case you were worried about it being Google Drive.

Before (or even without) opening, you can run pkgutil --check-signature daedalus-7.0.2-71760-mainnet-331049f3e-x86_64-darwin-stapled.pkg — I would be very grateful for this output, too. Does it contain Notarization: trusted by the Apple notary service?

Thanks for all the help. 🙏

@kirk-bit
Copy link
Author

kirk-bit commented Dec 19, 2024 via email

@kirk-bit
Copy link
Author

kirk-bit commented Dec 19, 2024 via email

@kirk-bit
Copy link
Author

kirk-bit commented Dec 19, 2024 via email

@michalrus
Copy link
Member

@kirk-bit hey, thanks, I see that you sent the output on a non-stapled installer twice:

pkgutil --check-signature daedalus-7.0.2-71760-mainnet-331049f3e-x86_64-darwin.pkg

Could you also download the new -stapled.pkg version, and run the command on it, too? 🙏

daedalus-7.0.2-71760-mainnet-331049f3e-x86_64-darwin-stapled.pkg

pkgutil --check-signature daedalus-7.0.2-71760-mainnet-331049f3e-x86_64-darwin-stapled.pkg

@kirk-bit
Copy link
Author

kirk-bit commented Dec 20, 2024 via email

@michalrus
Copy link
Member

Okay, I'm also getting rejected from spctl -a, but it works on my machine (macOS 15.1).

The issue you're seeing now (i.e. Incompatible library version: libiconv.dylib requires version 2.0.0 or later, but libcharset.1.dylib provides version 1.0.0) is a separate one, let's try to get notarization and trust working first, and then look at that, if you're still willing to help. 🙏

Question: were you able to install the -stapled.pkg without overriding trust by holding Option + RightClick + Open? Did simple double click install work for -stapled.pkg?

@kirk-bit
Copy link
Author

kirk-bit commented Dec 20, 2024 via email

@michalrus
Copy link
Member

Awesome to hear this! So the 1st issue is solved by stapling. We'll have to release 7.0.3 to solve it for everyone, but let's solve the 2nd issue first, and release both.

The 2nd issue is Incompatible library version: libiconv.dylib requires version 2.0.0 or later, but libcharset.1.dylib provides version 1.0.0.

It's confusing that it doesn't happen on my machine (or the ones of our QA). I'll analyze the log, will try to think of something, and will give you a new installer to test soon. ⏳

Thank you for the cooperation. 🙌

@kirk-bit
Copy link
Author

kirk-bit commented Dec 20, 2024 via email

@kirk-bit
Copy link
Author

kirk-bit commented Dec 20, 2024 via email

@Nearrain
Copy link

Is any info yet when will be new version of Deadalus wallet ( 7.0.2) published which will solve this problem also for users which are not computer experts?

@kirk-bit
Copy link
Author

@Nearrain, I was told the team would be working on the new release, but they haven't provided a release date yet. Additionally, the libiconv.dylib is still an active ticket with IOHK, and that's the remaining piece of this multi-part issue to my knowledge. Still, there may be additional issues I'm unaware of.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@michalrus @kirk-bit @Nearrain