[macOS] HaveClip.app works only on first run after new (unique) build #3

i-to-r · 2021-06-20T17:13:46Z

Errors:

-25293 errSecAuthFailed
-67030 errSecCSInfoPlistFailed

The HaveClip.app works only on first run after new (unique) build — can't access the client cert/key in keychain (Secure Transport ^{macOS native TLS/SSL backend} automatically puts it there).

Clear (delete existing ".app") and build

$ codesign -dvvvv HaveClip.app
HaveClip.app: code object is not signed at all

$ codesign -vvvv HaveClip.app
HaveClip.app: code object is not signed at all
In architecture: x86_64

First run from Terminal (Ok) — see "run-1-[0,1]. … .log"

$ HaveClip.app/Contents/MacOS/HaveClip 
Listening on QHostAddress("192.0.2.1") 9999
Remote control socket "/Users/_/Library/Application Support/HaveFun.cz/HaveClip-dev/haveclip.sock"
Send message 4 28 bytes
Received message 36
Send "text/html"
Send "text/plain"
Send message 6 753 bytes
Confirmed
Received message 28
Unable to reach "192.0.2.2" : QAbstractSocket::RemoteHostClosedError
Connection error QAbstractSocket::RemoteHostClosedError  (0):  "The TLS/SSL connection has been closed"
Communicator::onDisconnect

$ codesign -dvvvv HaveClip.app
Executable=/Users/_/.../HaveClip.app/Contents/MacOS/HaveClip
Identifier=cz.havefun.HaveClip-dev
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20100 size=5160 flags=0x2(adhoc) hashes=156+3 location=system
Hash type=sha256 size=32
CandidateCDHash sha256=00c3d9c6e70d6166cd8b1b4cf74627e651d600e4
Hash choices=sha256
Page size=4096
CDHash=00c3d9c6e70d6166cd8b1b4cf74627e651d600e4
Signature=adhoc
Info.plist entries=11
TeamIdentifier=not set
Sealed Resources version=2 rules=13 files=2
Internal requirements count=0 size=12

$ codesign -vvvv HaveClip.app
HaveClip.app: valid on disk
HaveClip.app: satisfies its Designated Requirement

🗒️ run-1-[0,1]. … .log

Note: In the program output and in the logs, you may have noticed the reference to cz.havefun.HaveClip-dev — I temporarily renamed HaveClip to HaveClip-dev in "Main.cpp:35" and in a custom "Info.plist" file (CFBundleIdentifier key).

2th run from Terminal (Error) — see "run-2-[0,0]. … .log"

$ HaveClip.app/Contents/MacOS/HaveClip 
Listening on QHostAddress("192.0.2.1") 9999
Remote control socket "/Users/_/Library/Application Support/HaveFun.cz/HaveClip-dev/haveclip.sock"
Unable to reach "192.0.2.2" : QAbstractSocket::SocketError(13)
Connection error QAbstractSocket::SocketError(13)  (0):  "SSLHandshake failed: -25293"
Communicator::onDisconnect

🗒️ run-2-[0,0]. … .log

Re‑sign (result: CodeDirectory location=system → location=embedded)

$ codesign -f -s - HaveClip.app
HaveClip.app: replacing existing signature

$ codesign -dvvvv HaveClip.app
Executable=/Users/_/.../HaveClip.app/Contents/MacOS/HaveClip
Identifier=cz.havefun.HaveClip-dev
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20100 size=5160 flags=0x2(adhoc) hashes=156+3 location=embedded
VersionPlatform=1
VersionMin=658432
VersionSDK=658944
Hash type=sha256 size=32
CandidateCDHash sha256=4444444444444444444444444444444444444444
Hash choices=sha256
Page size=4096
CDHash=4444444444444444444444444444444444444444
Signature=adhoc
Info.plist entries=11
TeamIdentifier=not set
Sealed Resources version=2 rules=13 files=2
Internal requirements count=0 size=12

$ codesign -vvvv HaveClip.app
HaveClip.app: valid on disk
HaveClip.app: satisfies its Designated Requirement

3th run from Terminal (Ok) — see "run-3-[1,1]. … .log"

$ HaveClip.app/Contents/MacOS/HaveClip 
Listening on QHostAddress("192.0.2.1") 9999
Remote control socket "/Users/_/Library/Application Support/HaveFun.cz/HaveClip-dev/haveclip.sock"
Send message 4 28 bytes
Received message 36
Send "text/plain"
Send message 6 66 bytes
Confirmed
Received message 28
Unable to reach "192.0.2.2" : QAbstractSocket::RemoteHostClosedError
Connection error QAbstractSocket::RemoteHostClosedError  (0):  "The TLS/SSL connection has been closed"
Communicator::onDisconnect

🗒️ run-3-[1,1]. … .log

4th run from Terminal (Ok) — see "run-4-[1,0]. … .log"

$ HaveClip.app/Contents/MacOS/HaveClip 
Listening on QHostAddress("192.0.2.1") 9999
Remote control socket "/Users/_/Library/Application Support/HaveFun.cz/HaveClip-dev/haveclip.sock"
Send message 4 28 bytes
Received message 36
Send "text/plain"
Send message 6 90163 bytes
Confirmed
Received message 28
Unable to reach "192.0.2.2" : QAbstractSocket::RemoteHostClosedError
Connection error QAbstractSocket::RemoteHostClosedError  (0):  "The TLS/SSL connection has been closed"
Communicator::onDisconnect

🗒️ run-4-[1,0]. … .log

Links:

Error after updating an app:
- Got -25293(errSecAuthFailed) when access keychain item after app is updated
  [screenshot, log]
- Upgrading a code signed Mono app causes KeyChain to stop access without reboot
  [answer]
- OS X Keychain access lost on updates
  [answer]
  Code Signing Guide: macOS subsystems that verify the validity of code
  - "How the Keychain checks it's the same app":
    - How does macOS keychain ACL determine which apps have access?
      [answer]
      Generate a self-signed certificate using Certificate Assistant (expand the spoiler) and Signing Code Manually (codesign) and do not run spctl (on local machine) to Test a Code Signature, run in virtual machine only
      Creating a Self-signed Code Signing Certificate using OpenSSL
    - When does Mojave check an app’s signature? The answer isn’t entirely consistent.
Signed Code vs Unsigned Code:
- log: CSSM_ERRCODE_OPERATION_AUTH_DENIED
  - "Unsigned code an Apple platforms is a really bad idea for all sorts of reasons, and this is one of them."
- Why is SFHFKeychainUtils failing with error errSecAuthFailed in a Cocoa app?
  [answer]
- "code has no resources but signature indicates they must be present"
  [Qt, macdeployqt, codesign --no-legacy-signing, answer]
  - Unable to sign app bundle using Qt frameworks on OS X 10.10
    [_debug, QTBUG-23268, QTBUG-32896, answer]
  - Qt: An update on OS X Code Signing — Code signing flow and checkpoints
    macdeployqt .app -codesign=
  - check which libraries the app links to
    otool -L .app/Contents/MacOS/App
  - macdeployqt will also copy "libcrypto.*.dylib"
    macdeployqt .app -codesign=- -verbose=2
- Can't fetch password from system: reprebinding
  [answer, resign, live stream log from Console.app]
  codesign -f -s - .app (ad-hoc signing → Signature=adhoc in the codesign -dvvvv HaveClip.app output above)
  - How to re-sign an app on a Mac
    [-67030, system.log from Console.app]
  - Security Auth Failure: make sure python is signed with codesign util
    [-25293, Lock and Unlock the Keychain]
  - Ad-hoc signing details
  - Deeper…
- Google: "-25293" errSecAuthFailed

Also:

"Do you want the application “app” to accept incoming network connections?" every time the app starts
- OSX ruby executable has an invalid signature chef-boneyard/chef-dk#258
- Code signing manually compiled software after changes

The text was updated successfully, but these errors were encountered:

i-to-r mentioned this issue Jun 20, 2021

[macOS] TLS, Keychain, Firewall related fixes #4

Merged

i-to-r referenced this issue Jun 20, 2021

Mac deploy script: fix library paths for all libs and plugins

816c485

This was referenced Jun 20, 2021

OpenSSl related fixes, Part 2 aither64/haveclip-core#4

Merged

[macOS] Fix 10 sec delay between auto-syncs (Nagle’s Algorithm + Delayed ACK, App Nap) aither64/haveclip-core#1

Merged

aither64 closed this as completed in #4 Jun 22, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[macOS] HaveClip.app works only on first run after new (unique) build #3

[macOS] HaveClip.app works only on first run after new (unique) build #3

i-to-r commented Jun 20, 2021 •

edited

Loading

[macOS] HaveClip.app works only on first run after new (unique) build #3

[macOS] HaveClip.app works only on first run after new (unique) build #3

Comments

i-to-r commented Jun 20, 2021 • edited Loading

i-to-r commented Jun 20, 2021 •

edited

Loading