Can't run crc setup on macOS Catalina - "the developer cannot be verified"

[geerlingguy]

General information

• OS: macOS 10.15.1 Catalina
• Hypervisor: default
• Did you run crc setup before starting it? Yes (but that's where it fails)

CRC version

N/A - cannot run crc

CRC status

N/A - cannot run crc

CRC config

N/A - cannot run crc

Host Operating System

ProductName:	Mac OS X
ProductVersion:	10.15.1
BuildVersion:	19B88

Steps to reproduce

1. Download the CRC archive from this page (macOS HyperKit).
2. Extract the archive.
3. Move crc into my $PATH (mv ~/Downloads/crc-macos-1.1.0-amd64/crc /usr/local/bin/crc)
4. Run crc setup

Expected

I would be guided through the CRC setup process.

Actual

After about a minute, I see the following dialog pop up:

It reads:

"crc" cannot be opened because the developer cannot be verified.

macOS cannot verify that this app is free from malware.

Safari downloaded this file today at 9:24 AM

Logs

N/A - crc won't run

[geerlingguy]

Probably related: hashicorp/terraform#23033

Workaround is to:

1. Open the containing folder in Finder (e.g. open /usr/local/bin)
2. Right-click on crc in Finder.
3. Click 'Open'.
4. Wait for 'Verifying "crc"' to fail (this takes about a minute).
5. You'll get a popup (see below) asking "Are you sure you want to open it?"
6. Click 'Open' to confirm the security exception.

CRC (the binary—any command) seems to run very slowly under Catalina, though. Could be related to #727

So, since there's a workaround, the question is: is it possible for CRC to be signed by a valid developer account (I believe you can get a Developer ID free with any working Apple ID, and use it to sign apps to bypass Gatekeeper) during its build process, so macOS users don't have to go through these hoops to use it?

[praveenkumar]

@geerlingguy Yes we are working on that, we will prioritise it in next sprint.

[zeenix]

I can confirm that I can reproduce this issue after upgrading to Catalina.

[sebastianfaulhaber]

FYI: Could reproduce with CRC V1.4.0

[sebastianfaulhaber]

FYI: Could reproduce with CRC V1.6.0

[gbraad]

Binaries haven't been signed yet. Use the provided exception option as referenced by Apple on the dialog.

…

On Wed, Feb 19, 2020 at 8:55 PM Sebastian Faulhaber < ***@***.***> wrote: FYI: Could reproduce with CRC V1.6.0 — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#836>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAOZWBOU7NWKTMCNBBP6DRDUT3BANCNFSM4JQSLW5A> .

-- Gerard Braad | http://gbraad.nl [ Doing Open Source Matters ]

[sebastianfaulhaber]

Here's how VSCode did it...maybe this helps: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution

I still think that the workaround is not acceptable for many customers. So I kindly ask you to put this up in the list. Thanks a lot.

Regards,
Sebastian

[gbraad]

this is being resolved company wide, but some applications are currently in the process for this. we will hopefully soon

[XUTProf]

My corporate IT admin sadly setup my mac and disabled the prompt for me to trust the crc app, so I had to allow download for all apps with "sudo spctl --master-disable".
+1 for developers LOL

[carlmes]

My workaround is to simply remove the quarantine flag, after which crc runs without issues:

sudo xattr -d com.apple.quarantine ~/crc-macos-1.10.0-amd64/crc

I usually create a symlink so that I don't have to keeping typing in "dot" "slash" (i.e. ./crc):

ln -nsf ~/crc-macos-1.10.0-amd64/crc /usr/local/bin/crc

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[srimurthyGit]

FYI - could reproduce with 1.19 on Mac

[cg2p]

Workaround is fine and works and looks like the root problem is on the list todo - meanwhile it would make complete sense to update the installation instructions on this page with details of the workaround here

[guillaumerose]

We are now shipping a .pkg for macOS. The crc binary is now signed and notarized. The default link will be changed in couple of days.

https://mirror.openshift.com/pub/openshift-v4/clients/crc/latest/crc-macos-amd64.pkg

[guillaumerose]

Default link is now the pkg