JabRef packages for macOS on fosshub broken? (solution inside)

[s0nnenschein]

JabRef version

5.9 (latest release)

Operating system

mac OS

Details on version and operating system

JabRef 5.9 (was asked to perform an update), macOS 12.6

Checked with the latest development build

All I checked were the files from fosshub.

Steps to reproduce the behaviour

I tried to get JabRef 5.9 running with JabRef Mac OS dmg, after extracting the file it says the file is broken.

Thankfully I was still able to redownload JabRef 5.8 Mac OS dmg, which works as expected after extracting the file.

[Siedlerchr]

Hi It is not broken but because it's not notarized apple gatekeeper reports it as broken. You have to execute xattr -d com.apple.quarantine /Applications/JabRef.app s0nnenschein ***@***.***> schrieb am Di., 10. Jan. 2023, 08:41:

…

JabRef version 5.9 (latest release) Operating system Windows Details on version and operating system JabRef 5.9 (was asked to perform an update), macOS 12.6 Checked with the latest development build - I made a backup of my libraries before testing the latest development version. - I have tested the latest development version and the problem persists Steps to reproduce the behaviour I tried to get JabRef 5.9 running with JabRef Mac OS dmg, after extracting the file it says the file is broken. Thankfully I was still able to redownload JabRef 5.8 Mac OS dmg, which works as expected after extracting the file. Appendix ... Log File Paste an excerpt of your log file here — Reply to this email directly, view it on GitHub <#9553>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACOFZCSBDOMTPJ7G3DXMSTWRUHEFANCNFSM6AAAAAATWLH3QY> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[stephanlukasczyk]

Thanks, @Siedlerchr , executing xattr -d com.apple.quarantine /Applications/JabRef.app did the trick as you suggested. In my case it was the version installed via Homebrew.

[astroboylrx]

What happened? I recall there is no need for such an action for v5.8. So v5.8 is notarized?

[Siedlerchr]

Yes. for 5.8 and other version before, the apple notarization workflow did work as usual, but not for 5.9 although code singing did not report any error, notarization fails. I could not get it to work locally either. Have to investigate further.

[jkulesza]

Is this something that will be fixed and re-uploaded? Cask installation via homebrew also leads to failure to launch.

[Siedlerchr]

@jkulesza We hope that we can make it work again for future versions. I recently ran some test but could not get it to work properly. It might have something to do with the jdk itself

[szhorvat]

For the sake of searchability, the message is:

“JabRef.app” is damaged and can’t be opened. You should move it to the Trash.

[tmancill]

For completeness and searchability, users may also see the message:

“JabRef” is damaged and can’t be opened. You should eject the disk image.

This occurs when you download the 5.9 DMG and double-click on the JabRef icon.

[tmancill]

We hope that we can make it work again for future versions. I recently ran some test but could not get it to work properly. It might have something to do with the jdk itself

Hi @Siedlerchr. I notice that the 5.9 version is shipping with Java 19, but Java 19 is already past EOL (https://endoflife.date/java). If the notarization error is actually related to the JDK, would it be possible to build against the latest LTS release of Java instead of the "fast channel" releases that occur every 6 months? So in this case, that would be building for Java 17.

Here's what I'm seeing for the 5.9 release:

JabRef 5.9--2023-01-08--76253f1a7
Mac OS X 13.4.1 aarch64 
Java 19.0.1 
JavaFX 19+11

[Siedlerchr]

We already compile with jdk 20. Next lts in September with jdk 21
I tested again it but that was not successful either. I tried several combination and arguments for jpackage and code sign.

My next idea would be to try out a minimal example with jlink and jpackage to rule out a jdk issue or for that case a reproducer.

If you know a fully notarized Java app with jdk 20 or 19 that uses jpackage that would help as well

[Siedlerchr]

adoptium/adoptium-support#829

I could not get it working with a sample project as well.

[Siedlerchr]

Good news, I found the issue. It was an issue in the creation of the image.
@tmancill can you test if this version works correctly? It should be notarized as well:
https://jabref.uber.space/cloud/index.php/s/kGwLPw3DBXGqd4y

[tmancill]

Hi @Siedlerchr. This works - thanks!

I uninstalled (since I had run the xattr to get things working) and then installed the version you shared. It starts with only the "downloaded this from the Internet" warning dialog, which is fully expected. I checked notarization with spctl and it looks good:

$ spctl --assess -v /Applications/JabRef.app
/Applications/JabRef.app: accepted
source=Notarized Developer ID

[Siedlerchr]

Thanks for the confirmation! I will try to get this back into our pipelines and the next release will then be notarized again.

[koppor]

@tmancill I think, it is in our pipelines now. Can you check the latest build at https://builds.jabref.org/main/?

[tmancill]

@tmancill I think, it is in our pipelines now. Can you check the latest build at https://builds.jabref.org/main/?

Hi @koppor . I didn't see a build for aarch64 on the latest builds page, but the installation of the x86_64 build works and runs (under emulation) without any warning or errors. Thanks!

From Help --> About JabRef

JabRef 5.10--2023-07-03--357f486
Mac OS X 13.4.1 x86_64 
Java 21-internal 
JavaFX 20+19

[Siedlerchr]

Aarch 64 will only be available at release because it's build on my m1 MacBook. There aren't any m1 runner available at GitHub and cross compilation is not yet supported in jpackage

[calixtus]

Should be fixed by #10041

[calixtus]

Please mind that this will only work for the next release 5.10

[xiaoguo1995]

@Siedlerchr Thanks! (xattr -d com.apple.quarantine /Applications/JabRef.app ) this works exactly after I update to version 5.9 my macOS update to Ventura.

Just wondering is there any other method not execute this "magic command" in terminal? I did not find a way to achieve similar results in Gatekeeper.

[Siedlerchr]

@PeterXiaoGuo For the next release this will not be necesary any longer. We got the notarization working again.

[tgvaughan]

Just FYI, I just encountered the same problem after installing JabRef-5.10.dmg. I had to manually remove it from quarantine as per @Siedlerchr 's suggestion above. (To be clear, I don't blame anyone besides Apple for this mess.)

[Siedlerchr]

@tgvaughan Can you tell me more? Where did you get the 5.10 version? It should be signed and notarized and working without any hacks
(The arm64 variant is definitely working without any hacks)

[tgvaughan]

@Siedlerchr it was automatically installed via homebrew, although it's a cask recipe which grabs it straight from https://github.com/JabRef/jabref/releases/download/v5.10/JabRef-5.10.dmg. I just tried uninstalling it, removing the cache, and installing it again and didn't experience any problems the second time around. Has the release file pointed to by that URL changed in the last few weeks? (I haven't opened jabref since probably August, so it's possible that I had an older version, despite what the URL says.)

[Siedlerchr]

Hm. No idea though. Maybe you had an older dev version installed? (Dev versions are not notarized, takes too long)
Works for me as well here. Tested on a different computer.
Btw, we also provide an arm64 version for Mac m1/m2
https://github.com/JabRef/jabref/releases/tag/v5.10

[tgvaughan]

It's probably safe to just chalk this up to weird homebrew randomness and leave this issue closed then. Thanks so much for your quick response, and for your work on this awesome program. (I've been using it very happily since 2008!)

[Siedlerchr]

@tgvaughan Thanks so much for the kind words! We welcome every contribution (code, docs or money)
https://docs.jabref.org/contributing