Gatekeeper Path Randomization makes life hard #182

joshaber · 2016-09-29T17:36:59Z

Use macOS Sierra.
Download an app to ~/Downloads.
Launch app.
Update found.
Prompted to auth update helper (??)
Update can't be installed.

This is because of Gatekeeper's path randomization, new in Sierra. Once you do something that deactivates path randomization (e.g., move the app), updates are fine.

This sucks. It's not terribly clear how we can deal with it. Try to detect it and tell users? Maybe we can explicitly de-quarantine the running app from ShipIt?

The text was updated successfully, but these errors were encountered:

joshaber · 2016-09-29T17:37:02Z

@keithduncan krona for your thoughts.

joshaber · 2016-09-29T17:44:45Z

Some other discussions about this:

potionfactory/LetsMove#56
http://www.openradar.me/radar?id=5022734169931776

joshaber · 2016-09-29T18:57:22Z

I've confirmed that removing com.apple.quarantine from the app fixes this. So what if we did this:

Check for updates.
Notice the host app still has com.apple.quarantine.
Clear the bit.
Since the app was launched with com.apple.quarantine, we can't update it until it's relaunch, so don't check for updates.

It sucks that it means they won't get updates on the first run, but... that's not too bad compared to the current behavior.

joshaber · 2016-10-06T01:13:31Z

Assuming #183 is misguided... I'm struggling to come up with any other ideas. We could try to detect when path randomization is being applied and just not check for updates?

zorgiepoo · 2016-10-09T23:27:35Z

Just found this thread while googling for something else related. We documented the issue for Sparkle at: sparkle-project/Sparkle#832 https://sparkle-project.org/documentation/

In short, we do nothing special, other than disabling updates if the app is running from a read-only mount, which needs to be handled anyway if the app is running inside a dmg.

Apple wants developers to ship code signed dmg's now to avoid translocation and not zips. Maybe not ideal, but we'd rather not oppose them by writing a hack to clear a quarantine bit. App developers could use something like LetsMove if they want, but we don't handle that kind of logic ourselves.

joshaber · 2016-10-10T18:47:31Z

Thanks @zorgiepoo!

In short, we do nothing special, other than disabling updates if the app is running from a read-only mount, which needs to be handled anyway if the app is running inside a dmg.

I think you're right that this is the best path forward 👍

joshaber · 2016-10-18T00:49:52Z

#186 addressed this as best as I know how for now.

Because of MacOS Gatekeeper path randomization issues (Squirrel/Squirrel.Mac#182) we need the user to move the app themselves. Changed the dialog to ask them to do this politely.

Because of MacOS Gatekeeper path randomization issues (Squirrel/Squirrel.Mac#182) we need the user to move the app themselves. Changed the dialog to ask them to do this politely. Conflicts: internal_packages/verify-install-location/lib/main.es6

Use staging autoupdater for staging. fixed failing test Fix autoupdater – we were using the wrong command. Revert "Bump version to 1.5.0" Temporarily reverting this because I need to test the upgrade path from 0.4.2 => 1.5.0 Revert "Revert "Bump version to 1.5.0"" Had to do this to test the autoupdater. [fix] [channel drop-down list] Show the stable channel in all cases. Conflicts: internal_packages/preferences/lib/tabs/update-channel-section.jsx Fix broken autoupdater, for reals. [master] Replace "Nylas N1" by "Nylas Mail" in build scripts Summary: As discussed --- we need to make those changes to make the autoupdater work across versions. Test Plan: Will run a build. Reviewers: evan Reviewed By: evan Differential Revision: https://phab.nylas.com/D3701 Revert "Revert "Revert "Bump version to 1.5.0""" Need to set the version to 0.4.402 for testing purposes. Set preferredChannel in the autoupdater instead of in the ChannelStore It turns out that Squirrel checks for update at program launch. In some cases, it would put Pro users on the "nylas-mail" channel because that's the default channel if you don't pass a preferredChannel. Conflicts: src/flux/stores/update-channel-store.es6 Set the autoupdater preferredChannel to stable. Don't try to move the app file to the Application folder ourselves Because of MacOS Gatekeeper path randomization issues (Squirrel/Squirrel.Mac#182) we need the user to move the app themselves. Changed the dialog to ask them to do this politely. Conflicts: internal_packages/verify-install-location/lib/main.es6

repertor · 2017-07-26T19:09:11Z

I am directed to this issue when I try to update Atom. I am not running Atom from a read-only location, nor is it in my Downloads folder. It is in a subfolder of my Dropbox, located in my user directory. And yet, I receive the error message that follows:

Cannot update while running on a read-only volume. The application is on a read-only volume. Please move the application and try again. If you're on macOS Sierra or later, you'll need to move the application out of the Downloads directory. See #182 for more information.

himynameisjonas · 2017-07-26T20:20:19Z

@repertor I had the same issue and also not running from a read-only volume but i just did what the first post here said:

Once you do something that deactivates path randomization (e.g., move the app), updates are fine.

I moved it out of my applications folder and back again and the updater worked fine. (I guess I moved the Atom.app into the applications folder with Alfred.app instead of just moving it in Finder)

repertor · 2017-07-26T20:41:37Z

Thanks, @himynameisjonas. I had unzipped Atom directly into the directory from the download, so moving it in and out solved the problem.

shaunc · 2017-08-28T18:33:11Z

@himynameisjonas @repertor -- I tried

$ mv /Applications/Atom.app ~
$ mv ~/Atop.app /Applications

but it had no effect. Is there some trick about how you move?

himynameisjonas · 2017-08-28T18:57:41Z

I just dragged it to the desktop and back in the Finder.

…

-- Jonas Brusman

On 28 aug. 2017 20:33 +0200, Shaun Cutts ***@***.***>, wrote: @himynameisjonas @repertor -- I tried $ mv /Applications/Atom.app ~ $ mv ~/Atop.app /Applications but it had no effect. Is there some trick about how you move? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

joshaber · 2017-08-31T14:56:07Z

@shaunc You may need to move it using the Finder for it to work.

Squirrel/Squirrel.Mac#182

mrmass · 2018-12-05T10:07:52Z

FYI - I'm new to mac platform, but the update only started working when I restarted my mac after the move from Downloads to Applications via Finder.

Not sure whether it's normal or not but it might save someone a bit of trouble...

hassenius · 2019-02-05T09:40:17Z

For anyone arriving here, here's what solved the problem for me:

Shutdown Atom
Run (in a terminal)

mv ~/Downloads/Atom.app ~/Applications/
xattr -dr com.apple.quarantine ~/Applications/Atom.app

Start Atom again
It was now able to run updates no problem

aberezin · 2019-02-12T15:52:41Z

That wfm. Specifically

shutdown Atom
cd /path/to/my/apps/
xattr -dr com.apple.quarantine ./Atom.app

lukasz-formela · 2019-04-15T08:57:39Z

Hello!
As @mrmass stated:
Not only you have to move the app but you also need to restart the platform.
Kudos!

m-lamarre · 2019-05-02T13:26:23Z

I moved it out of my applications folder and back again and the updater worked fine.

Thanks @himynameisjonas
This worked for me. My Atom was in the Applications folder. So I moved it to the Desktop and back, and now Updates are downloading 😅 🤷‍♀ 🤦‍♀

cmd + c 'Atom'
alt + cmd + v to move it to a new location

willthemoor · 2019-08-05T19:15:16Z

Running OXS 10.14.5. Had the atom installed in /Applications.

Moving it to the desktop and back via Finder did not work. Permissions looked right via cli.

xattr -dr com.apple.quarantine /Applications/Atom.app/
and
xattr -dr com.apple.quarantine /Applications/Atom\ Beta.app/
worked for me.

brando90 · 2019-08-28T15:30:40Z

I had to make sure I opened it outside of downloads. I even had to re-install it and then move it to applications and THEN open it there. Weird.

zorgiepoo · 2019-08-28T23:50:30Z

That's working as expected for app translocation (i.e, you need to move the app using Finder to have auto-updates available). Atom needs to update Squirrel so it doesn't try to auto-update in that scenario and/or ship their app in a signed/notarized dmg. That's an issue for Atom, not here.

zorgiepoo · 2019-08-29T03:39:09Z

Actually I take that back.. Looking at the code it looks like squirrel tries to notify the user if an update is available. It shouldn't. It should silently fail unless the user manually requests for an update like Sparkle. Responsibility is left to the apps or other frameworks (eg LetsMove) if they want the app to not be on a read-only volume. To each their own.

danwetherald · 2019-10-09T22:10:40Z

This is happening when the Atom.app resides in ~/Applications

jhriv · 2019-11-18T18:55:35Z

Verified: using Iterm2 to mv ~/Downloads/Atom.app to /Applications keeps the read-only error. Using Finder to drag and drop it to /Applications allows the updater to function.

macOS Mojave Version 10.14.6

MichaelRDionne · 2022-07-21T23:41:18Z

I just dragged it to the desktop and back in the Finder.
…
-- Jonas Brusman
On 28 aug. 2017 20:33 +0200, Shaun Cutts @.***>, wrote: @himynameisjonas @repertor -- I tried $ mv /Applications/Atom.app ~ $ mv ~/Atop.app /Applications but it had no effect. Is there some trick about how you move? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

Yep, same here.

I quit VSC
moved the APP from downloads to Applications
opened VSC from inside the Applications folder.

Worked fine after that. Hope that helps.

This was referenced Sep 29, 2016

Fix macOS updater on Sierra desktop/desktop#432

Closed

[WIP] Try to unquarantine the host app before checking for updates. #183

Closed

This was referenced Oct 14, 2016

com.mydomain.ShipIt respawn every 2 second, spamming user's system.log #185

Closed

Error if there's an update available but the app's on a read-only volume #186

Merged

joshaber closed this as completed Oct 18, 2016

joaomoreno mentioned this issue Nov 14, 2016

Code won't update on macOS microsoft/vscode#7426

Closed

joaomoreno mentioned this issue Nov 23, 2016

When updating Visual Studio Code is asking for a password to Add Helper microsoft/vscode#15924

Closed

zh99998 mentioned this issue Dec 11, 2016

mac update not works electron-userland/electron-builder#943

Closed

zorgiepoo mentioned this issue Jan 21, 2017

Work around translocation by updating into /Applications sparkle-project/Sparkle#1012

Closed

joshaber mentioned this issue Feb 6, 2017

Squirrel tries to escalate privileges even when user owns the parent directory #199

Closed

tierninho added a commit to desktop/desktop that referenced this issue Sep 12, 2017

squirrel error msg

3c0cdbc

Squirrel/Squirrel.Mac#182

shiyunn mentioned this issue Sep 14, 2017

I can't keep in Dock microsoft/vscode#34336

Closed

steffanhalv mentioned this issue Oct 31, 2018

Gatekeeper Path Randomization makes life hard #182 #232

Open

ghost mentioned this issue Jan 16, 2019

Commit failed - exit code 1 received [NO .git FILE] desktop/desktop#6624

Closed

jm0421 mentioned this issue Jan 31, 2019

Feature request: Show better error when Signal on read-only volume signalapp/Signal-Desktop#3096

Closed

mattparkins mentioned this issue Feb 6, 2019

Signal crashes at startup claiming it's on a read-only volume, but it's not ! signalapp/Signal-Desktop#3110

Closed

1 task

ghost mentioned this issue Feb 13, 2019

Crash: "EPERM: operation not permitted)" signalapp/Signal-Desktop#3106

Open

1 task

maverick915 mentioned this issue Mar 25, 2019

Failed to start Pgsql tools service on MacOS microsoft/azuredatastudio-postgresql#108

Closed

trystant mentioned this issue Apr 17, 2019

Ran into this error while trying to update Signal.Mac from the Downloads directory mnyon-grandkru/knowledgebase#60

Closed

cicorias mentioned this issue Jun 25, 2019

LiveShare complains running outside application directory microsoft/live-share#2408

Closed

charlag mentioned this issue Sep 25, 2019

Notify macOS users that the app cannot be updated in Downloads folder tutao/tutanota#1507

Closed

AdrianoFerrari mentioned this issue Oct 24, 2019

macOS can't update Gingko if it's in the Downloads folder gingko/client#174

Open

tierninho mentioned this issue Jan 29, 2020

Untrusted Server Error desktop/desktop#7925

Closed

nsakaimbo mentioned this issue May 12, 2020

revert(os x): com.apple.quarantine attr Automattic/wp-desktop#878

Merged

casas1010 mentioned this issue May 27, 2020

Commit failed - exit code 1 received desktop/desktop#9807

Closed

melissamarchand mentioned this issue Mar 17, 2021

Cannot update on Mac "while running on a read-only volume" ... microsoft/vscode#119210

Closed

timfeeley-okta mentioned this issue Jul 30, 2021

Settings Sync prompts for login every time VSCode restarts microsoft/vscode#129813

Closed

ManuGowda mentioned this issue Jan 11, 2022

Restart app button doesn't work after an update LiskHQ/lisk-desktop#4062

Closed

emanuelaguna mentioned this issue Nov 4, 2022

Unexpected Error Occurred while Connecting microsoft/azuredatastudio#21106

Closed

Phyloiota mentioned this issue Oct 1, 2023

[Bug report]: Updating to Alpha 2 fails with error iotaledger/firefly#7511

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Gatekeeper Path Randomization makes life hard #182

Gatekeeper Path Randomization makes life hard #182

joshaber commented Sep 29, 2016

joshaber commented Sep 29, 2016

joshaber commented Sep 29, 2016

joshaber commented Sep 29, 2016

joshaber commented Oct 6, 2016 •

edited

Loading

zorgiepoo commented Oct 9, 2016

joshaber commented Oct 10, 2016

joshaber commented Oct 18, 2016

repertor commented Jul 26, 2017

himynameisjonas commented Jul 26, 2017

repertor commented Jul 26, 2017

shaunc commented Aug 28, 2017

himynameisjonas commented Aug 28, 2017 via email

joshaber commented Aug 31, 2017

mrmass commented Dec 5, 2018

hassenius commented Feb 5, 2019

aberezin commented Feb 12, 2019

lukasz-formela commented Apr 15, 2019

m-lamarre commented May 2, 2019 •

edited

Loading

willthemoor commented Aug 5, 2019 •

edited

Loading

brando90 commented Aug 28, 2019

zorgiepoo commented Aug 28, 2019 •

edited

Loading

zorgiepoo commented Aug 29, 2019

danwetherald commented Oct 9, 2019

jhriv commented Nov 18, 2019

MichaelRDionne commented Jul 21, 2022

Gatekeeper Path Randomization makes life hard #182

Gatekeeper Path Randomization makes life hard #182

Comments

joshaber commented Sep 29, 2016

joshaber commented Sep 29, 2016

joshaber commented Sep 29, 2016

joshaber commented Sep 29, 2016

joshaber commented Oct 6, 2016 • edited Loading

zorgiepoo commented Oct 9, 2016

joshaber commented Oct 10, 2016

joshaber commented Oct 18, 2016

repertor commented Jul 26, 2017

himynameisjonas commented Jul 26, 2017

repertor commented Jul 26, 2017

shaunc commented Aug 28, 2017

himynameisjonas commented Aug 28, 2017 via email

joshaber commented Aug 31, 2017

mrmass commented Dec 5, 2018

hassenius commented Feb 5, 2019

aberezin commented Feb 12, 2019

lukasz-formela commented Apr 15, 2019

m-lamarre commented May 2, 2019 • edited Loading

willthemoor commented Aug 5, 2019 • edited Loading

brando90 commented Aug 28, 2019

zorgiepoo commented Aug 28, 2019 • edited Loading

zorgiepoo commented Aug 29, 2019

danwetherald commented Oct 9, 2019

jhriv commented Nov 18, 2019

MichaelRDionne commented Jul 21, 2022

joshaber commented Oct 6, 2016 •

edited

Loading

m-lamarre commented May 2, 2019 •

edited

Loading

willthemoor commented Aug 5, 2019 •

edited

Loading

zorgiepoo commented Aug 28, 2019 •

edited

Loading