Bug #74000 MySQLWorkbench 6.2.2 RC for OSX Damaged
Submitted: 22 Sep 2014 0:02 Modified: 24 Sep 2014 12:13
Reporter: Mike H Email Updates:
Status: Closed Impact on me:
Category:MySQL Workbench Severity:S3 (Non-critical)
Version: build 2282 OS:MacOS (10.9.5)
Assigned to: CPU Architecture:Any

[22 Sep 2014 0:02] Mike H
Launching 6.2.2 RC downloaded in mysql-workbench-community-6.2.2-osx-i686.dmg fails with:

“MySQLWorkbench.app” is damaged and can’t be opened. You should move it to the Trash.

This is usually a simple code signing issue:

spctl -a -t exec -vv /Applications/MySQLWorkbench.app/
/Applications/MySQLWorkbench.app/: nested code is modified or invalid

See the following reports :

- http://mysqlworkbench.org/2014/09/mysql-workbench-6-2-2-rc-has-been-released/ (comments)
- http://bugs.mysql.com/bug.php?id=73854 (partial duplicate... macports not relevant to this issue)


- change System Preferences > Security & Privacy > General > Allow apps downloaded from: to Anywhere
- launch MySQLWorkbench.app
- change Allow apps downloaded from: back to your preferred setting

How to repeat:
Download mysql-workbench-community-6.2.2-osx-i686.dmg and launch on any OS X version with Gatekeeper (10.7.5+).

Launch MySQLWorkbench.app

if launched from the disk image will display:

“MySQLWorkbench.app” is damaged and can’t be opened. You should eject the disk image.

If copied outside of DMG and launched will display:

“MySQLWorkbench.app” is damaged and can’t be opened. You should move it to the Trash.

Suggested fix:
Look for modifications post signing then resign and repackage with correct signature.

codesign -vv /Applications/MySQLWorkbench.app/Contents/MacOS/MySQLWorkbench 
MySQLWorkbench: nested code is modified or invalid
files added: 187
files modified: 145
[23 Sep 2014 18:35] Alfredo Kojima
Please try version 6.2.3
[23 Sep 2014 20:15] Mike H
Now launches OK but not fully resolved.

spctl -a -t exec -vv /Applications/MySQLWorkbench.app/
/Applications/MySQLWorkbench.app/: a sealed resource is missing or invalid

Expected result would be:

spctl -a -t exec -vv /Applications/MySQLWorkbench.app/
/Applications/MySQLWorkbench.app/: accepted
source=Developer ID
origin=Developer ID Application: Oracle America, Inc.
[24 Sep 2014 11:05] Mike Lischke
In the meantime MySQL Workbench GA was released where the code signing is correct. Thanks for the information anyway.
[24 Sep 2014 11:25] Mike H
The code signing was allowed but not fully accepted.

Is there any reason why you can't sign everything?
[24 Sep 2014 12:05] Mike Lischke
The app is correctly signed now. I just downloaded and ran the spctl command on it. All fine now.
[24 Sep 2014 12:13] Mike H
Confirmed... must have been updated since my last download.