Bug #74000 MySQLWorkbench 6.2.2 RC for OSX Damaged

• Submitted: 22 Sep 2014 0:02
• Modified: 24 Sep 2014 12:13
• Reporter: Mike H
• Status: Closed
• Category: MySQL Workbench
• Severity: S3 (Non-critical)
• Version: 6.2.3.12313 build 2282
• OS: MacOS (10.9.5)
• CPU Architecture: Any

[22 Sep 2014 0:02] Mike H

Description:
Launching 6.2.2 RC downloaded in mysql-workbench-community-6.2.2-osx-i686.dmg fails with:

“MySQLWorkbench.app” is damaged and can’t be opened. You should move it to the Trash.

This is usually a simple code signing issue:

spctl -a -t exec -vv /Applications/MySQLWorkbench.app/
/Applications/MySQLWorkbench.app/: nested code is modified or invalid

See the following reports :

- http://mysqlworkbench.org/2014/09/mysql-workbench-6-2-2-rc-has-been-released/ (comments)
- http://bugs.mysql.com/bug.php?id=73854 (partial duplicate... macports not relevant to this issue)

Workaround:

- change System Preferences > Security & Privacy > General > Allow apps downloaded from: to Anywhere
- launch MySQLWorkbench.app
- change Allow apps downloaded from: back to your preferred setting

How to repeat:
Download mysql-workbench-community-6.2.2-osx-i686.dmg and launch on any OS X version with Gatekeeper (10.7.5+).

Launch MySQLWorkbench.app

if launched from the disk image will display:

“MySQLWorkbench.app” is damaged and can’t be opened. You should eject the disk image.

If copied outside of DMG and launched will display:

“MySQLWorkbench.app” is damaged and can’t be opened. You should move it to the Trash.

Suggested fix:
Look for modifications post signing then resign and repackage with correct signature.

codesign -vv /Applications/MySQLWorkbench.app/Contents/MacOS/MySQLWorkbench 
MySQLWorkbench: nested code is modified or invalid
files added: 187
files modified: 145

[23 Sep 2014 18:35] Alfredo Kojima

Please try version 6.2.3

[23 Sep 2014 20:15] Mike H

Now launches OK but not fully resolved.

spctl -a -t exec -vv /Applications/MySQLWorkbench.app/
/Applications/MySQLWorkbench.app/: a sealed resource is missing or invalid

Expected result would be:

spctl -a -t exec -vv /Applications/MySQLWorkbench.app/
/Applications/MySQLWorkbench.app/: accepted
source=Developer ID
origin=Developer ID Application: Oracle America, Inc.

[24 Sep 2014 11:05] Mike Lischke

In the meantime MySQL Workbench GA was released where the code signing is correct. Thanks for the information anyway.

[24 Sep 2014 11:25] Mike H

The code signing was allowed but not fully accepted.

Is there any reason why you can't sign everything?

[24 Sep 2014 12:05] Mike Lischke

The app is correctly signed now. I just downloaded and ran the spctl command on it. All fine now.

[24 Sep 2014 12:13] Mike H

Confirmed... must have been updated since my last download.