Bug 89561 - Unsigned Language Packs not passing OS X Gatekeeper security -- disrupting LO installation on 10.9.x and later
Summary: Unsigned Language Packs not passing OS X Gatekeeper security -- disrupting LO...
Status: RESOLVED DUPLICATE of bug 89657
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Installation (show other bugs)
Version:
(earliest affected)
4.4.1.2 release
Hardware: x86-64 (AMD64) Mac OS X (All)
: medium major
Assignee: Not Assigned
QA Contact:
URL:
Whiteboard:
Keywords:
: 89704 90951 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-02-22 13:35 UTC by Martin Srebotnjak
Modified: 2016-02-05 12:39 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Srebotnjak 2015-02-22 13:35:35 UTC
Upon launching "LibreOffice Language Pack" to install language pack on OSX a window pops up saying:
"LibreOffice Language Pack" can't be opened because it is from an unidentified developer.
Your security preferences allow installation of only apps from the Mac App Store and identified developers.
This did not happen with previous Lang Pack editions (or with previous OS subversions).
It means that in order to install a lang pack a user is forced to lower security setting (unacceptable) or to go to System Preferences - Security & Privacy - General and find the "Open Anyway" button at the bottom (most or half users don't know where to find it/what to do).
Therefore I am labeling this as a stopper for OS X 4.4.1, but someone might to downgrade it to a normal bug, but it might just make OS X users go away from LO.
Comment 1 Stephan Bergmann 2015-02-25 14:31:55 UTC
cf. mailing list sub-thread starting at <http://lists.freedesktop.org/archives/libreoffice/2015-February/066713.html> "Re: OS X build signature"
Comment 2 V Stuart Foote 2015-02-25 22:47:53 UTC
*** Bug 89657 has been marked as a duplicate of this bug. ***
Comment 3 V Stuart Foote 2015-02-25 22:50:16 UTC
cf. from bug 89657

Please cf. mailing list sub-thread starting at <http://lists.freedesktop.org/archives/libreoffice/2015-February/066713.html> "Re: OS X build signature"

I am pasting its most important part for this bug report regarding OS X lang-pack installation mechanism:

"For another, our language pack mechanism copies files into an existing 
LO installation, which is not endorsed at least by the updated (>= 
10.9.5) GateKeeper:

If the installed LO had never been started before the language pack is 
installed into it, trying to open LO leads to a "'LibreOffice' is 
damaged and can't be opened. You should move it to the Trash." error and 
requires to lower "System Preferences... - Security & Privacy - General 
- Allow apps downloaded from: Anywhere."

If the installed LO had already been started before the language pack is 
installed into it, it appears that Gatekeeper does not re-verify the 
modified LO installation, and allows to open LO (at least on 10.10.2)."

Since most non-English users automatically install lang-pack over a new LO installation without first running the install, it means that most non-English users will run into this problem.
Comment 4 V Stuart Foote 2015-02-25 22:55:52 UTC
Yup, now need to post the work around of a launch of LO prior to install of the Language pack in the LO release notes.
Comment 5 V Stuart Foote 2015-02-27 03:16:39 UTC
*** Bug 89704 has been marked as a duplicate of this bug. ***
Comment 6 Martin Srebotnjak 2015-07-13 16:03:55 UTC
Seems to work with LO50RC1-3 so I guess I can close it?
Comment 7 steve -_- 2015-07-15 08:55:37 UTC
Confirming miles findings. Setting to Fixed. Seems the translated UIs are now signed.

Please update this bug accordingly if I missed something or you disagree.
Comment 8 Alex Thurgood 2015-09-17 07:43:08 UTC
*** Bug 90951 has been marked as a duplicate of this bug. ***
Comment 9 Frank Fuchs 2015-10-11 13:11:49 UTC
I cannot confirm both fixed behaviours, only one:
Under Mac OS X 10.10.5 and 10.11.0, installing LO 5.0.3.1 with the German language pack, I still had to run LO once before installing the language pack - otherwise the installation was reported as damaged and LO subsequently could not be run.
Summary:
- the language packs seem to be signed and their installation can be run "normally" (this was fixed)
- but you still  have to run LO at least once before installing a language pack (see also https://bugs.documentfoundation.org/show_bug.cgi?id=89704), so:
  * either this needs to be fixed (if possible)
  * or this information needs to be added back to the release notes for Mac OS X
Comment 10 V Stuart Foote 2015-10-11 14:25:13 UTC
(In reply to Frank Fuchs from comment #9)
> I cannot confirm both fixed behaviours, only one:
> Under Mac OS X 10.10.5 and 10.11.0, installing LO 5.0.3.1 with the German
> language pack, I still had to run LO once before installing the language
> pack - otherwise the installation was reported as damaged and LO
> subsequently could not be run.
> Summary:
> - the language packs seem to be signed and their installation can be run
> "normally" (this was fixed)
> - but you still  have to run LO at least once before installing a language
> pack (see also https://bugs.documentfoundation.org/show_bug.cgi?id=89704),
> so:
>   * either this needs to be fixed (if possible)
>   * or this information needs to be added back to the release notes for Mac
> OS X

Reclosing this as fixed, instead reopening Miles' bug 89657 for the language pack packaging. Adding a note to the Platform compatibility OS X 5.0 release notes.
Comment 11 Frank Fuchs 2015-10-25 10:55:08 UTC
There seems to be a regression with the MAC OS X language packs of LO 5.0.3.2 (tested with the German language pack) OR the problem wasn't really fixed at all:

After opening the language pack .dmg file, double clicking on the install .app yields the OS X error message, that the .app is from an unverified developer. You need to open it with RMB and then install it.

Note: Once you install the respective language pack, I CAN NOT reproduce this error, i.e. if you once again open the same language .dmg file and double click on the .app, you only get the warning that the file was loaded from the internet. It seems that OS X only checks the signature once.
Comment 12 V Stuart Foote 2016-02-05 12:39:21 UTC
QA housekeeping -- closing this for duplicate bug 89657 that has preferred  developer review

*** This bug has been marked as a duplicate of bug 89657 ***