06-21-2019, 03:13 PM | #1 | |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
Sigil for Mac & macOS 10.15 Catalina
I started this discussion in a Catalina thread on the Apple forum and was asked to take it elsewhere.
Starting with macOS 10.15 Catalina, Apple is requiring app notarization by default: "Mac apps, installer packages, and kernel extensions that are signed with Developer ID must also be notarized by Apple in order to run on macOS Catalina." Meanwhile, this discussion on MacRumors suggests Catalina's Gatekeeper can be overridden via System Prefs > Security or spectl to allow unsigned/unnotarized apps to run. KevinH weighed in on the new notarization requirement thus: Quote:
Thank you |
|
06-21-2019, 04:13 PM | #2 |
Sigil Developer
Posts: 7,644
Karma: 5433388
Join Date: Nov 2009
Device: many
|
See the related discussion I had with Kovid here:
https://www.mobileread.com/forums/sh...43#post3859243 His plan is a wait-and-see approach but the new "hardened runtime" requirement would be an issue for Calibre as well. To be notarized an app must use the Apple hardened runtime. The only way to get Sigil to use the hardened runtime would be to ask for almost all of the entitlements (exceptions) as both Sigil and Calibre use python plugins which may load many python packages and associated shared libraries and modules, none of which we sign), we both use QtWebKit/QtWebEngine which means we use JIT compilation, javascripts, and areas of the stack are walked for garbage collection, etc. Access to user's Photos, Audio, and Video would be restricted. They do not want you to allow the user to run a debugger to help track down an error, they do not want you to use DYLD library path setting, and etc. Basically, Apple views any 3rd party app as an "attack vector" for an uncaught virus or malware, instead of a real app. This makes no sense at all. If anyone gets physical access to your mac machine, you are screwed anyway. The silly thing is anyone can write a python plugin package that does anything it wants and a user could install that and run it via Sigil or Calibre or even from the command line, so this notarization is effectively shutting a barn door after all the animals inside have already fled. So my plan is similar to Kovids. First wait and see what develops. The beta is allowing us both to run now since we are signed but that may change. If that door closes, the problem will be figuring a way to actually get our apps to work with the "hardened runtime" if at all possible. If so, I will try for "notarization" but it might be impossible to actually pass that requirement even when asking for almost all of the exceptions. If I can not get notarization to pass, then we come to a real problem. As long as Apple allows unsigned and unnotarized apps to be run, I will simply stop signing it (actually lessening security not increasing it) and keep releasing. If Apple ever prevents power users from installing and running the apps we want, I will simply stop being a Mac user. At that point, some other Apple volunteer developer would have to step up, redesign Sigil to curtail or limit its usefulness to fit the hardened runtime limits or development on macOS would stop. Last edited by KevinH; 06-21-2019 at 04:20 PM. |
Advert | |
|
06-21-2019, 08:20 PM | #3 | |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
Quote:
If Apple insists on driving developers like you and KovidGoyal away, I will likely abandon Mac as well — words I thought I'd never say. The last non-Mac operating system I used was DOS. I have never used Windows or Linux, and the thought of leaving Mac is daunting and deeply unhappy-making. |
|
10-05-2019, 03:54 PM | #4 |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
With regard to notarization, here are two interesting articles that may (or may not) include useful information if notarization is a no-go for Sigil: disabling Gatekeeper on Catalina and Catalina Security Explained
Last edited by odamizu; 10-14-2019 at 01:55 PM. |
10-14-2019, 01:54 PM | #5 | |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
Good news! Looks like all my worry about notarization is moot.
From Apple Support: Quote:
|
|
Advert | |
|
10-14-2019, 02:15 PM | #6 |
Banned
Posts: 168
Karma: 10010
Join Date: Oct 2018
Device: Tolino/PRS 650/Tablet
|
Did you already updated to catalina?
|
10-14-2019, 02:29 PM | #7 |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
Not yet. I've been trying to find time to install it on an external SSD for testing purposes. Hopefully this week.
(I don't plan to update my primary Mac any time in the foreseeable future because I have 32-bit apps I need.) |
10-14-2019, 03:21 PM | #8 | ||
Grand Sorcerer
Posts: 27,548
Karma: 193191846
Join Date: Jan 2010
Device: Nexus 7, Kindle Fire HD
|
Quote:
|
||
10-14-2019, 11:56 PM | #9 |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
This whole notarization thing has been rather murky from the start.
A lot of developer talk is over my head, but early discussion on the Internet suggested it would only apply once an app was signed or if it was downloaded from the Internet, or that Gatekeeper could be overridden using a Terminal command (spctl) or overridden the way Apple now confirms it can be — all of which would allow a developer to test on other machines they own without notarizing. kovidgoyal said Gatekeeper is triggered by downloading with Safari here: https://www.mobileread.com/forums/sh...84#post3886884 In any case, I am hopeful this is now moot Last edited by odamizu; 10-15-2019 at 12:28 AM. |
10-15-2019, 03:46 AM | #10 |
Banned
Posts: 168
Karma: 10010
Join Date: Oct 2018
Device: Tolino/PRS 650/Tablet
|
I replaced PiBaker last weekend. This was my last 32 bit App. Ok, one exception, i still have ADE 2.something to test ebpubs with that version. But usage is very rare.
|
10-15-2019, 02:31 PM | #11 |
Bibliophagist
Posts: 35,380
Karma: 145435140
Join Date: Jul 2010
Location: Vancouver
Device: Kobo Sage, Forma, Clara HD, Lenovo M8 FHD, Paperwhite 4, Tolino epos
|
For what it's worth, I cloned my Mojave VM and updated the clone to Catalina over the weekend (long weekend here for Thanksgiving). Calibre 4.1 and Sigil 9.1.8 downloaded, installed and ran with the usual Mac query over trusting the application. Now I just need to clean out the remaining 32-bit apps.
|
10-15-2019, 03:44 PM | #12 |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
It does appear that the notarization requirement is not as stringent as Apple first implied, and KevinH and DiapDealer can leave Sigil unnotarized if notarization turns out to be too much of a pain in the behind
|
10-15-2019, 03:59 PM | #13 |
Grand Sorcerer
Posts: 27,548
Karma: 193191846
Join Date: Jan 2010
Device: Nexus 7, Kindle Fire HD
|
I'm determined not to pay the extortion money they want to keep Windows from popping warnings about unknown publishers.
It's not really even the money at this point (though the prices ARE ridiculous--and getting more so). It's the hoops I would have to jump through and the documents I would have to provide just to be allowed to spend too much money on a certificate (assuming one doesn't want to get a fly-by-night cert). All just to eliminate a pop-up warning that can be easily dismissed. I'm not p(l)aying. |
10-15-2019, 04:23 PM | #14 |
just an egg
Posts: 1,586
Karma: 4300000
Join Date: Mar 2015
Device: Kindle, iOS
|
Is Apple charging a fee for notarization?!
|
10-15-2019, 04:32 PM | #15 |
null operator (he/him)
Posts: 20,567
Karma: 26954694
Join Date: Mar 2012
Location: Sydney Australia
Device: none
|
Apparently so, for popup Windows only
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Notarizing App for macOS Catalina | KevinH | Development | 31 | 09-19-2019 07:52 AM |
MacOS 10.15 Catalina Beta Discussion Thread | OtinG | Apple Devices | 40 | 08-21-2019 07:51 AM |
Sigil doesn't work with MacOS Mojave dark mode | kawayama | Sigil | 7 | 05-22-2019 08:47 AM |
Epub crashes on Sigil for Mac, OK on Sigil for PC | crystamichelle | Sigil | 6 | 08-14-2013 02:52 PM |
Bug reports & advices for next versions (0.6.32 MacOS X) | neotheone | Calibre | 2 | 01-07-2010 01:14 PM |