Bug 447441

Kid3 was never signed, neither 3.9.0, nor 3.8.7 nor any older release, so it does not make sense why it should be refused to open on macOS 11.6.2. Maybe this is a false positive detection of macOS.

You could try the alternative version which is built with Qt 6 and requires at least macOS Mojave: https://sourceforge.net/projects/kid3/files/kid3/development/kid3-3.9.0-Darwin-Qt6-Mojave.dmg

If this version is also refused when using "Open" from the finder context menu (assuming it still exists in mac OS 11.6.2), you could try the build from the KDE build factory, which is signed by KDE: https://binary-factory.kde.org/job/Kid3_Nightly_macos/. Get the DMG from the artifacts at the top of then Jenkins page.

Kid3 is a great program and I'm satisfied with 3.8.7
You should be aware that MacOS is the safest OS and that the rules
will be tightened from day by day to keep it safe.
So, I expect that you will start to sign future releases.

Besides, I hope to continue the use of Kid3
when I'm forced to switch to Silicon hardware.
Another thing that's out of our hands.
;JFL.

On 23/12/2021 19:49, Urs Fleisch wrote:
> https://bugs.kde.org/show_bug.cgi?id=447441
>
> --- Comment #1 from Urs Fleisch <ufleisch@users.sourceforge.net> ---
> Kid3 was never signed, neither 3.9.0, nor 3.8.7 nor any older release, so it
> does not make sense why it should be refused to open on macOS 11.6.2. Maybe
> this is a false positive detection of macOS.
>
> You could try the alternative version which is built with Qt 6 and requires at
> least macOS Mojave:
> https://sourceforge.net/projects/kid3/files/kid3/development/kid3-3.9.0-Darwin-Qt6-Mojave.dmg
>
> If this version is also refused when using "Open" from the finder context menu
> (assuming it still exists in mac OS 11.6.2), you could try the build from the
> KDE build factory, which is signed by KDE:
> https://binary-factory.kde.org/job/Kid3_Nightly_macos/. Get the DMG from the
> artifacts at the top of then Jenkins page.
>

I am glad that you like Kid3. Did you have the opportunity to check whether the other two packages I mentioned have the same problem? Also I have not heard before that it is no longer possible to run an unsigned app by using the "Open" action from the Finder or context menu and then selecting "Open" in the confirmation dialog. Have you tried that?

At the time of writing this message, kid3-3.9.0-Darwin.dmg has been available for less than a week and has been downloaded 1500 times. Since nobody else has complained so far, there is a possibility that the program works (unless the other 1499 downloaders are undemanding or not using Big Sur).

Concerning the signing of packages: See Bug 422123 to read why I am not willing to pay USD 99 every year to a company which really does not need my money. Why should projects which are completely free and do not earn any money pay money to Apple? Maybe this tax will keep Apple fans from using using "unsecure" open source software and limit them to "safe" Apple products. On https://kid3.kde.org/#download you will find signatures for all binary packages, so you can check if the package was really signed with my GPG key. You could also get the source code and build the DMG using the build.sh script in the top level source directory, you will also find instructions on how to do so on macOS in the comment at the top of this script.

This is all going above my head;
I'll leave it to more experienced users to do the research.
Btw.: Big Sur did not give me any chance to allow the open;
it said "Bin or cancel".
I'll await the future events.
Happy 2022.
;JFL.

On 24/12/2021 14:12, Urs Fleisch wrote:
> https://bugs.kde.org/show_bug.cgi?id=447441
>
> --- Comment #3 from Urs Fleisch <ufleisch@users.sourceforge.net> ---
> I am glad that you like Kid3. Did you have the opportunity to check whether the
> other two packages I mentioned have the same problem? Also I have not heard
> before that it is no longer possible to run an unsigned app by using the "Open"
> action from the Finder or context menu and then selecting "Open" in the
> confirmation dialog. Have you tried that?
>
> At the time of writing this message, kid3-3.9.0-Darwin.dmg has been available
> for less than a week and has been downloaded 1500 times. Since nobody else has
> complained so far, there is a possibility that the program works (unless the
> other 1499 downloaders are undemanding or not using Big Sur).
>
> Concerning the signing of packages: See Bug 422123 to read why I am not willing
> to pay USD 99 every year to a company which really does not need my money. Why
> should projects which are completely free and do not earn any money pay money
> to Apple? Maybe this tax will keep Apple fans from using using "unsecure" open
> source software and limit them to "safe" Apple products. On
> https://kid3.kde.org/#download you will find signatures for all binary
> packages, so you can check if the package was really signed with my GPG key.
> You could also get the source code and build the DMG using the build.sh script
> in the top level source directory, you will also find instructions on how to do
> so on macOS in the comment at the top of this script.
>

I have asked a Mac specialist about the problem, and he confirmed that it has become more difficult for users to run applications from unidentified developers, but it is still possible. You have to click the "Open Anyway" button in the "Security & Privacy" section of the system preferences. The procedure is described in https://support.apple.com/en-us/HT202491#view (section "If you want to open an app that hasn’t been notarized or is from an unidentified developer").

As I said before, you could use a nightly build from https://binary-factory.kde.org/job/Kid3_Nightly_macos/, these DMGs are signed by KDE, or you could settle for the PGP signature published on https://kid3.kde.org/#download.

*** This bug has been marked as a duplicate of bug 422123 ***

The "Open Anyway" button no longer exists in Big Sur .....
I will stick to 3.8.7 till I must switch to Silicon hardware.
;JOOP!

On 29/12/2021 14:11, Urs Fleisch wrote:
> https://bugs.kde.org/show_bug.cgi?id=447441
>
> Urs Fleisch <ufleisch@users.sourceforge.net> changed:
>
>             What    |Removed                     |Added
> ----------------------------------------------------------------------------
>           Resolution|---                         |DUPLICATE
>               Status|REPORTED                    |RESOLVED
>
> --- Comment #5 from Urs Fleisch <ufleisch@users.sourceforge.net> ---
> I have asked a Mac specialist about the problem, and he confirmed that it has
> become more difficult for users to run applications from unidentified
> developers, but it is still possible. You have to click the "Open Anyway"
> button in the "Security & Privacy" section of the system preferences. The
> procedure is described in https://support.apple.com/en-us/HT202491#view
> (section "If you want to open an app that hasn’t been notarized or is from an
> unidentified developer").
>
> As I said before, you could use a nightly build from
> https://binary-factory.kde.org/job/Kid3_Nightly_macos/, these DMGs are signed
> by KDE, or you could settle for the PGP signature published on
> https://kid3.kde.org/#download.
>
> *** This bug has been marked as a duplicate of bug 422123 ***
>

There is now a link to a signed package for ARM64 Apple Silicon on the Kid3 Homepage, see https://invent.kde.org/multimedia/kid3/-/issues/573.

I finally managed to build signed an notarized packages for both the arm64 and x86_64 via the KDE CI/CD infrastructure. Could you please check if kid3-git20240810-Darwin-arm64.dmg and kid3-git20240810-Darwin-amd64.dmg from https://sourceforge.net/projects/kid3/files/kid3/development/ are working correctly?