Bug 481009

Summary:	Cannot open LabPlot2 after installation via DMG
Product:	[Applications] LabPlot2	Reporter:	michael.huebner
Component:	general	Assignee:	Stefan Gerlach <stefan.gerlach>
Status:	RESOLVED FIXED
Severity:	major	CC:	o.freyermuth, stefan.gerlach
Priority:	NOR
Version:	2.10.1
Target Milestone:	---
Platform:	macOS (DMG)
OS:	macOS
Latest Commit:		Version Fixed In:
Sentry Crash Report:

Description michael.huebner 2024-02-07 13:25:14 UTC

SUMMARY
LabPlot is not signed and installing it requires disabling OS security features.

STEPS TO REPRODUCE
1. Download DMG file from here: https://download.kde.org/stable/labplot/labplot-2.10.1.dmg
2. Open DMG file and open LabPlot on an ARM Mac

OBSERVED RESULT
App will not open with an error message stating that the developer cannot be verified. This can only be circumvented by disabling security features by hand (thus major severity).

EXPECTED RESULT
App should open without having to disable security mechanisms.

SOFTWARE/OS VERSIONS
macOS: 14.1.2

ADDITIONAL INFORMATION
Signing the software should fix the problem. This would also help getting LabPlot into the official Homebrew repository. At the moment, it cannot be added because of this issue.

Comment 1 Stefan Gerlach 2024-02-13 12:11:12 UTC

We are currently switching to gitlab for building DMG images which supports signing. We will publish new installers as soon as this works.

Comment 2 michael.huebner 2024-02-15 16:20:08 UTC

(In reply to Stefan Gerlach from comment #1)
> We are currently switching to gitlab for building DMG images which supports
> signing. We will publish new installers as soon as this works.

Thanks a lot! Do you already have a rough estimate for the timeline, so I can plan when to work on including this in Homebrew?

Comment 3 Stefan Gerlach 2024-02-19 22:12:49 UTC

We now have signed installer for x86_64 and arm64. Due to a bug in XCode they only work on macOS 14 (Sonoma). The installer can be found on the SourceForge page https://sourceforge.net/projects/labplot/files/labplot/2.10/
Any comments or bug reports are welcome.

Comment 4 michael.huebner 2024-02-26 12:55:18 UTC

(In reply to Stefan Gerlach from comment #3)
> We now have signed installer for x86_64 and arm64. Due to a bug in XCode
> they only work on macOS 14 (Sonoma). The installer can be found on the
> SourceForge page https://sourceforge.net/projects/labplot/files/labplot/2.10/
> Any comments or bug reports are welcome.

Thanks a lot! Unfortunately, with the new installers the app cannot be opened due to "App is damaged and can't be opened. You should move it to the Bin". Apparently, it has been quarantined by the Mac automatically, which can be fixed with something like:
xattr -d com.apple.quarantine /path/to/labplot2.app

If I understand the discussion here correctly (https://github.com/orgs/Homebrew/discussions/4302), there is also a quarantine attribute that can be set when signing an app. This could possibly fix the issue.

Comment 5 Stefan Gerlach 2024-02-27 15:36:16 UTC

The quarantine flag is added to the package when downloading so it can't be avoided by changing settings of the package. What we need is to notarize the package from Apple which should be possible by the KDE infrastructure. I will work on this.
In the meantime i added a note on the download page on how to fix this flag. Thanks for finding this out.

Comment 6 michael.huebner 2024-08-13 08:29:41 UTC

(In reply to Stefan Gerlach from comment #5)
> The quarantine flag is added to the package when downloading so it can't be
> avoided by changing settings of the package. What we need is to notarize the
> package from Apple which should be possible by the KDE infrastructure. I
> will work on this.
> In the meantime i added a note on the download page on how to fix this flag.
> Thanks for finding this out.

Thanks a lot for tackling this! I can confirm that it works now on my machine. As promised, I just opened a PR for the official Homebrew repository: https://github.com/Homebrew/homebrew-cask/pull/182259