OS X build signature

[Stephan Bergmann]

On 02/10/2015 02:22 PM, Stephan Bergmann wrote:
> On 01/30/2015 12:38 AM, V Stuart Foote wrote:
>> So with release of 4.4.0 we appear to still have issues with OS X 10.9
>> and
>> 10.10 Gatekeeper fussing over the package signing.
>
> should be fixed on master towards LO 4.5 with
> <http://cgit.freedesktop.org/libreoffice/core/commit/?id=615fae2f67028f3c5c51c70c77dbaa9b9f3856d6>
> "Attempt at fixing Mac OS X code signing;" backports to libreoffice-4-4
> and libreoffice-4-4-1 pending

What appears to be still an open issue is what to do with the LO 
language packs on Mac OS X (cf. 
<https://bugs.documentfoundation.org/show_bug.cgi?id=89561> "4.4.1RC2 on 
OSX10.10: LO Language Pack can't be opened - security pref block install"):

For one, the language packs are not signed at all, so opening one by 
default leads to the "..." error and requires the "ctrl-click - Open - 
Open" dance.

For another, our language pack mechanism copies files into an existing 
LO installation, which is not endorsed at least by the updated (>= 
10.9.5) GateKeeper:

If the installed LO had never been started before the language pack is 
installed into it, trying to open LO leads to a "'LibreOffice' is 
damaged and can't be opened. You should move it to the Trash." error and 
requires to lower "System Preferences... - Security & Privacy - General 
- Allow apps downloaded from: Anywhere."

If the installed LO had already been started before the language pack is 
installed into it, it appears that Gatekeeper does not re-verify the 
modified LO installation, and allows to open LO (at least on 10.10.2).

(The LO SDK for Mac OS X is not signed, either, but I guess that is kind 
of acceptable for such a developer-facing tool.)