Page 1 of 1

Digital signing for OS X Mountain Lion

Posted: Fri Feb 17, 2012 9:11 am
by cidentan50
OS X Mountain Lion, due out this summer, will change the type of apps allowed to run. The default will be to only allow (1) apps from the Mac App Store and (2) apps from outside the app store that have been digitally signed by the developer with a certificate issued by Apple. The two other choices for this setting will be to allow "Mac App Store only" or apps from "Anywhere." BZFlag is distributed outside the Mac App Store, so it would be easiest for users if the game were digitally signed by the BZFlag team.

There is no approval/rejection process beforehand for either the app or the developer. Nor is there any fee. As I understand it, developers simply sign up for a free developer account, fill out an automated form, and the server instantly spits out a certificate file to use for signing the app.

Apple's idea here is to provide a small amount of security for apps not approved by Apple for it's app store. Signing links the binary to the developer's identity, giving Apple a kill switch if the developer turns evil. It also verifies to the OS that the binary wasn't tampered with by someone other than the developer. Yet at the same time, the kill switch and the restrictions on what apps are allowed to run are easily bypassed or disabled by the user.

More info here and here.

Re: Digital signing for OS X Mountain Lion

Posted: Fri Feb 17, 2012 12:00 pm
by blast
Yeah, I don't see us probably bothering with that. By the time 10.8 is out, we'll probably have already released our last version of BZFlag.

Re: Digital signing for OS X Mountain Lion

Posted: Fri Feb 17, 2012 10:58 pm
by Bullet Catcher
Apple says, "you can even temporarily override your setting by Control-clicking, and install any app at any time." So all we really have to do is be prepared to teach BZFlag players to install using control-click. It is easy enough to get an Apple developer account if we do choose to sign BZFlag.

Re: Digital signing for OS X Mountain Lion

Posted: Sat Feb 18, 2012 6:58 am
by cidentan50
The first time a new user launches an app that isn't from the app store and isn't signed, this is what they'll see:
Image
"You should move it to the Trash." (Source)

That could scare some users away, and a thought I just had was that parental controls might get an option to block the override for specific OS X accounts. That's speculation on my part, but it sounds like a feature Apple would likely add. Many BZFlag players are kids, but they might get blocked if their parents disable unsigned apps.

I've done something like this for Safari extensions (getting a digital certificate from Apple), and the process took no more than 5-10 minutes. It was very easy.

Re: Digital signing for OS X Mountain Lion

Posted: Mon Apr 09, 2012 8:21 pm
by allejo
My guess would be it's only some time until someone can get past the digital signatures in OS X 10.8

Re: Digital signing for OS X Mountain Lion

Posted: Mon Apr 09, 2012 9:20 pm
by joevano
Getting passed it is built it to the OS:
Even with the most restrictive setting of "Mac App Store Applications only", you can still force an app to run by right-clicking on it and selecting Open. This will display a warning that lets you override the restriction and run the application. Again, you only have to this the first time you run the app.
This should not be a really big issue...

Re: Digital signing for OS X Mountain Lion

Posted: Mon May 07, 2012 5:58 am
by dartman
But if you look at the warning, as Captain said, it would make it sound like BZFlag would harm the person's computer, which could scare away potential new players--which is the last thing BZFlag needs right now.
My guess would be it's only some time until someone can get past the digital signatures in OS X 10.8
Maybe, but why should we force users to work around it just because they're on a Mac, when doing it the right way is a quick, easy and free process?