App Store apps do not install properly on a fresh install of High Sierra on internal SSD or HDD

Hope this helps everyone:

1. Open a terminal
2. run the following command

sudo rm -f /Library/Keychains/crls/valid.sqlite3

I haven't tested, but I think a reboot is not even necessary. And this does survive a reboot.

It looks like this file may be used by "trustd". So worse case scenario, this will rebuid trustd's cache, so that should not affect the security of your system.

Enjoy!

@ FrancoisQC

Apparently I don't have an issue with High Sierra and App Store apps at the moment (keeping fingers crossed). I rebuilt High Sierra about six months ago from fresh after I installed an SSD to replace the spinner in my Mac mini 4,1 (Core 2 Duo... yes it still works fine).

Per your request I applied the codesign Terminal command to the 'File Spy'.app I installed at the time of the software rebuild. Here's what I got:

Authority=Apple Mac OS Application Signing

Authority=Apple Worldwide Developer Relations Certification Authority

Authority=Apple Root CA

And another for 'Ka-Block!'.app:

Authority=Apple Mac OS Application Signing

Authority=Apple Worldwide Developer Relations Certification Authority

Authority=Apple Root CA

Finally another for 'Magic Lasso'.app:

Authority=Apple Mac OS Application Signing

Authority=Apple Worldwide Developer Relations Certification Authority

Authority=Apple Root CA

oops... found one more, 'The Unarchiver'.app:

Authority=Apple Mac OS Application Signing

Authority=Apple Worldwide Developer Relations Certification Authority

Authority=Apple Root CA

That's it. Those are the only four apps I've installed through the App Store. All of the other non-Apple apps have come from either individual third-party websites or I've installed using MacPorts. At this point, given all the issues High Sierrans have had since the release of Big Sur, I'm not comfortable nor confident in installing App Store apps until such a time when Apple addresses this (if at all, given the impending/actual EOL status of High Sierra).

Hope the info I've provided helps in your research.

@ FrancoisQC

I tried the codesign extract command on all four of my apps but could not find any extracted certificates. I searched the working directory I used, my home directory, the Contents subdirectory within each app bundle, and the root directory but could not find them. Obviously trying to run the openssl commands gave up "file not found" type errors. So, unless these extracted certificates are being slyly hidden in some other directory, the extraction command may have not extracted anything.

edited for grammar

cavenewt wrote:

Incidentally, here is my exact HS version as reported in the System Report:

macOS 10.13.6 (17G14033)

In case it matters, this is the version number I have since rebuilding my machine in March 2020 and just applying software updates via the command line 'softwareupdate' command: 10.13.6 (17G14042)

For what it is worth, I finally got around to downloading four apps from Mac App store. (As a brief review, I rebuilt my High Sierra install in Feb/Mar 2020 so initially I did not have issues with Mac App store installs/updates.) Those apps were three from Apple (Numbers, Keynote, and Pages) and one from Cutedge (Liya).

To make it short, all four apps installed (for Pages I had to sign out of the App store and sign in again as the download for that errored out four times until I did). While I can launch and use all four apps from the Finder and Dock, the App store does not recognize the fact that they are installed. Neither the Purchase page nor the product page for each of these four apps shows them to be installed.

However, all app store apps installed prior to the Nov 12-ish time frame show as installed in the App store and the Open buttons for each work as expected.

As to the "valid.sqlite3" database, mine is version 145 @ 7.2 MB in size.

[edited for grammar]

jlhopes22 wrote:

That's great news! Will that update come down automatically, or is there something we need to do?

I have no idea how I received the new version 147 database but I suspect I got it when I had to reload the OS from the recovery drive earlier today.

While I had hope to not have to touch my seemingly working system, messing around with Android phone app transfer utilities made for macOS left my system in a highly unstable state when I went through the uninstall process for those apps. Sadly, I was not able to Safe Boot so I crossed my fingers and did the OS reload from Recovery. Apparently it all worked AND I got the new updated DB. Previous to the recovery, mine was version 145.

Do I suggest everyone do an OS reload from Recovery? Not unless you really have to I suppose. I haven't yet checked the status of the App Store pages to see if they are now synched with my installed apps but I'll do that later. For now I'm just thankful the recovery went without an issue thus far.

Stephen Adams wrote:

I haven't yet checked the status of the App Store pages to see if they are now synched with my installed apps but I'll do that later.

Found the time to play with the App Store and no, the status of apps I installed is not in synch with the Purchased page or individual product page in the App Store app. But, all the apps I did install are working just fine regardless of what the App store shows. :)

ok, so here is another update. After extracting all certs from the .app, and looking at codesign0 (Apple Mac OS Application Signing), the cert does not have a CRLdp, so CRL revocation is not the issue. But it does have a AIA extension which points to the OCSP server at http://ocsp.apple.com/ocsp03-wwdr08.

Using "openssl ocsp" to verify the certificate, the OCSP server responds with a "good" response, meaning the certificate is indeed valid. Looking at the network trace of this OCSP request, we can see that the OCSP response is signed (ok, the response is secure), but extracting the signing certs from the pcap, the cert who signed the response is like this:

• • Common Name: WWDR OCSP Responder MG2
  • Issued by: Apple Worldwide Developer Relations Certificate Authority
    • the one expiring on Feb 7, 2023
  • Valid from: November 4, 2020 at 5:03:29 PM GMT-5:00
  • Valid until: December 16, 2020 at 5:03:29 PM GMT-5:00

This is strangely close to when people seem to have started experiencing issues...

Both the OCSP response signer and its issuer are not in the default System Roots keychain. And manually adding them to the System keychain does not help, the Apple Mac OS Application Signing certificate remains detected as revoked.

I don't want to block OCSP requests by modifying /etc/hosts, this is a bad security practice and does not address the real issue.

That is exactly the same problem I experienced with my MacBook Pro. I have two internal drives (SSD and HDD) for years now, don't think that's the point. I think it is on Apple to fix something with their App Store servers.

Apps from Mac App Store crash when started (CODESIGNING error)

I'm having the same issue on a mid 2011 iMac 21.5 inch running macOS High Sierra 10.13.6. I clean installed the OS for the second time and still having the same issue. The apps that I purchased outside the AppStore work. I didn't have any issues before I clean installed the OS couple of days ago.

Exactly the same situation here. After clean installing High Sierra I got the same updates in the App Store. Security update 2020-005 then Security update 2020-006 and after installing those security updates I got the 004 security update error message. I'm not sure if this issue is related to the wide spread issue with Apple servers that happened on Thursday, but if it is the same issue why hasn't it get fixed for us while it got fixed for others?

Did you try disabling Gatekeeper and installing an app from the AppStore?

Open the Terminal app then enter the following command syntax:

sudo spctl --master-disable

if it didn't solve the issue re-enable Gatekeeper run the following command in the Terminal app

sudo spctl --master-enable

I have had the same issue. Had no issues until last Thursday (release of Big Sur). I have wiped my SSD and did a new OS install of High Sierra (10.13.6) but still having the same issue even after all security updates have finished and have been installed. Even tried signing the program myself using Xcode and in terminal I did "sudo codesign --force --deep --sign - /Applications/Application.app". It seemed to have worked momentarily but again, reverted back to the same issue, and some apps continued to not open. Contacted apple support and they clearly weren't aware of the situation, nor could they help me. Definitely something on Apples end. Just hoping they can fix it sometime soon as I do need some of these apps for work and such.