App Store apps do not install properly on a fresh install of High Sierra on internal SSD or HDD

Did you see this???

stephán193

Nov 18, 2020 10:31 AM in response to GrenadeBait

I was introduced a solution that works with some apps. 

Open terminal and type:

sudo codesign —deep -fs - /Applications/Pages.app

After typing -fs - you can drag your desired application. I tried it with pages. While it now opens and gives me the option to either create a new document or open an existing one, it closes again after I chose one of said options. But with some other apps it actually worked.  

https://discussions.apple.com/thread/252030900?answerId=253912973022#253912973022

Might try this from Viking OSX...

https://discussions.apple.com/thread/252062728?answerId=253923443022#253923443022

Click the Update panel in your Mac App Store, and apply all available updates. Then reboot your Mac, and just once, press the shift key while launching Pages, so it will not attempt to use its last (crashed) application state.

I am in the category of users with this problem that recently installed MacOS High Sierra to an external SSD. Many, almost all my AppStore purchased apps fail, giving the "... quit unexpectedly" message.

Fortunately, I still have a working system on the internal HDD. If I boot up from the internal HDD, all apps in the /HDD/Applications folder run. I can even run the apps that are installed in the /SSD/Applications folder on the SSD.

When running the system from the HDD the command,

sudo codesign --display --verbose=4 /Applications/Numbers.app

reports,

Authority=Apple Mac OS Application Signing

Authority=Apple Worldwide Developer Relations Certification Authority

Authority=Apple Root CA

Info.plist entries=40

When running the system from the SSD, the command reports

Authority=(unavailable)

Info.plist=not bound

@DCamaion: can you compare the Apple-owned Certificates in KeyChain? Compare the ones from when you boot with the HDD, vs the ones you boot from the external drive.

Things I would be looking for:

• Are the certs the same? Any missing? Any extra?
• Are they all in System Roots, or are there some in other containers like System or login or Local Items?

Sorry don't understand "Convert the DER-encoded (binary) certificate to PEM using openssl." However, the code sign command issues the same information when booted up on the HDD as on the SSD.

Checked again, App Store apps run without problem on the HDD installation but not on the SSD installation.

To reiterate, the difference between the two is that the HDD installation is legacy while the SSD installation is a recent clean install. Both installations having been fully updated through the App Store.

Hey, DCmaion, something is not right. You said this:

Line-by-line the System Roots Apple certificates in the SSD installation look the same as in the HDD installation. Specifically, Apple Root CA, Apple Root CA - 1, Apple Root CA - 2, Apple Root CA - 3, and Apple Root Certificate Authority.

But what I have in mine is

• • Apple Root CA - expires Feb 9, 2035
  • Apple Root CA - G2 - expires April 30, 2039
  • Apple Root CA - G3 - expires April 30, 2039
  • Apple Root Certificate Authority - expires Feb 9, 2025

When you run the codesign with --extract-certificates, this should create files, which would be the CA certificate chain. Either upload here, or make available somewhere else, I will convert them.

Sorry , a misunderstanding, I did not mean all the certificates are the same. Instead each of the said certificates on the SSD is the same as the corresponding certificate on the HDD. Expiration dates you posted are the same as on the certificates in my keychains.

As far as I can tell, The command did not write files. Here is what was reported for Numbers:

iMac:~ $ codesign -dvvvv --extract-certificates /Applications/Numbers.app

Executable=/Applications/Numbers.app/Contents/MacOS/Numbers

Identifier=com.apple.iWork.Numbers

Format=app bundle with Mach-O thin (x86_64)

CodeDirectory v=20200 size=116247 flags=0x2200(kill,library-validation) hashes=3625+5 location=embedded

VersionPlatform=1

VersionMin=658688

VersionSDK=658944

Hash type=sha256 size=32

CandidateCDHash sha256=e271ff47ffa0f79028790448828ef7c3e8a272b7

Hash choices=sha256

Page size=4096

CDHash=e271ff47ffa0f79028790448828ef7c3e8a272b7

Signature size=4617

Authority=Apple Mac OS Application Signing

Authority=Apple Worldwide Developer Relations Certification Authority

Authority=Apple Root CA

Info.plist entries=40

TeamIdentifier=K36BKF7T3D

Sealed Resources version=2 rules=13 files=30839

Internal requirements count=1 size=112

Thank you so much for everything you are doing FrancoisQC. You are our only hope at fixing this issue. Especially if they only have before-September High Sierra macs at apple. As for me, I have been using Logic Pro X on a freshly installed HS with no updates. It worked at first and then it gave me the signature error anyway. Once I got to this point, I used these two commands:

xcode-select --install

and then:

sudo codesign --force --deep --sign - /Applications/Logic\ Pro\ X.app 

I have now been using Logic Pro X for 2 days and it is running fine so far. I hope this can help someone. Of course this is only temporary and Apple should fix their software but in case they never do, this seems to be working.

Forget about everything I mentioned above, I was not able to reproduce the success... Since my post above, I again did a full reinstall of HS from scratch (HDD erased prior to reinstall from USB). Prior to installing High Sierra updates, I downloaded MS Remote Desktop app, tried it: same crash.

Downloaded and installed "What's your sign" again. Again, the very first time you check the app's signature, it says

Microsoft Remote Desktop signed, but certificate has been revoked!

signed, but no signing authorities (adhoc?)

Then immediately recheck the app's signature, now it shows

Microsoft Remote Desktop is validly signed & Notarized

Signer: Apple Dev-ID

...

sign auth:

Apple Mac OS Application Signing

Apple Worldwide Developer Relations Certificate Authority

Apple Root CA

But even with this successful signature check, trying to start the app now keeps on failing.

What is the difference between the successful use-case above vs the latest one that failed: no idea.

... and this is still without the 005-006 security updates.

I also tried reinstalling Remote Desktop, turning off wifi, and checking the certs and starting the app, in case High Sierra checks a CRL online, same error.

Could the CRL have been cached? possibly...

Could this be related to the OCSP issue reported recently by Jeff Johnson? possibly...

I don't think the 005 or 006 security update have anything to do with the problem, as even from a fresh install from USB I get this. 3rd full reinstall today, trying to nail this down.

Running a tcpdump from 1st login after install to post-install-and-run: all of the TLS traffic and OCSP traffic shows a "good" certificate status, and all response timestamps fit within a valid response time window.

There is an OCSP deamon running (ocspd), trying to find how to disable it and/or disable any kind of ocsp/crl checks.

This is getting annoying...

Here is something interesting. Install "What's your sign", turn off WiFi, reboot.

Log back in, click "Signer Info" on "MS Remote Desktop" for as many time as you want, you still get the "Certificate Revoked" error with "signed, but no signing authorities (adhoc?)" message.

Connect to wifi, check Signer Info once: cert revoked. Check twice: back to listing the CA chain.

So the "What's your sign" app is able to build (and download??) the CA chain, or get the Apple Security Framework to build and display the chain. But High Sierra itself refuses to do it...

Users with access to an functioning startup disk or Time Machine backup may be interested trying what I did yesterday. I used the migration assistant (https://support.apple.com/en-us/HT203981) to migrate the system, applications and user files on my internal HDD to an external SSD. I had done a clean-install of High Sierra to that SSD. It had the problem described above, i.e., downloaded App Store apps failed to run. This problem disappeared after the migration. I deleted Keynote and reinstalled from the AppStore. It launched and ran without problem.

Previously, I reported that installing to a SSD using the Recovery to restore from a Time Machine backup reformatted the drive to MacOS extended. The Migration Assistant did not change the format of the SSD which was formatted APFS.

The down side is that my SSD installation is not "clean" anymore. All those legacy files I hoped to loose by doing a clean install, got installed anyways, along with whatever file(s) corrected the problem.

At least now my 2011 iMac is noticeably more responsive running from the SSD connected to the thunderbolt port.