numbles45 wrote:
The interesting question that you seem to have skipped was: "the apps and System Preferences aren't querying the TCC permissions from the same database. How can that be?"
There's only one database to query. However, there may be multiple apps. For example, many modern apps are "electron" apps. They consist of an HTML web browser wrapper around a cross-platform core. Even if they aren't truly "electron", sometimes apps use a similar strategy with a native UI wrapper around what is essentially a command-line tool. When they do this, those are multiple apps. Which one gets the TCC permissions? (That's a rhetorical question, by the way. No one knows the answer, including the developer.)
Your response from BetterSnapTool is pretty good:
It can also happen if the code signature of an app changes for whatever reason (e.g. buggy update, broken disk, some other software that „accidentally“ breaks the signature). At least for BetterSnapTool the code signature hasn’t changed through updates.
There are a lot of those "whatever reasons". And it just so happens that these kinds of "haxie" tools are more likely than most to employ these techniques. So, in addition to what I mentioned above, consider some of these other scenarios:
buggy update - Any kind of auto-update mechanism is likely to trigger this. In theory, it is possible to update an app and its signature. It just doesn't happen bloody often.
broken disk - I have no idea what they are talking about there.
some other software that "accidentally" breaks the signature - All kinds of possibilities here. Ironically enough, some of these are these same system modification apps that are so popular. Monolingual will remove "foreign" (i.e. non-English) language from apps - breaking the signature. Little Snitch can interfere with virtually everything. Any kind of "security" software can cause similar problems.
Apple's Gatekeeper software lives up to its name. It checks an app's signature after an app has been first downloaded. But after that, Apple typically doesn't verify signatures. Apps also typically don't verify their signature either. So if a signature becomes invalid for whatever reason, nobody is going to know. But something like TCC that double-checks signatures is going to be the one to find it. Plus, sometimes these apps may try some tricks to avoid Gatekeeper problems. That's good for avoiding Gatekeeper problems, but not for avoiding TCC problems.
I’d really like to know whether this is something that needs to be addressed by Apple or if app developers are missing something here and need to be helped.
Does it matter? Whether the ultimate cause is Apple or 3rd party developers, there's nothing you can do to affect any change. Apple's software could very well have bugs. So could 3rd party apps. Every app is different. Can you use command line tools to hack around on the database and fix it for a time? Maybe.
I think one thing you can do is be careful with auto-updates for these kinds of apps. I think that would go a long ways towards alleviating this problem. Next time one breaks during an update, make a note of it. Uninstall the app completely, restart, then reinstall. I suspect you might find that certain apps are more likely to exhibit this particular problem than others. If that happens, then you might lean a little bit closer towards it being the fault of 3rd party developers. But still, it won't really mean anything.
