10.12.3 Combo update failing code sign verification, certificates fail, and mysterious error message from the Mac Store

chase_daniel wrote:

Linc Davis' bash script Question regarding the messages in the system log identified at least one bad kernel extension and single user mode identified even more, specifically those ???? ones.

If you want more information about Linc Davis' bash script, you will have to find him and ask him. No one here knows.

It's 'normal' in the sense that it's what is always reported by the 'sudo kextstat -arch' command on every installation of Sierra including brand new machines straight from Apple.

C.

Unknown architecture isn't "normal."

The kextstat output you posted is normal.

If you are having trouble with your Mac, explain what it is. Please be as specific as possible.

What exactly makes you say its completely normal? Linc Davis' bash script Question regarding the messages in the system log identified at least one bad kernel extension and single user mode identified even more, specifically those ???? ones.

Unknown architecture isn't "normal."

"Stop using unsupported symbols

In addition, the exported KPI symbol lists are cleaned up for the 64-bit environment. If your code uses functions that are not exported by the 64-bit kernel, you will receive compile-time or load-time errors. https://developer.apple.com/library/content/documentation/Darwin/Conceptual/64bi tPorting/KernelExtensionsandDrivers/Kern…

".kpi" means its a network kernel extensions which "monitor and modify network traffic, and can receive notification of asynchronous events from the driver layer, such as interface status changes."https://developer.apple.com/library/content/documentation/Darwin/Conceptual/NKEC onceptual/intro/intro.html

ChaseDaniel was running codesign against the package itself, not the containing disk image. But generally, spctl does provide much more detailed information about signatures. It is much slower though. You can run it against the installer package too.

Threads like this are getting to be more and more common. Apple tries hard to present a "seamless" ecosystem, but lately they have been struggling with that. So people see the facade of grandeur and polish and like what they see. But then they peek into one of those seams and see the sausage being made. It is perfectly understandable that they are going to be confused by this paradox of perfection that they have come to believe in and the messy reality before their eyes that they cannot deny.

We can't heap too much blame on Apple though. It is an industry-wide phenomena. Just the other day someone made a typo at Amazon and took down a fair portion of the Internet, including much of Apple. In my background, everything was scripted and tested for years before deployment. But today, there is a concept of "DevOps", where people are doing development on live, running code. The messiness at places like Apple and Amazon will only get worse. If they can't turn it around, it is inevitable that whole ecosystems will collapse upon themselves like a house of cards.

Unfortunately, the idea of "turning it around" isn't even on the table. Apple will just pull the Terminal so people can't look inside anymore, like on iOS. Amazon will just fire the person who made the typo.

All birds are animals. Not all animals are birds.

C.

when I put the Sierra installer after the codesign -vvv command it works correct.

Codesign is the wrong tool to use to assess disk images. According to

https://developer.apple.com/library/prerelease/content/technotes/tn2206/_index.h tml

the correct method works as follows:

$ spctl -a -t open --context context:primary-signature -v MyImage.dmg

/Users/me/Downloads/MyImage.dmg: accepted

source=Developer ID

Haven't tried it myself.

C.

I don't have any experience and knowledge to offer here, but I downloaded the Combo update and looked at the codesign. See the screenshot:

Hello again Chase.

Once again etresoft is correct. You should listen to him. As it turns out according to him he has a "twisted imagination" which allows him to comprehend things the rest of us don't understand.

You can trust his posts.

Hello again ChaseDaniel,

That output is completely normal.