As I understand it I have to pay £99 a year to Apple for the privilege of signing my app, which I am disinclined to do.

Oh, signing is tied to a commercial apple developer ID? Okay, makes some sense. I think they start to give out free developer accounts in the US this year, but even if they'd extend that to the UK, you would probably not qualify as a 'charitable organization'? I thought there were other ways to solve this. There are some cases were creating firewall rules didn't solve this issue. I can not remember when this turned up initially on my Mac, but since then I thought it was sort of a deadlock/bug, not a requirement, but looks as if at some point Apple made it a feature.

Well then...

• Carsten

That's the way I understand it... I'd be happy to be proved wrong.

As a tester and translator, I am probably bugged more by this issue than many others, as frequently I spent more time exiting and restarting the app than working in it ;-)

• Carsten

I'm having second thoughts about this. I may be cutting off my nose to spite my face...

OK, I've given in and apple have got their £79. Hopefully now I can get rid of this warning...

Should be fixed by 2e1c5594f784c061c18b09a619d22450ee529905

Any idea when this will become effective? I assume it will take some time? Will we see this 'feature' in 2.12?

• Carsten

It's supposed to work in 2.11.69. Does it not? I think my OS X version is less fussy about these things.

That's why I was asking - for this to happen, does something first need to be processed at Apple, like a registration completing, or did you immediately received a working certificate to sign DCP-o-matic?

I don't know much about the inner working of apples app signing. I would assume it needs to work offline as well, and if so, how does my OS X know your signing/certificate is valid? I heard that apple can withdraw certs if they have been abused as well, so there needs to be some way of communicating that back and forth?

Anyway - I tried it last night with 2.11.70, and the firewall confirmation dialog still comes up. I deleted all DCP-o-matic related entries in my firewall exception rules, and reinstated them from scratch, but the dialog still comes up on every start.

This is on Sierra.

I hope you didn't spend that money for nothing ;-)

• Carsten

edit: <grin> just fired up all DCP-o-matic apps to look for that dialog, and when it was (expectedly) missing for the player, I had that funny idea about using remote DEcoding servers for the player - but only for a fraction of a second ;-)

You get it straight away. They do zero actual work, and apparently zero checks. I think it's just so they can turn you off if they don't like what you are doing. And of course pocketing some cash while they do it.

I really don't have much clue how it works. As you say there must be some communication for revocation, I think.

Is the error just about firewalls? Does it (or has it ever) said anything about being an unknown developer, or anything like that?

You're right, for some strange reason I didn't pay attention on that - that one usually doesn't annoy me as it only needs to be bypassed once when installing a new version, whereas the firewall/incoming connection issue pops up on every app start. Now, I just deleted all .70 apps from their folder and reopened all DMGs from where I had stored them last night - I get a very long 'verifying application...' (multiple minutes actually), and then again 'app start blocked missing developer identity confirmation' (or whatever that spells in real english).
'Safari downloaded this file from dcpomatic.com tonight at 00:01'

This also happens with a new .70 download I did just now. I am sure this did not happen last night when I installed it first. But I experienced this on some occasions before. Maybe my machine/gatekeeper DOES check something online, and there may be times when this takes longer. When I saw this happen before, I assumed the download or app could have been broken, but it seems, that was never the case. When I reinstall .68, currently I get the same delayed 'checking', so, it sure is some temporary issue. I guess I need to read a bit more about the gatekeeper process.

I would think that the app signing works similar to DCI signing. The certificate that comes with the app is checked against the private OS X key. Maybe at app start, or by applying software updates, certain certificates can be revoked.

As you spent that money, it sure would be nice to have it working in 2.12 right away.

• Carsten

edit: Restarted my internet router and Sierra machine - no change so far, guess I simply need to wait a bit...

Hmm, this goes a bit above my head I guess...

Now: I copied my .70 DMGs over to my Snow Leopard MB, I edited the firewall rules there, removing all DCP-o-matic entries. On SL, I can start any application without the initial verification taking place. After opening, I still get the firewall dialog about wether I want to allow DCP-o-matic to receive incoming connections. I allow this for all apps, but none of these apps appear in my firewall list of allowed apps. After I added DCP-o-matic main app manually, I can open every DCP-o-matic application without that dialog popping up.

Back to my Sierra machine:

I have set my security settings/gatekeeper to allow apps from Appstore and certified developers. There are no firewall rules visible for DCP-o-matic.
I start DCP-o-matic main app .70 (double click), and still get the longish 'verifying...' dialog as before. This stays on for about three minutes this time - then it says 'DCP-o-matic was blocked from opening because it is not from an identified developer'. I click okay, I Control-Open... same longish verification dialog for about 3min as well - then I get the 'DCP-o-matic blocked, open anyway' dialog.
I open it, and immediately afterwards, I get the OS X Firewall 'incoming connection' request. I click 'Allow', the app opens. I see that DCP-o-matic has been positively added to the firewall exception rules. I quit DCP-o-matic, double click again, the app starts immediately, but I STILL get that firewall 'allow incoming connections' request, even if DCP-o-matic is shown in my firewall exception list. Same result when I manually add DCP-o-matic to the FW list.
This is more or less the same as I experienced it over the last years. This is a fairly new Sierra installation, there is no other security/firewall/IP blocker software installed.
I could try this on other machines. Unfortunately, I had two other OS X machines here over the weekend, but didn't bother trying...

Maybe we should ask other OS X users about their experience on the mailing list and the forum?

• Carsten

Believed fixed (eventually)