Can't launch Pale Moon 33.4.0.1 on macOS 15.1

[gmaguire]

When I try to launch Pale Moon from the dock, Applications or Launchpad I get this error message: "The application "Dock" does not have permission to open "(null)".

I can launch Pale Moon by going to Applications/Pale Moon.app/Contents/MacOS and double clicking on the palemoon terminal executable, but it has to be allowed from Privacy & Security in settings first. After this it still doesn't work from the dock etc.

[Nigaikaze]

I've encountered this too. Everything was working fine with Pale Moon 33.4.0.1 on Sequoia 15.0.1. These error messages started after the recent 15.1 update. I'm on an Intel Mac if that makes any difference.

[therube]

Similar threads on the SeaMonkey (& other application) end(s), along with a work-around to launch from Terminal.

% /Applications/SeaMonkey.app/Contents/MacOS/seamonkey-bin

Once launched, I keep the icon in the dock and that's it.

http://forums.mozillazine.org/viewtopic.php?t=3126183
http://forums.mozillazine.org/viewforum.php?f=40
https://bugzilla.mozilla.org/show_bug.cgi?id=1924612


(And obviously s/seamonkey/palemoon/ or whatever might be required.)

[wandersmann]

Auch bei mir startet seit dem Update auf 15.1 Pale Moon nicht mehr,
gleiche Fehlermeldung.
Pale Moon ist das einzige Programm, das nach dem Update nicht funktioniert.
Deshalb kann es kaum an Apple liegen - Gatekeeper habe ich bereits deaktiviert.
Auch ältere PM-Versionen starten nicht.
Andere Dateimanager liefern die gleiche Fehlermeldung.

[Moonchild]

Please keep posts in English

[Moonchild]

Deshalb kann es kaum an Apple liegen - Gatekeeper habe ich bereits deaktiviert.
Auch ältere PM-Versionen starten nicht.

So, let me get this straight. Pale Moon hasn't changed a thing. Apple provides an O.S. update and it breaks every existing version of Pale Moon, and the conclusion is then that "Apple can't be at fault for this"?... Even if Pale Moon would be the only affected piece of software (which I doubt...) I don't follow this conclusion. Especially not for a minor point update. If it was a new major version of macOS I could more easily imagine it being a potential issue with the build libraries or what not (but still in that case it'd be pretty bad for Apple to not retain backwards compatibility), but with a point update...? Not really.

[Goodydino]

Apparently, there is a problem with SeaMonkey and LibreWolf as well. Somebody should complain to Apple.

[Nigaikaze]

According to this ...

https://www.osnews.com/story/141055/bug ... lications/

... it looks like the issue has to do with Apple cracking down on unsigned applications.

[Moonchild]

it looks like the issue has to do with Apple cracking down on unsigned applications.

I don't think it's unsigned? I don't really know 100% though, there was some difficulty with the code signing in the past. dbsoft will have to weigh in here.

[dbsoft]

I don't sign the Intel ones, because it caused problems on very old versions of MacOS. It is signed and notarized on ARM. I haven't updated to 15.1 yet, but I have not found issues on 15.0.1

Edit: Basically 10.7 through 10.9 had some issues launching when it was signed, before the signing/notarizing system was completely finalized... when it isn't signed it basically just refuses to open initially then you have to go to "Open Anyway" on newer versions of MacOS. I did a vote and people thought leaving it unsigned was better. The other option was to release 2 versions for Intel, an unsigned version for older MacOS and a signed and notarized one for newer versions.

If it becomes necessary I'll start releasing unsigned White Star branded builds for old MacOS and signed and notarized Pale Moon ones for newer MacOS versions.

[Moonchild]

If it becomes necessary I'll start releasing unsigned White Star branded builds for old MacOS and signed and notarized Pale Moon ones for newer MacOS versions.

Well.... looks like it just became necessary, unless Apple will roll this back here.

[therube]

(I know nothing of Mac, only passing what I've read.)


"Given that SeaMonkey is not code signed at all, the first command that removes an existing signature is not needed.
Even the --force option, used to explicitly remove an existing signature, is not necessary.

So the only command to use is:

Code: Select all

codesign --deep --sign - /Applications/SeaMonkey.app

Please be aware that you are ad-hoc code signing the application and this way it will only run on the machine that signed it.

Anyway, it is still necessary to try to open it once by double-clicking on it, then go to System Settings --> Privacy & Security, scroll down and select "Open anyway" in the Security section. After this you'll be able to launch SeaMonkey normally."

https://forums.mozillazine.org/viewtopic.php?t=3126299

[dbsoft]

Well.... looks like it just became necessary, unless Apple will roll this back here.

I will update to 15.1 this week, but from the error message it sounds kind of like a bug, if it was intended why wouldn't they have just done it with 15.0, why wait for 15.1 and why the bizarre error message?

[Moonchild]

I'm not sure either! Not saying to rush this right away. Just seems to me that if that's the direction they are going in, then it may be something we need to do.

[dbsoft]

Here are signed and notarized builds for Intel... should work on 15.1, it did for me. It may not work on old versions of MacOS.

https://dbsoft.org/palemoon/palemoon-33 ... el64sn.dmg
MD5: b6980f4dbd4d90685941df9d0eedad44
https://dbsoft.org/basilisk/basilisk-20 ... el64sn.dmg
MD5: 09bf29899d69a62fb26de89e9f41e4eb
https://dbsoft.org/epyrus/epyrus-2.1.3.intel64sn.dmg
MD5: db9b9d8bb949ac7db49edaeda9aec573

Let me know if this works for people...

[RealityRipple]

For people on older systems where it doesn't work, you can right-click and open the "Pale Moon.app" folder and delete the "_CodeSignature" subfolder in Contents. You might also need to do the same for the "plugin-container.app" folder in Pale Moon's "Contents/MacOS".

[Nigaikaze]

Here are signed and notarized builds for Intel... should work on 15.1, it did for me.

Yes, that build of Pale Moon works just fine on my 15.1 system. Thanks, dbsoft!

[dbsoft]

For people on older systems where it doesn't work, you can right-click and open the "Pale Moon.app" folder and delete the "_CodeSignature" subfolder in Contents. You might also need to do the same for the "plugin-container.app" folder in Pale Moon's "Contents/MacOS".

That might not be the only issue, I had to use different packaging settings, because the hybrid mode that works better on the old systems would prevent the notarization to complete. I also used the new linker which had problems on 10.7, although that also seemed like a bug which may be fixed at some point. If it looks like this issue won't be addressed in the near future I'll do testing to try and determine what versions can run the signed and notarized version without problems.

Regardless, I am not recommending using these builds unless you are on 11 or later, but they may work on earlier versions. (These settings have been tested thoroughly on ARM from 11 through 15).

Edit: Just a note I was doing some searching to see if Apple has said anything about this change in behavior... but they haven't. However during that search I discovered this about the 15.1 update... these are the security issues fixed in 15.1, one stood out to me https://support.apple.com/en-us/121564 :

"AppleMobileFileIntegrity

Available for: macOS Sequoia

Impact: An app may be able to modify protected parts of the file system

Description: A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.

CVE-2024-44280: Mickey Jin (@patch1t)"

Although now that I look at it, this CVE also affected earlier versions... which I don't think are having the same issue... hmmm....

[dbsoft]

So update about the problem... I upgraded to 15.2 and it seems to have been fixed. It is back to allowing unsigned apps to run after clicking "Open Anyways" in the System Preferences. So this is only an issue for 15.1 and 15.1.1, all other versions are able to run unsigned apps.

I will go back to just releasing unsigned apps for Intel.