Uploaded image for project: 'Minecraft Launcher'
  1. Minecraft Launcher
  2. MCL-124

"Minecraft is Damaged" - incorrect code signature

    • Icon: Bug Bug
    • Resolution: Fixed
    • 0.8.2
    • 0.5
    • None
    • None
    • OS X 10.8.2
    • Community Consensus

      When you download Minecraft on a default-configured Mac (Gatekeeper on) and try to open it, the system will report that the application is "damaged" and cannot be opened. This cannot be overridden by using Finder's Open contextual menu item, as is possible with unsigned applications. This is because the launcher is signed, but the code signature is incorrect:

      $ codesign -vv Minecraft.app
      Minecraft.app: invalid Info.plist (plist or signature have been modified)
      In architecture: i386

      The solution to this issue is for Mojang to re-sign Minecraft.app after making any changes in the .app bundle. Disabling Gatekeeper (as the official support article recommends: http://help.mojang.com/customer/portal/articles/901687-error-minecraft-is-damaged) is only a workaround and leaves systems significantly more vulnerable to malware.

      Relevant docs:

          [MCL-124] "Minecraft is Damaged" - incorrect code signature

          I hate this stuff. Trivial fix though!

          Consider this properly fixed for the next release of the bootstrap (which will happen likely this week).

          $ spctl -a -vv /Applications/MinecraftDev.app/
          /Applications/MinecraftDev.app/: accepted
          source=Developer ID
          origin=Developer ID Application: Mojang AB

          Also thanks for pointing it out Eike, documentation on this issue is .... stupidly vague

          [Mojang] Grum (Erik Broes) added a comment - - edited I hate this stuff. Trivial fix though! Consider this properly fixed for the next release of the bootstrap (which will happen likely this week). $ spctl -a -vv /Applications/MinecraftDev.app/ /Applications/MinecraftDev.app/: accepted source=Developer ID origin=Developer ID Application: Mojang AB Also thanks for pointing it out Eike, documentation on this issue is .... stupidly vague

          Eike Ziller added a comment -

          you should really reopen this issue...

          Eike Ziller added a comment - you should really reopen this issue...

          Eike Ziller added a comment - - edited

          This (the attached screenshot unidentifieddeveloper.png) is what I get when opening the launcher downloaded from http://s3.amazonaws.com/Minecraft.Download/launcher/MinecraftDev.dmg today.
          There's no way you can argue away reality with some codesign output

          Anyhow.

          $ codesign -dvvv -r- MinecraftDev.app/
          Executable=/Volumes/MinecraftDev/MinecraftDev.app/Contents/MacOS/JavaApplicationStub
          Identifier=com.Mojang Specifications.Minecraft.Minecraft
          Format=bundle with Mach-O universal (i386 ppc x86_64)
          CodeDirectory v=20100 size=214 flags=0x0(none) hashes=3+3 location=embedded
          Hash type=sha1 size=20
          CDHash=ea30c3a5abe5552bb7b96c53c2e06b3734a4bdc3
          Signature size=4330
          Authority=3rd Party Mac Developer Application: Mojang AB
          Authority=Apple Worldwide Developer Relations Certification Authority
          Authority=Apple Root CA
          Signed Time=25.04.2013 17:09:21
          Info.plist entries=17
          Sealed Resources rules=4 files=3
          designated => identifier "com.Mojang Specifications.Minecraft.Minecraft" and anchor apple generic and certificate leaf[subject.CN] = "3rd Party Mac Developer Application: Mojang AB" and certificate 1[field.1.2.840.113635.100.6.2.1] /* exists */
          z
          
          $ spctl -a -vv MinecraftDev.app/
          MinecraftDev.app/: rejected
          origin=3rd Party Mac Developer Application: Mojang AB
          

          You are using the wrong certificate. "3rd Party Mac Developer Application:" is for submission to the app store google tells me. You need to use your "Developer ID Application:"

          Eike Ziller added a comment - - edited This (the attached screenshot unidentifieddeveloper.png) is what I get when opening the launcher downloaded from http://s3.amazonaws.com/Minecraft.Download/launcher/MinecraftDev.dmg today. There's no way you can argue away reality with some codesign output Anyhow. $ codesign -dvvv -r- MinecraftDev.app/ Executable=/Volumes/MinecraftDev/MinecraftDev.app/Contents/MacOS/JavaApplicationStub Identifier=com.Mojang Specifications.Minecraft.Minecraft Format=bundle with Mach-O universal (i386 ppc x86_64) CodeDirectory v=20100 size=214 flags=0x0(none) hashes=3+3 location=embedded Hash type=sha1 size=20 CDHash=ea30c3a5abe5552bb7b96c53c2e06b3734a4bdc3 Signature size=4330 Authority=3rd Party Mac Developer Application: Mojang AB Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA Signed Time=25.04.2013 17:09:21 Info.plist entries=17 Sealed Resources rules=4 files=3 designated => identifier "com.Mojang Specifications.Minecraft.Minecraft" and anchor apple generic and certificate leaf[subject.CN] = "3rd Party Mac Developer Application: Mojang AB" and certificate 1[field.1.2.840.113635.100.6.2.1] /* exists */ z $ spctl -a -vv MinecraftDev.app/ MinecraftDev.app/: rejected origin=3rd Party Mac Developer Application: Mojang AB You are using the wrong certificate. "3rd Party Mac Developer Application:" is for submission to the app store google tells me. You need to use your "Developer ID Application:"

          There are no issues with the latest launcher.

          If there are, something else is up.

          $ codesign -vvv /Applications/MinecraftDev.app/
          /Applications/MinecraftDev.app/: valid on disk
          /Applications/MinecraftDev.app/: satisfies its Designated Requirement

          Also; the old launcher (the 1.5.x and earlier) will not get fixed.

          [Mojang] Grum (Erik Broes) added a comment - - edited There are no issues with the latest launcher. If there are, something else is up. $ codesign -vvv /Applications/MinecraftDev.app/ /Applications/MinecraftDev.app/: valid on disk /Applications/MinecraftDev.app/: satisfies its Designated Requirement Also; the old launcher (the 1.5.x and earlier) will not get fixed.

          The new launcher appears not to be signed at all, which is an improvement over the previous state of affairs but still not ideal. I've attached the dialog that appears on my machine (and would appear on any other Mac running 10.8 still on the default security configuration) when you try and open the new launcher. The workaround is to right click the app and click "Open" which will give me the option to circumvent the security check.

          The only way to get a program to launch without hassle on OS X is to sign it with a developer key. (see http://support.apple.com/kb/ht5290 for more explanation of this OS X feature) It looks like the docs linked above may already be out of date, this appears to be the most relevant documentation on how to sign your code to avoid this dialog: https://developer.apple.com/library/ios/#documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW2

          MacRae Linton added a comment - The new launcher appears not to be signed at all, which is an improvement over the previous state of affairs but still not ideal. I've attached the dialog that appears on my machine (and would appear on any other Mac running 10.8 still on the default security configuration) when you try and open the new launcher. The workaround is to right click the app and click "Open" which will give me the option to circumvent the security check. The only way to get a program to launch without hassle on OS X is to sign it with a developer key. (see http://support.apple.com/kb/ht5290 for more explanation of this OS X feature) It looks like the docs linked above may already be out of date, this appears to be the most relevant documentation on how to sign your code to avoid this dialog: https://developer.apple.com/library/ios/#documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW2

          Warning for new launcher

          MacRae Linton added a comment - Warning for new launcher

          GrygrFlzr added a comment -

          MacRae Linton: From the Mojang blog but when opening the launcher download 1.5.1, not 13w16a/b unless you want to.

          GrygrFlzr added a comment - MacRae Linton: From the Mojang blog but when opening the launcher download 1.5.1, not 13w16a/b unless you want to.

          Where can I get the new launcher from? I just went to minecraft.com and downloaded the zip file there and it still has this problem.

          MacRae Linton added a comment - Where can I get the new launcher from? I just went to minecraft.com and downloaded the zip file there and it still has this problem.

          Tails added a comment -

          Does the new launcher fix this?

          Tails added a comment - Does the new launcher fix this?

          Eike Ziller added a comment -

          As a side note: Broken or missing code signatures are something that I can bear with in the context of open source projects done by people which have a "real" job besides. That's not the case here. It creates the impression of "they are doing this just as some side thingy".

          Eike Ziller added a comment - As a side note: Broken or missing code signatures are something that I can bear with in the context of open source projects done by people which have a "real" job besides. That's not the case here. It creates the impression of "they are doing this just as some side thingy".

            grum [Mojang] Grum (Erik Broes)
            binaryminded Brian Moore
            Votes:
            5 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved:
              CHK: