11

Without having changed anything, I now get this message when I try to open the app "Breeze" - Other apps fail similarly on other Macs:

enter image description here

I tried to get rid of this message by re-installing it from the App Store, but nothing changes. Rebooting and changing gatekeeper security preferences also doesn't help by choosing "allow Apps downloaded from anywhere".

What the heck is going on?

Improve this question
1
  • Do you think this may be related to my problem? (Ironically, today is my birthday.)
    – geokavel
    Commented Nov 12, 2015 at 19:17

2 Answers 2

Reset to default
17

Pretty much everyone is in the same boat as you. The situation is quite complicated, but this picture shows some of the details of the layers of certificates involved in making a "receipt" file:

enter image description here

Apple engineers used a certificate that is marked as Not VALID After : Nov 11 21:58:01 2015 GMT to sign apps that were downloaded for a long period this year. Additionally, one of the certificates used to be signed with Signature Algorithm: sha1WithRSAEncryption and is transitioning to sha256WithRSAEncryption which isn't fully supported by all OS and developers.

The best write up (of many good ones) is by Ben Toms:

In a nutshell, one of the keys making up the wrapper that apps use to verify a proper App Store download expired yesterday. Apple has renewed that certificate, but you might need to take action now to remedy this error.

Oddly, the apps that Apple itself made, rely on some other validation chain of trust since they include this same now expired certificate yet still run on OS X. Basically, those apps seem to use another (or no) validation of the receipt for correctness.

If you're comfortable with the command line, try restarting the process that tends to these now outdated app receipts:

killall -KILL storeaccountd

If you power off your Mac, that also cycles the accounts daemon and should fix things so you don't have to re-download the apps to the computer after the time when that one Apple certificate expired.

At this point, when you try to run the app, you should be prompted to re-enter your password one time. This will get you a new certificate from Apple which may or may not solve the actual breakage depending on how or if the application uses the receipt file.

Another thing that can cure false certificate failures is to check your date/time settings and then try signing out of the Mac App Store entirely. If you still cannot run the app after signing back in, you might be forced with deleting the app and re-downloading it after verifying your date/time and rebooting the OS. Be sure to check spotlight and delete all copies of the app. Empty the trash before trying to restore the download.

If all else fails, contacting both the developer of your specific app as well as Apple Support for guidance might be prudent since the programs that handle this receipt validation and generation are not well documented.

Big thanks also to Craig Hockenberry and Paul Haddad for the great technical explanations on what's happening here. Without community working together we might be in the dark far longer when uncomfortable breakages like this arise.

Improve this answer
6
  • Also, it's a bit painful to pick apart the error messages relating to storelegacy from CommerceKit, harmless from meaningful sandboxd errors, storeassetd, storeuid, storeaccountd and storelegacy process messages and errors to figure out what changed after rebooting after the failure time for OS X to update the receipt that was cached to the filesystem with a newer expiration date. It sure would be nice to have some of this documented or a switch to throw so that you could load an app when the next chain of trust fails due to user error or insufficient foresight of the OS developers.
    – bmike ♦
    Commented Nov 12, 2015 at 16:42
  • Unfortunately this did not help for me. Rebooting, reinstalling, killing the above process, checking the date/time and logging out and back into the App store did not help. This is on a Mac 10.10.5. Opening from the command prompt did not help either: $ open -a Breeze.app LSOpenURLsWithRole() failed for the application /Applications/Breeze.app with error -10810
    – Andrew
    Commented Nov 12, 2015 at 17:46
  • Thanks a lot for your answer. Unfortunately, none of this helps. In more detail, I tried the command line trick, rebooted, re-entered the password, yet I still receive that message. The date/time settings look fine to me (what am I supposed to check there?) After reinstalling it, I still get the same message. Any ideas?
    – Corsin Pfister
    Commented Nov 12, 2015 at 17:47
  • I just had a phone call with the Apple Support, and using some screen sharing to try out a few things. This included: Checking Date & Time, deleting / moving some stuff from the Library, Rebooting, Checking other third party apps (which turned out not to be affected). I also made the support guy aware of this question here on AskDifferent. After trying out several things that didn't help, he suggested to contact the creators of Breeze (which I will do), and gave me the case ID in case I want to contact Apple Support again.
    – Corsin Pfister
    Commented Nov 12, 2015 at 18:55
  • I've added one more step. @CorsinPfister - check for multiple copies of the app and deleting trash. I would also disconnect my Time Machine drive after making a backup to be 100% sure the storeaccountsd process gets a new receipt for the app in question. It's highly unlikely this is the developer's problem. They all didn't make the same mistake yesterday at 1800 GMT. Hopefully Apple will document things better going forward.
    – bmike ♦
    Commented Nov 12, 2015 at 20:20
7

It looks like the receipts embedded in applications downloaded from the Mac App Store are being signed with an expired certificate.

Tapbot's Paul Haddad pointed out the issue earlier today on Twitter.

https://twitter.com/tapbot_paul/status/664653066679906304

For some users rebooting is enough to prompt the operating system to retrieve new receipts from the Store. Other users find they are being prompted to log in to the Mac App Store again to update application receipts. Other developers like C-Command Software suggest that users delete applications and download them again.

Improve this answer
4
  • This isn't all there is to the story. I have apps that still launch even though they are signed with the certificate that is marked to not be valid after Nov 11 21:58:01 2015 GMT - Xcode for example still runs so I'm digging into what can be done short of deleting and reinstalling each app that OS X feels is now "damaged".
    – bmike ♦
    Commented Nov 12, 2015 at 14:11
  • 2
    Maybe the OS doesn't check the receipt on every app launch. And/or maybe it only checks after a period of inactivity. You'd assume this was documented somewhere. :)
    – Alistair McMillan
    Commented Nov 12, 2015 at 14:22
  • 1
    Since this is a huge surprise to most people that applications can "expire" and it's going to be a real pain for people flying in an airplane or on a trip away from WiFi to keep working on Mac OS, I would expect a public explanation from Apple on what happened, why it happened and how to fix/prevent this from happening in the future. Basically, Gatekeeper needs a function to report on expiring apps beforehand and a toggle to override this check temporarily. Egg on Apple's face for sure over how they failed to educate users and look out for them.
    – bmike ♦
    Commented Nov 12, 2015 at 14:25
  • 2
    I just find it amazing that companies regularly have problems with certificates expiring. If only they had some way to automatically remind themselves that certain things need renewed on certain days.
    – Alistair McMillan
    Commented Nov 12, 2015 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .