I downloaded an app, and after installation, it fails signature verification:

codesign -vv Amazon\ Music.app
Amazon Music.app: a sealed resource is missing or invalid
file added: /Applications/Amazon Music.app/Contents/Frameworks/update.ini

What I've tried: I don't think it's a transmission error; aside from any internal checks, I downloaded the .dmg twice, over https (URL), and got the same crc32 both times: 74ecf8ab

The installer checks out fine:

codesign -vv */Am*er.app/
Amazon Music/Amazon Music Installer.app/: valid on disk
Amazon Music/Amazon Music Installer.app/: satisfies its Designated Requirement


   -R='anchor apple generic'

doesn't help.

Anyone come across this before?

  • The only thing you can do is report it to Amazon and ask for a fix. – mmmmmm Feb 22 '19 at 22:01
  • Do you mean that literally? My WAG is that a malware reverse engineer would think differently...and not take the time to attempt reverse engineering. – Matthew Elvey Feb 23 '19 at 3:23

w/o guidance, my plan is:

  1. report it as a security issue to security@ (per https://www.amazon.com/gp/help/customer/display.html?nodeId=201909140),

  2. try to get codesign to show me what's missing,

  3. Pick apart the .ini

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .