I downloaded an app, and after installation, it fails signature verification:

codesign -vv Amazon\ Music.app
Amazon Music.app: a sealed resource is missing or invalid
file added: /Applications/Amazon Music.app/Contents/Frameworks/update.ini

What I've tried: I don't think it's a transmission error; aside from any internal checks, I downloaded the .dmg twice, over https (URL), and got the same crc32 both times: 74ecf8ab

The installer checks out fine:

codesign -vv */Am*er.app/
Amazon Music/Amazon Music Installer.app/: valid on disk
Amazon Music/Amazon Music Installer.app/: satisfies its Designated Requirement


   -R='anchor apple generic'

doesn't help.

Anyone come across this before?

migrated from apple.meta.stackexchange.com Feb 22 at 21:56

This question came from our discussion, support, and feature requests site for power users of Apple hardware and software.

  • The only thing you can do is report it to Amazon and ask for a fix. – Mark Feb 22 at 22:01
  • Do you mean that literally? My WAG is that a malware reverse engineer would think differently...and not take the time to attempt reverse engineering. – Matthew Elvey Feb 23 at 3:23

w/o guidance, my plan is:

  1. report it as a security issue to security@ (per https://www.amazon.com/gp/help/customer/display.html?nodeId=201909140),

  2. try to get codesign to show me what's missing,

  3. Pick apart the .ini

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .