[MacOS 10.15] Problems with macOS Catalina

[Waitsnake]

I am currently having an issue with Mojave Catalina. Its an early developer release.

OXS Version: (macOS 10.15 (19A471t))
GPU: Intel Iris Graphics 6100
Model: MacBookPro12,1
Year: MacBook Pro (Retina, 13-inch, Early 2015)

The exact behavior is as follows:

• I download the most recent release from github
• Unzip animated.saver
• Double click to install (Here i get the warning like you mention in the readme)
• Go to security/preferences
• Click the allow action like you mention in the readme
• After clicking allow anyways, it brings me back to the screensaver menu with the same unidentified developer warning. I can repeat this process ad infinitum.

Originally posted by @RandyStevens in #55 (comment)

[Waitsnake]

It seems other screensavers suffer with the same issue on macOS Catalina Beta 1. For example the Aerial screensaver had the same issue, that install was not possible "without properly signed/notarised installer". See here and look for "signed" (in the report are different issues with Catalina mentioned not only the signed issue):
JohnCoates/Aerial#801

I have not the time and resources (A extra Mac that I can use to install the Beta 1. I need the stable Mojave on my notebook for working.) at the moment to take a closer look at this issue.

For what I read in the Areal issue it sounds for me that it is neither a bug with the Gatekeeper, that someone can't allow a screensaver from an unknown developer at the moment (as it was possible in all macOS versions before!), or that Apple had tighten the thumbscrews and on Catalina and only software signed with paid developer IDs (paid developer accounts cost 100$ a year and I don't have one) will be allowed to execute in general.

As of now I will hope for the best and that later Betas of Catalina will again allow software from unknown developers. Otherwise mac users will lost a ton of free software and the freedom of choise to use own software. If apple really plans to completely close the "jail" as they did with the iOS platform it is possible that the support of AnimatedGif will end with Mojave.

Anyway thanks a lot for the report. I let this issue open and wait for more Betas and reports to come.

[Waitsnake]

After reading some websites it seems with Catalina (10.15) "notarising an app" became mandatory even for apps outside the App Store.

I tried to follow this blog Entry here, but unfortunately this was not working with my free "Mac Developer" certificate and this is even root signed from Apple.
https://blog.zeplin.io/dev-journal-automate-notarizing-macos-apps-94b0b144ba9d

I got the error(I change the mail address):

The username username@host.domain is not a member of the provider . Contact your team admin for assistance. (1296)

I did not find much to that specific error on the net, but what I read about the requirements for "notarising an app" that a free "Mac Developer" certificate is not sufficient.

Use a “Developer ID” application, kernel extension, or installer certificate for your code-signing signature. (Don't use a Mac Distribution or local development certificate.) For more information, see Create, export, and delete signing certificates.

Xcode show my certificate as role "user" and I need to be the role "team leader" for "notarising" witch I can only be if I had a full "Developer ID" witch is 99$ a year. Seems that is the price now to distribute even free software outside of the App Store. I don't get that. :-(
I mean if I'm registered at Apple and sign with an Apple certificate and if Apple would check that the binary is clean and notarising it for free distribution outside the App Store, why I have to pay them money for this? If I would use there App Store than I would be ok to pay, but If I don't use it only this notarising should be free.

Anyway I updated the binary in the ZIP of the latest release. Before it was a self signed root certificate with waitsnake, but now it is signed with my free "Mac Developer" certificate and this is root signed by Apple and also with enabled "hardened" option in Xcode. Maybe it makes it easier to deal with gatekeeper in Catalina? I don't know and hope someone can give it a try. Or maybe I should remove code-signing completely to make it easier to pass?

There would be also the chance to manually give AnimatedGif a approval in the Terminal-App(?):
spctl --add /Path/To/AnimatedGif.saver

Or if this is not working(?) it would be possible to disable the gatekeeper completely witch the most people of cause would not like to do:
sudo spctl --master-disable

[RandyStevens]

The solution you suggested spctl --add /Path/To/AnimatedGif.saver Works.

Unfortunately I am now encountering an issue selecting the gif I want to use. It seems like the rest of the customization panel works but the button to select a file appears to be unresponsive.

I'll try to poke around in the code but i'm a n00b at objective-C. 😅

[RandyStevens]

Totally agree with you about Apple being big jerks about their notarization process now by the way. 😡

[Waitsnake]

Again there is something wrong with the open panel? That is not good. :-(
There was some trouble with the open panel in Mojave too, see issue #37.
The method normal used to select a file or folder just crashed (use "runModal" of class NSOpenPanel) and so I tried a different approach as a workaround (use "beginWithCompletionHandler" of NSOpenPanel).

Anyway, without analysing it directly it is too hard to guess for me what is wrong now.
I tried to setup Catalina in a VirtualBox some days ago by following some instructions I found for Win10 system, but this was not working. After Catalina was finishing with install inside the VirtualBox and then needs to reboot it hangs endless afterwards in the reboot process(?). Maybe because I don't did on a Mac system and not on a Windows? Finally I gave up and hoped for future instructions to come especially ones for Mac users.

[RandyStevens]

Well at least it seems they aren't breaking it entirely! The screensaver "works" i just can't select a gif from my library. but the default screen with the "NO GIF SELECTED" works. And i am able to change the color still. and it doesn't freeze my macbook.

Sorry I cant help more but if you know any way I can help get this running again or have any ideas let me know, i'm happy to help.

[Waitsnake]

I found a few references where developer have similar problems with their screensavers caused by the new sandboxing of the new legacyScreenSaver app.

https://forums.developer.apple.com/message/370712
https://forums.developer.apple.com/thread/119008
JohnCoates/Aerial#801
JohnCoates/Aerial#809
JohnCoates/Aerial#805
https://iscreensaver.com/forum/discussion/520/iscreensaver-and-macos-10-15-catalina

Most I liked the comment of glouel that gets it to the point:

Well, I'm finally starting to understand what they did, under 10.15, screen savers are now sandboxed and can't access much (if anything) outside of a container. So, in my case, I can successfully access the containerized user cache directory, but it's not ~/Library/Caches/Aerial but ~/Library/Containers/com.apple.ScreenSaver.Engine.legacyScreenSaver/Data/Library/Caches/Aerial !

/Library/Caches looks unaccessible for us now, as I would suspect /Library/Application Support (user one should work fine).

Because a screensaver is a plugin and not an app (we are now run by a system app called legacyScreenSaver), we can't even ask for entitlements such as accessing the filesystem so it looks like we'll have to live in the container from now on. This may break other things such as location, but it's too early to tell wit the nib bug. What a (completely undocumented) mess !

These are no good news. At the moment it looks like that the whole screensaver AnimatedGif could no longer work in the way it did in the past. Since the legacyScreenSaver application is highly sandboxed and with very limited access to the file system (only some cache folders) and can not even use the NSOpenPanel. And AnimatedGif itself is only a Plugin that can not ask for any entitlement it needs.

[Waitsnake]

I just installed 10.15 Beta 6 on an external ssd drive to dig a bit around.

1.) The original issue with seems to be solved by apple. I could install AnimatedGif 1.5.3 as it was without disabling the Gatekeeper. Maybe the have changed this behavior between Beta 1 and Beta 6. The way to allow was very similar to Mojave. After installing the Screensaver there was the usual warning. Then I needed to go to "Security & Privacy" click "Open Anyway" and then again confirm with "open". Then the screensaver was kind of running (the default screen with the "NO GIF SELECTED" works).

Furthermore I saw more issues:

2.) Even if my language was German and the hole operating system was set to German the options panel of the screensaver was only in English. This is strange since the Screensaver includes localization files for English, German, Spanisch and Japanese. This works fine until Mojave and seems like another bug of Catalina and I think there is not much that I can do here.

Addition:
I would not wonder if this is also an issue with the new sandboxing of legacyScreenSaver application. It seams an screensaver plugin has not even the rights to load its own localisation files from its own bundle.

3.) As RandyStevens mentioned earlier the "Select File or Directory" is not working.
When I press it I saw the following warning within the Console.app:
"legacyScreenSaver ERROR: Unable to display open panel: your app is missing the User Selected File Read app sandbox entitlement. Please ensure that your app's target capabilities include the proper entitlements."

Until now I'm not sure if the legacyScreenSaver app from operating system needs this mentioned entitlement or if the Screensaver Plugin can have it too? But my fear is that this entitlement can be only set by Apple for this legacyScreenSaver app, but we will see.

Addition:
I added a Entitlements.plist to the screensaver and within I set com.apple.security.files.user-selected.read-only but this had no effect on the issue. It seems this entitlement needs to be set for the program legacyScreenSaver itself and not for the screensaver. But this can be only done by Apple since legacyScreenSaver is part of the operating system.

4.) The background mode is not longer working. When I try to start it I see this error in the Console.app:
"Sandbox: legacyScreenSave deny(1) file-write-create /Users/username/Library/LaunchAgents
Violation: deny(1) file-write-create /Users/username/Library/LaunchAgents"

Seems that this new legacyScreenSaver.appex is sandboxed and it is not longer possible to create the plist file from within an screensaver that I used in the past to start the ScreenSaverEngine in background mode. I think the background feature will be gone with 10.15.

By the way the name "legacyScreenSaver" sounds bad. The name suggest Apple is planing even bigger changes and there is only a legacy support for the old screensavers that maybe soon (10.16 ?) will run out completely. I don't know if they plan to kill screensavers as a hole or if they will just bring up a complete new way to develop screensavers? Maybe in this appex format? In the PlugIns folder inside the ScreenSaver.framework contains:
legacyScreenSaver.appex
Computer Name.appex
iLifeSlideshows.appex

The new plugins can be found under:
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/ .

So far, so bad.