Little snitch complains about a mismatched code signature

Question

On a Mac with High Sierra Little Snitch (a app based firewall) complains about the code signature of the xplane app.

This happened after an update today. The version is 11.11r2 (build 111101).

The error message looks like this:

Best regards

Tom

Answer 1

Mac OS default code signature check verifies the authenticity of X-Plane. It's really weird that the OS would pass it but an app would not. 

Please send us a bug report with additional info: 

• full log.txt
• which specific update broke this (11.10 to 11.11?)
• the terminal output from running the 3 commands in this article:
  • http://hacksoflife.blogspot.com/2016/11/terminal-voodoo-for-code-signing.html

Comments

How can I send the full log.txt?

There is no way to attach it here ...

The version of the app is 11.20vr1

Running the commands gives the following output:

codesign -vvv /Applications/X-Plane\ 11/X-Plane.app
--prepared:/Applications/X-Plane 11/X-Plane.app/Contents/Frameworks/OpenVR.framework/Versions/Current/.
--prepared:/Applications/X-Plane 11/X-Plane.app/Contents/Frameworks/libfmodstudio.dylib
--validated:/Applications/X-Plane 11/X-Plane.app/Contents/Frameworks/libfmodstudio.dylib
--prepared:/Applications/X-Plane 11/X-Plane.app/Contents/Frameworks/libfmod.dylib
--validated:/Applications/X-Plane 11/X-Plane.app/Contents/Frameworks/libfmod.dylib
/Applications/X-Plane 11/X-Plane.app: unsealed contents present in the root directory of an embedded framework
In subcomponent: /Applications/X-Plane 11/X-Plane.app/Contents/Frameworks/OpenVR.framework

spctl -vvv -a -t exec -vvv /Applications/X-Plane\ 11/X-Plane.app
/Applications/X-Plane 11/X-Plane.app: rejected (unsealed contents present in the root directory of an embedded framework)
origin=Developer ID Application: Laminar Research (LPH4NFE92D)

pkgutil --check-signature /Applications/X-Plane\ 11/X-Plane.app
Package "X-Plane.app":
   Status: signed by a certificate trusted by Mac OS X
   Certificate Chain:
    1. Developer ID Application: Laminar Research (LPH4NFE92D)
       SHA1 fingerprint: BE A9 8F BA 07 2B CA 98 21 AC 2B 9B 44 DD 48 34 6A 31 99 06
       -----------------------------------------------------------------------------
    2. Developer ID Certification Authority
       SHA1 fingerprint: 3B 16 6C 3B 7D C4 B7 51 C9 FE 2A FA B9 13 56 41 E3 88 E1 86
       -----------------------------------------------------------------------------
    3. Apple Root CA
       SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60

Answer 2

I guess the reason is "unsealed contents present in the root directory of an embedded framework". However, I don't know what that means.