[Bug report] Publii 0.46.3 fails Apple verification

[johnluther]

Operating system

Mac OS Sequoia 15.3

Publii version

0.46.3

Issue type

Application

Bug description

I copied Publii 0.46.3 to my Applications folder. When I try to run it, I get the error, "Apple could not verify “Publii” is free of malware that may harm your Mac or compromise your privacy."

Steps to reproduce

Try to run Publli appliction

Relevant log output

No response

[bobmitro]

Are you sure?

I just checked this, and it's actually the opposite - Apple does verify applications. We sign it before every release.

Additionally, no one else has reported a similar issue.

[dziudek]

@johnluther - I have downloaded both version of Publii (Intel/Mac) and it looks correct:

[johnluther]

I definitely get the error, and on multiple computers.

Is the verification just a local signature check, or does it ping an Apple server? Downdector reports that Apple has had some disruptions in the last few hours.

(The app name is Publii 2 because on my Mac mini I didn't want to blow away 0.43.2 and be unable to update my site.)

[bjazmoore]

What version of Mac OS are you running? Have you updated to the most recent? Are sure you have downloaded the authentic Publii download? Try changing your DNS settings to point to the Google DNS: 8.8.8.8 and 8.8.4.4. Clear your browser cache, restart and try again.

[johnluther]

MacOS 15.3.1 (24D70)

I'm sorry, I use NextDNS on my router and don't want to bother changing settings and rebooting my whole network. I don't update the site often, so running Publii isn't urgent for me. I can keep running 0.43.2 for now.

Here's a SHA-256 of the file I downloaded, if that would be of use:

70f4b068a429e9563c2f2eab219b12746eb5328ce3b83af5e84b24f0b31c2c16 Publii-0.46.3-apple-silicon.dmg

[dziudek]

@johnluther - I am getting exactly the same sha-256 sum for this file:

downloads % shasum -a 256 Publii-0.46.3-apple-silicon.dmg
70f4b068a429e9563c2f2eab219b12746eb5328ce3b83af5e84b24f0b31c2c16  Publii-0.46.3-apple-silicon.dmg

[dziudek]

@johnluther - the only strange thing which I see is "Publii 2" as name. I have also checked the Publii.app with codesign -dv --verbose=4 Publii.app command and app seems to be properly signed

[johnluther]

0.46.3 magically started working this morning without the error. I didn't change anything. 🤷‍♂️

[dziudek]

@johnluther - I suspect that it could be a network issue :)