Search code examples
macosshared-librariesmacos-monterey

System can't verify shared libraries

I have a program executable that uses quite a few shared libraries. However when attempting to download and run it on another computer I get an error saying that the program can't be opened because the libraries cannot be verified. The only way to run it is to manually go into system preferences and allow each individual library. Is there any way to get the libraries verified so that the program can be run normally?

Solution

  • Library Validation ensures dynamically-loaded libraries are signed off by the same entity which signs the main executable.

    Per Apple: Code Signing Tasks:

    A program may link against any library with the same team identifier in its code signature as the main executable, or with any Apple system library. Requests to link against other libraries are denied.

    To get the libraries validated, they must be codesigned with the same identity. Your identity would look something like this, depending on your certificate type: "Developer ID Application: Firstname Lastname (XXXXXXXXXX)" The required team identifier is the ten-character code in parentheses. The entire string in double-quotes is the common name of the certificate used.

    codesign -s "Developer ID Application: Doctor Who (1234567890)" path/to/binary
    Caveat: Once you get beyond library validation: macOS 12 will attempt to verify the team identity by the stapled notary ticket or by looking up the ticket on Apple servers in the cloud. Without notarizing, no problem for your own machine as there is no need to validate the self. In macOS 12 the Notary/sandbox/library validation/hardened runtime security scheme is enforced by default.