Getting "Failed to replace code signatures."error

[ScottyBeach]

Gentlemen:
I'm trying this out and get the same error trying with either a 10.14 or a 10.15 installer:

sudo createinstalliso -I /target -a /10.15.7\ macOS\ Catalina.app
Password:
Copying installer application...
Replacing existing code signatures...
Failed to replace code signatures.

sudo createinstalliso -I /target -a /10.14.6\ macOS\ Mojave.app
Password:
Copying installer application...
Replacing existing code signatures...
Failed to replace code signatures.

sudo createinstalliso -I /target -a /13.6-22G120\ macOS\ Ventura.app
Password:
Creating empty disk image...
Failed to start erase of disk due to error (-69812, 0).
An error occurred erasing the disk.
Failed to convert disk image into bootable install media.

Those are all in the same place on an external HD. Is that location a problem? The first two are both old installers with expired certs.

Any ideas? Thanks,

• Scott in Toronto

[BITespresso]

Hi Scott,

For your first two cases could you please try if this helps (also see #13):

The reason that this is now occurring more frequently is that Apple has started to apply a stricter protection against unknown software (see e.g. https://www.macrumors.com/2024/08/06/macos-sequoia-gatekeeper-security-change/). What happens is that the installer application itself gets an extended attribute com.apple.quarantine if it was downloaded or created from another location than the App Store.

As a quick workaround, you can remove this attribute with xattr -dr com.apple.quarantine <installer application path>.app. Note, however, that this is a potential security risk.

Nonetheless, I will add a better handling for this situation in a future version.

For the third case: I'll investigate this and get back to you in case I need help for the investigation.

Michael in Bonn (Germany)

[BITespresso]

@ScottyBeach: Could you tell me which macOS version number your Mac is running?

Thanks,

Michael

[ScottyBeach]

Hi Michael. Yes, I'm on 15.5 but I think it was still at 15.4 when I had this problem occur. I'll try adjusting extended attributes as you suggest. Thank you for your help!

• Scott

[ScottyBeach]

Hello Michael:
No, the xattr -dr com.apple.quarantine .app didn't work. The signing cert for the old High Sierra installer has expired so I tried setting my system clock back 5 years. This trick used to work when running the installer in the Finder but didn't help in this case.

scott@MiniWorld-5 bin % sudo createinstalliso -i /Documents/Apple\ Installers/ -a /Documents/Apple\ Installers/13.6-22G120\ macOS\ Ventura.app
Password:
Creating empty disk image...
Failed to start erase of disk due to error (-69812, 0).
An error occurred erasing the disk.
Failed to convert disk image into bootable install media.

[BITespresso]

Hi Scott,

Let's first focus on the error 'Failed to replace code signatures.' you get for Catalina and Mojave.

It would be helpful if you could try something on a copy of you existing Catalina and Mojave installers. Please use a copy and not the original installer, as this will modify files!

Execute these blocks in the sequence listed here i.e. copy and paste each block separately.

1. We need bash:

bash

2. We need root permissions:

sudo su

3. Define function to replace code signatures:

replace_code_signatures() {
  local +x -r installer_application_path="$1"

  find "${installer_application_path}" -type f -print0 | while IFS= read -r -d "" file; do
    local +x file
    local +x -i exit_status

    # Check if file has a code signature
    codesign -d "${file}"
    exit_status="$?"
    echo "Exit status from 'codesign -d \"${file}\"' is: ${exit_status}"

    # Replace existing code signature with adhoc signature
    if [[ "${exit_status}" -eq 0 ]]; then
      codesign --sign - --force "${file}"
      exit_status="$?"
      echo "Exit status from 'codesign --sign - --force \"${file}\"' is: ${exit_status}"
    fi
  done
}

4. Execute function and send stdout and stderror to file. Replace "<path_to_copy_of_your_installer_application>.app":

replace_code_signatures <path_to_copy_of_your_installer_application>.app >./DEBUG.log 2>&1

Then you can look into and provide me the content of the file DEBUG.log

You might want to do this for Catalina and Mojave but I'd expect the same reason for an error. Hope this shows what's going on.

Michael

[JanBurp]

I have the same problems. Here is the result in the DEBUG.log, hope it can be of any help.

DEBUG.log

[BITespresso]

Hi @JanBurp,

thank you for providing the logs. This allowed me to figure out what is going wrong.

The problem is that codesign does not allow to sign files that have certain extended attributes: https://developer.apple.com/library/archive/qa/qa1940/_index.html

You can find out which files contained in the installer application have some extended attributes set:

xattr -l -r <path_to_copy_of_your_installer_application>.app

In my Install macOS Mojave.app, this does not show any files with extended attributes. In your case, you have set an extended attribute for Install macOS Mojave.app/Contents/MacOS/InstallAssistant_springboard as you can see in the DEBUG.log. Unfortunately, I have no idea how this was set in your case.

The above article also contains the solution to fix this. Simply run:

xattr -c -r <path_to_copy_of_your_installer_application>.app

Check if the extended attributes have been removed by running xattr -l -r <path_to_copy_of_your_installer_application>.app again. If it did not work, please try sudo xattr -c -r <path_to_copy_of_your_installer_application>.app.

Let me know if this worked.

For the future I think about a feature to warn about files with extended attributes and either abort or allow to apply a workaround by copying the installer application and then removing the extended attribute. What is you opinion on that?

Thanks,

Michael

[devoln]

Hello! I have the same error.
The extended attribute is not removable:

$ xattr -l -r /Applications/Install\ macOS\ Catalina.app
/Applications/Install macOS Catalina.app/Contents/SharedSupport/BaseSystem.dmg: com.apple.provenance: 
/Applications/Install macOS Catalina.app/Contents/SharedSupport/AppleDiagnostics.dmg: com.apple.provenance: 
/Applications/Install macOS Catalina.app: com.apple.provenance: 
$ sudo xattr -d com.apple.provenance "/Applications/Install macOS Catalina.app/Contents/SharedSupport/BaseSystem.dmg"
$ xattr -l -r /Applications/Install\ macOS\ Catalina.app
/Applications/Install macOS Catalina.app/Contents/SharedSupport/BaseSystem.dmg: com.apple.provenance: 
/Applications/Install macOS Catalina.app/Contents/SharedSupport/AppleDiagnostics.dmg: com.apple.provenance: 
/Applications/Install macOS Catalina.app: com.apple.provenance: 
$ sudo xattr -c -r /Applications/Install\ macOS\ Catalina.app
$ xattr -l -r /Applications/Install\ macOS\ Catalina.app
/Applications/Install macOS Catalina.app/Contents/SharedSupport/BaseSystem.dmg: com.apple.provenance: 
/Applications/Install macOS Catalina.app/Contents/SharedSupport/AppleDiagnostics.dmg: com.apple.provenance: 
/Applications/Install macOS Catalina.app: com.apple.provenance: 

[JanBurp]

@BITespresso thanks for answering with a possible solution. Totaly missed your answer and in the meantime moved further. So hope someone else can test your solution.

[BITespresso]

Hello @devoln,

Apple has apparently introduced new security mechanisms to prevent software downloaded from the Internet from being executed. In addition to the extended attribute com.apple.quarantine, the attribute com.apple.provenance is also used.

As you have noticed, com.apple.provenance cannot be cleared with sudo xattr -c.

An additional requirement for removing the extended attribute com.apple.provenance is that the terminal used to execute the command sudo xattr -c is added to the list of applications with full disk access (see screenshot below).

Therefore, please add the terminal application you are using to the list of applications with full disk access and run the following commands again:

$ sudo xattr -c -r /Applications/Install\ macOS\ Catalina.app
$ xattr -l -r /Applications/Install\ macOS\ Catalina.app