<div dir="ltr"><div class="gmail_default" style="font-family:times new roman,serif;font-size:large"><a class="gmail_plusreply" id="plusReplyChip-0" href="mailto:kazu@iij.ad.jp" tabindex="-1">+Kazu Yamamoto</a> <br></div><div class="gmail_default" style="font-family:times new roman,serif;font-size:large"><br></div><div class="gmail_default" style="font-family:times new roman,serif;font-size:large">Hi Ben</div><div class="gmail_default" style="font-family:times new roman,serif;font-size:large"><br></div><div class="gmail_default" style="font-family:times new roman,serif;font-size:large">My 2 machines also have:</div><div class="gmail_default" style="font-family:times new roman,serif;font-size:large"><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div class="gmail_default" style="font-family:times new roman,serif;font-size:large">$ spctl --status</div><div class="gmail_default" style="font-family:times new roman,serif;font-size:large">assessments enabled</div><div class="gmail_default" style="font-family:times new roman,serif;font-size:large"><br></div></blockquote><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">I've duplicated the issue on both of my machines. It would be good to know if anybody else is seeing it. Kazu, I know you have seen this in the past. Do you get the same error installing rc1?</span></font><div><font face="times new roman, serif" size="4">W<span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">hen I run sudo make install I get a popup that says:</span></font></div><div><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></font></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><b style="color:rgba(0,0,0,0.85);font-family:"Helvetica Neue";font-size:13px;text-align:center">“libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib” cannot be opened because the developer cannot be verified.</b></div><div><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></font></div></blockquote><span style="font-family:"times new roman",serif;font-size:large"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">When I cancel out of that I get another popup with the same error. When I hit cancel on that the script ends with the output:</span></span><div><span style="font-family:"times new roman",serif;font-size:large"><br></span></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"># We finally replace the original file.<br>mv '/usr/local/lib/ghc-9.4.0.20220721/lib/package.conf.d/process-1.6.14.0.conf.copy.copy' '/usr/local/lib/ghc-9.4.0.20220721/lib/package.conf.d/process-1.6.14.0.conf'<br>'/usr/local/lib/ghc-9.4.0.20220721/bin/ghc-pkg' --global-package-db "/usr/local/lib/ghc-9.4.0.20220721/lib/package.conf.d" recache<br>dyld[32239]: Library not loaded: '@rpath/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib'<br> Referenced from: '/usr/local/lib/ghc-9.4.0.20220721/bin/ghc-pkg-9.4.0.20220721'<br> Reason: tried:<b> '/usr/local/lib/ghc-9.4.0.20220721/bin/../lib/x86_64-osx-ghc-9.4.0.20220721/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' (code signature in <CA45AED4-4028-3B3F-9AA6-91EDE1078A7E> '/usr/local/lib/ghc-9.4.0.20220721/lib/x86_64-osx-ghc-9.4.0.20220721/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' not valid for use in process: library load disallowed by system policy), '$ORIGIN/../../../lib/x86_64-osx-ghc-9.4.0.20220721/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' (no such file), '/usr/local/lib/ghc-9.4.0.20220721/bin/../lib/x86_64-osx-ghc-9.4.0.20220721/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' (code signature in <CA45AED4-4028-3B3F-9AA6-91EDE1078A7E> '/usr/local/lib/ghc-9.4.0.20220721/lib/x86_64-osx-ghc-9.4.0.20220721/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' not valid for use in process: library load disallowed by system policy),</b> '$ORIGIN/../../../lib/x86_64-osx-ghc-9.4.0.20220721/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' (no such file), '/usr/local/lib/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' (no such file), '/usr/lib/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib' (no such file)<br>make: *** [update_package_db] Abort trap: 6<br>gcolpitts@macMini-2018 ghc-9.4.0.20220721-x86_64-apple-darwin %<br><br></blockquote> <span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">Hope this helps. </span><div><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></div><div><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">Speculations: </span></div><div><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">/usr/local/lib/ghc-9.4.0.20220721/bin/../lib/x86_64-osx-ghc-9.4.0.20220721/libHSterminfo-0.4.1.5-ghc9.4.0.20220721.dylib is created after xattr -rc . was run so it doesn't have the necessary attributes. Is it possible that ghc developers and/or the test machines have this file on another of the paths in the error message and that is why it works for them?</span></div><div><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></div></blockquote><div><div><font face="times new roman, serif" size="4">I<span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"> hope I didn't offend you by asking if the fix had been tested; I assume it had been but I thought it was important to rule that out.</span></font></div><div><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></font></div><div><span style="font-family:"times new roman",serif;font-size:large">More than happy to test. I really appreciate all the work you and others have put into GHC<span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"> !</span><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"></span></span><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></font></div><div><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"><br></span></font></div><div><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">Cheers</span></font></div><div><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large">George</span></font></div><div><font face="times new roman, serif" size="4"><span class="gmail_default" style="font-family:"times new roman",serif;font-size:large"></span></font></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jul 23, 2022 at 10:03 AM Ben Gamari <<a href="mailto:ben@well-typed.com">ben@well-typed.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">George Colpitts <<a href="mailto:george.colpitts@gmail.com" target="_blank">george.colpitts@gmail.com</a>> writes:<br>
<br>
> Hi Ben<br>
><br>
> /ust/bin/xattr exists on my machine. Running "xattr -rc ." manually does<br>
> not fix the bug as noted at the start of 21506. It was sufficient in the<br>
> past but no longer fixes this error. As noted farther down in 21506<br>
><br>
> the workaround given in #17418 </ghc/ghc/-/issues/17418> no longer works.<br>
> It did not work in 9.2.2 either. The current workaround is similar to what<br>
> Kazu explained in<br>
> <a href="https://twitter.com/kazu_yamamoto/status/1500643489985761282" rel="noreferrer" target="_blank">https://twitter.com/kazu_yamamoto/status/1500643489985761282</a><br>
><br>
> sudo xattr -rc .<br>
><br>
> sudo spctl --global-disable<br>
><br>
> ./configure<br>
><br>
> sudo make install<br>
><br>
> sudo spctl --global-enable<br>
><br>
> It seems there are files created during sudo make install that have an<br>
> issue as xattr -rc . was never run on them. Perhaps this is related to<br>
> using Hadrian. Is it possible that the fix that was made was never tested?<br>
><br>
I tested the change both manually and via CI on the hardware that I have<br>
access to; in both cases installing the binary distribution resulted in<br>
a functional compiler. However, given how the effects of SIP are<br>
essentially undocumented, it is very hard to know what variables may be<br>
at play here. Running spctl --status on the machine on which I tested<br>
claims:<br>
<br>
> spctl --status<br>
objc[48908]: Class SPExecutionPolicy is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class AppWrapper is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class AppWrapperPolicyResult is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class AppWrapperPolicy is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class SPLog is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class MIS is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class SPExecutionHistoryItem is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class SPExecutionPolicyItem is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class SPDeveloperPolicy is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
objc[48908]: Class GKScanResult is implemented in both /System/Library/PrivateFrameworks/SystemPolicy.framework/Versions/A/SystemPolicy and /usr/sbin/spctl. One of the two will be used. Which one is undefined.<br>
assessments enabled<br>
<br>
Which to me suggests that SIP (which, I imagine, is responsible for<br>
#21506) is enabled. However, the lack of comprehensive documentation<br>
here makes it very hard to say with certainty what might differ between<br>
your machine and mine. Without more information I don't know how to<br>
proceed here. Perhaps someone (Moritz or Simon, perhaps) with more<br>
familiarity with macOS has some insight?<br>
<br>
Thanks for your help in testing, George!<br>
<br>
Cheers,<br>
<br>
- Ben<br>
</blockquote></div>