"This version has been tampered with".

[Dominyk Tiller]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

OS X 10.10 DP6 seems to have broken Tunnelblick. Every time it opens
it now yells "This version has been tampered with".

It's a false positive. I went back to the download site and checked
both the MD5 & SHA1 against the posted checksums and it matched, and
then installed fresh against those correct checksums and hit the same
error message. (I suppose theoretically it's possible that the website
has been compromised too).

The only thing I can think of that's causing this that changed between
DP5 & DP6 is that Apple has implemented stronger codesigning
requirements for DP6 onwards. All applications and kexts, etc must now
be signed with a machine running nothing older than 10.9, Mavericks.
Anything older will generate error messages.

Dom
- --
Sent from Thunderbird for OS X. My PGP public key is automatically
attached to this email.
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJT8ohtAAoJEIclJNuddDJsm9IP/3viKa44ZOuu4mbVK8vRKFZY
50PpT1ss/6z+aLqtX/HgghY5FDVLsx6GB8zf3oMsUhNAzJiP8OhUE5wr5cdX1G/q
Lk1sJfKIG+jdOs6NlWqHexQujKOpapA+NDmv6OtIau4q+EPC+98wBdRsEDkyXyga
laS8jfFP0GPnxYsbUJ1c+bfGXev13AIE2P2JA5w/CxN01BBH2PbA+riCb1nb8E4A
6ku4c3uICjPG1NEmMEfPLv64A4bz5MF3T1r8jXMcOyyGTYzObjM5WPkXEiRntI8E
SbVWS8UW+I6GQMpC5ARFMVa2/vir0xA97caRw+UknIaXGiVfPMjDI7rF+rqsZ3FO
ao6uoU5cv1xBXccCKkb4RTfb+RhBCbR9kccQmdwwEeI/XIg27lWI5W/VRqImCP+J
DZBJ8M1/Xfzzk6AjA/dF+sImQWlbzoMxAKKch8lzOOoW6kMDi7GqThZteJOQWSgE
8zSkFVZHbsSXs2BVv+TH7OFRK2m1CnSPUqKgdbGV4i1jTIKDnhk8GhD+gfGp/u2W
X6DvZ4ddNCBy3ESScO85UzpqyU7Zm1ENT7XC7G/edxgC55ROnJf6CwOpWV8gvsdo
sYVCe/lKxFGIBFeL1emFApJXotBzcPl4R+UZFp2kUc1D3i9Pp6ELa6KJqi7eG+WR
B++vk1JegxUA1CMKZj3u
=HT0q
-----END PGP SIGNATURE-----

[jkbull...gmail.com]

Thank you for this report. I have not had a chance to test DP6, so I haven't seen this.

Tunnelblick is signed under 10.8 (although it is built under 10.6.8 so 10.4 and PPC are supported). There was a problem signing it with 10.9 but I don't remember if it was because the 10.9-generated signatures were not accepted by 10.5 or if there was some other problem.

I will look into this and report back to this thread, but probably not for a day or two.

The main problem with 10.10 considering the signature invalid may be that it won't recognize updates as being the same program, so it will request that the user authorize Tunnelblick's use of each VPN username/password that have been saved by the old version of Tunnelblick.

[Dominyk Tiller]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Apologies for the delayed reply.

I went back to the seed notes and plucked this section out which
explains it in a little more detail:

"Signatures created with OS X v10.8.5 or earlier ("v1 signatures") are
obsoleted and will no longer be recognized by Gatekeeper. To ensure
your apps will run on updated versions of OS X they must be signed
using the codesign tool on OS X v10.9 or later ("v2 signatures")."

This could also be relevant:

"App extensions for OS X are always run as 64-bit code. You will need
to build your extensions, and any shared frameworks they depend upon,
to include 64-bit support"

Sent from Thunderbird for OS X. My PGP public key is automatically
attached to this email.

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJT+At1AAoJEIclJNuddDJsryoP/1Cg5g/m3ky5EbwpcUMk2+Ld
DtNNxOSKo67j+wlK312ph79x7lphLZL7pSJlSBAFuwQe1nrLn2INsSw9zd8l70Dc
F4FIluKk1JjWFimZMLP+4TfvwLGR55rN66++0XguB8YgfHByifbo1KFCaKfD0vkQ
siKViDXL0J2b5O9gw7I1werJxL7AJWRw4E4WL4vX3s/DjIXhIwNoyWClmdBlhiMG
2MDtxFj7WTzeknsbMyEaD/i+qCoGSch7dobBfPlCcNd+lKssIHCkgDrirmDhAzSZ
01wOuj86ndl5JxoaZOIoT8ZoXzAXKFjC+uXkT/SQZR8EW9p2qg1hFvpT4yoh9fBS
/YRx6uketTnNrotsevB5sNUIt3DR9CtvB4VD7UAbSgPMwPc0k5Ca4lVVOHccJLPP
YrCC1UCciYI6RmvvTFWSxRdXeGyFYYDWDc4c8JJg7tkx1rklTez47JkRHZAUhcBw
EMr5irTNerUTva/B3L7VUnwMax3esthGWJuOevQf+A9iaK5lAGrxSqMA143DTeZg
LUVS+5wsWE/m+YXrWbmEkGWx2JrDZb338iI4hcpqdeugbM9om057siNVSqj2y1r/
Ct4iB1lbwgvgqiJYuRu0aYh8y8D7zjMPyoUhb7Q96G9KsJJU0xxetheSZ/9k1UAi
UAd7vyqNmDe2fSCgYn44
=OLna
-----END PGP SIGNATURE-----

[chuck...@gmail.com]

On Tuesday, August 19, 2014 1:13:45 AM UTC+2, Dominyk Tiller wrote:

OS X 10.10 DP6 seems to have broken Tunnelblick. Every time it opens
it now yells "This version has been tampered with".

 I can confirm this in 10.10 public beta 2, which is virtually identical to DP6.

[ba...@seesink.net]

Hi,

Having the same problem. This version has been tampered with

done the same thing as Dominyk Tiller 

checked both the MD5 & SHA1. They are a match.

Using it on a mac with the beta 2 of 10.10

greetings

Palermo

[jkbull...gmail.com]

I have committed a fix for this problem as r2937, and a "snapshot" (pre-release) version with the fix is available. Email me directly at jkbullard at gmail to get a link to download the snapshot.

[vina...@gmail.com]

Is there a simple Xcode project file that would let me build this on Yosemite? I got it to almost build using Xcode 6b3 (with lots of warnings though) but it's failing with creating the archive. 

Thanks,

Vinay

[jkbull...gmail.com]

Not that I know of, but feel free to contribute one!

To support PowerPC processors and OS X 10.4, Tunnelblick is built with Xcode 3.2.2, the latest version that supports PowerPC processors, on OS X 10.6.8, the latest version that supports Xcode 3.2.2.

[jkbull...gmail.com]

Tunnelblick 3.4beta36 includes a fix for this problem, which affects OS X 10.9.5 ("Mavericks") and 10.10 ("Yosemite"). It may be found on the Tunnelblick Downloads page.

On Monday, August 18, 2014 7:13:45 PM UTC-4, Dominyk Tiller wrote:

[dominy...@gmail.com]

Yup. Can confirm the new beta resolves the issue on DP7. Thanks!

[klvn...@gmail.com]

Hi,

Is it possible that this is occuring when cleaning caches?
Everytime I use CleanMyMac to rid of system bulk, it may have removed digital signatures for TunnelBlick.
So everytime, I reinstall TunnelBlick to correct this issue, but reappears when running another purge.
Hope this helps!

[jkbull...gmail.com]

CleanMyMac probably doesn't remove the signatures. If they were removed you would get a message that Tunnelblick is unsigned, not that it was tampered with.

My guess is that CleanMyMac is doing much more than removing caches, and that it is removing "unused" languages from applications. If anything inside Tunnelblick is removed or altered, including language files, you will get the "tampered with" message.

[klvn...@gmail.com]

Yes, language files are being removed.
Avoid or can this be considered for the next build?

Thanks!

[jkbull...gmail.com]

No, I'm afraid not. See my response at https://groups.google.com/d/msg/tunnelblick-discuss/OyPQrDSQXdU/oMv6FqW8_WIJ.

[klvn...@gmail.com]

Sorry, wasn't aware you've responded elsewhere before. Thanks for the update. Cheers.