{"id":45249,"date":"2024-10-04T15:49:11","date_gmt":"2024-10-04T19:49:11","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=45249"},"modified":"2024-10-15T12:39:20","modified_gmt":"2024-10-15T16:39:20","slug":"damaged-mac-app-store-apps","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2024\/10\/04\/damaged-mac-app-store-apps\/","title":{"rendered":"&ldquo;Damaged&rdquo; Mac App Store Apps"},"content":{"rendered":"<p><a href=\"https:\/\/www.splasmata.com\/?p=4287\">Keith Gugliotto<\/a>:<\/p>\n<blockquote cite=\"https:\/\/www.splasmata.com\/?p=4287\">\n<p>The Mac App Store places a receipt file in each purchased application.  The receipt includes a certificate the application uses to validate that receipt to be sure you&rsquo;ve made a bona fide purchase.  That certificate is only valid for a limited amount of time &#x2013; in our experience, up to about 25 months, though sometimes significantly less, which could indicate the App Store renews these certificates every so often.  So, when you see this &ldquo;damaged&rdquo; message out of the blue, it&rsquo;s almost surely because the certificate in the receipt has expired.  You <em>could<\/em> set the date on your Mac back a bit to work around it, but you <em>really<\/em> want to straighten things out so you don&rsquo;t have to go through that fun every time you sit down to use an application.<\/p>\n<p>Usually, as long as your current Apple Account has a valid purchase for the application in question, you won&rsquo;t ever see the &ldquo;damaged&rdquo; message because the application will tell the Mac the receipt&rsquo;s invalid, the Mac will automatically refresh your receipt, and you&rsquo;re on your way.  You should only see the message in those three cases we outlined above.<\/p>\n<\/blockquote>\n\n<p><a href=\"https:\/\/x.com\/eternalstorms\/status\/1842114076408725887\">Matthias Gansrigler<\/a>:<\/p>\n<blockquote cite=\"https:\/\/x.com\/eternalstorms\/status\/1842114076408725887\">\n<p>Are any other Mac developers observing a surge of support requests for &#8220;&#60;App&#62; is damaged and can&rsquo;t be opened. Please re-download it from the Mac App Store&rdquo; recently?<\/p>\n<p>It started yesterday, out of the blue. macOS 15, 14, 13 and 12 as well&#8230;<\/p>\n<\/blockquote>\n\n<p>I am not seeing this personally, and I&rsquo;m not sure what&rsquo;s going on here, but there are multiple <a href=\"https:\/\/bsky.app\/profile\/eternalstorms.bsky.social\/post\/3l5ocpkew2h2z\">reports<\/a> of problems launching Mac App Store apps.<\/p>\n\n<p><a href=\"https:\/\/github.com\/iterate-ch\/cyberduck\/issues\/16031\">This bug thread<\/a> suggests that some receipt validation code needs to change because Sequoia adds MAC address randomization. <a href=\"https:\/\/medium.com\/@ronaldmannak\/how-to-validate-ios-and-macos-in-app-purchases-using-storekit-2-and-server-side-swift-98626641d3ea\">This post<\/a> and other sources suggest that it&rsquo;s important to use StoreKit 2 instead of validating receipts directly, although perhaps that only pertains to IAP. Apple&rsquo;s <a href=\"https:\/\/developer.apple.com\/documentation\/appstorereceipts\/validating_receipts_on_the_device#3744656\">sample code<\/a> does not seem to have changed.<\/p>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2024\/08\/20\/eaglefiler-1-9-15\/\">EagleFiler 1.9.15<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2024\/05\/03\/error-609-launching-app-from-the-mac-app-store\/\">Error -609 Launching App From the Mac App Store<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2024\/01\/16\/resolving-trusted-execution-problems\/\">Resolving Trusted Execution Problems<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2023\/05\/29\/receipt-validation-with-sha-256\/\">Receipt Validation With SHA-256<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2022\/05\/20\/new-receipt-validation-sample-code\/\">New Receipt Validation Sample Code<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2021\/03\/08\/distributing-mac-apps-without-notarization\/\">Distributing Mac Apps Without Notarization<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/12\/14\/damaged-apps-that-cant-be-opened\/\">&ldquo;Damaged&rdquo; Apps That Can&rsquo;t Be Opened<\/a><\/li>\n<\/ul>\n\n<p id=\"damaged-mac-app-store-apps-update-2024-10-08\">Update (2024-10-08): <a href=\"https:\/\/ohanaware.com\/storeKitBridge\/\">Sam Rowlands<\/a> (<a href=\"https:\/\/x.com\/Sam_Ohanaware\/status\/1842803513031840176\">tweet<\/a>):<\/p>\n<blockquote cite=\"https:\/\/ohanaware.com\/storeKitBridge\/\"><p>The OWStoreKitBridge is the latest Mac App Store receipt verification code from Ohanaware. It uses a whole new design to fit in with Apple&rsquo;s StoreKit, now that the classic Mac receipt verification functions have been moved to legacy.<\/p><\/blockquote>\n\n<p id=\"damaged-mac-app-store-apps-update-2024-10-15\">Update (2024-10-15): See also: <a href=\"https:\/\/mastodon.social\/@catlan\/113129508424358273\">this thread<\/a>.<\/p>\n\n<p><a href=\"https:\/\/mastodon.social\/@lukaskubanek\/113134881358646082\">Lukas Kubanek<\/a>:<\/p>\n<blockquote cite=\"https:\/\/mastodon.social\/@lukaskubanek\/113134881358646082\"><p>Since <code>exit(173)<\/code> is the macOS counterpart to <code>SKReceiptRefreshRequest<\/code> on iOS, I guess it falls into the same deprecation category. However, they say that the original API will continue to work. But then, <code>exit(173)<\/code> has had long phases of not working at all (<a href=\"https:\/\/github.com\/structuredpath\/AppleBugReports\/blob\/main\/FB9789052\/README.txt\">example<\/a>), so I&rsquo;m not surprised if it&rsquo;s been cut.<\/p><\/blockquote>\n\n<p><a href=\"https:\/\/social.blach.io\/@lextar\/113251687503751456\">Alexander Blach<\/a>:<\/p>\n<blockquote cite=\"https:\/\/social.blach.io\/@lextar\/113251687503751456\"><p>I would like to move to <code>AppTransaction<\/code>, but last time I checked it didn&rsquo;t support volume purchases (VPP). For apps bought in Apple School Manager, it showed an Apple ID login prompt instead.<\/p><p><code>exit(173)<\/code> now shows the &ldquo;API no longer available&rdquo; alert when I run a build from Xcode 16 on macOS 15, but it still actually refreshes the receipt anyway.<\/p><p>I wonder in which circumstances exactly this alert is shown. Maybe only when using the sandbox environment?<\/p><\/blockquote>","protected":false},"excerpt":{"rendered":"<p>Keith Gugliotto: The Mac App Store places a receipt file in each purchased application. The receipt includes a certificate the application uses to validate that receipt to be sure you&rsquo;ve made a bona fide purchase. That certificate is only valid for a limited amount of time &#x2013; in our experience, up to about 25 months, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2024-10-04T19:49:13Z","apple_news_api_id":"8a6ba7de-016f-4649-b49b-01fd0f3ce072","apple_news_api_modified_at":"2024-10-15T16:39:23Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAQ==","apple_news_api_share_url":"https:\/\/apple.news\/Aimun3gFvRkm0mwH9Dzzgcg","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[2392,30,39,2077,2223,2385,2598],"class_list":["post-45249","post","type-post","status-publish","format-standard","hentry","category-technology","tag-app-store-receipt-validation","tag-mac","tag-macappstore","tag-macos-12","tag-macos-13-ventura","tag-macos-14-sonoma","tag-macos-15-sequoia"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/45249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=45249"}],"version-history":[{"count":3,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/45249\/revisions"}],"predecessor-version":[{"id":45367,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/45249\/revisions\/45367"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=45249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=45249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=45249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}