Warning message!

[dfrost]

I booted up 1.8.6 a short while ago to do some editing.  PI stated there were 7 updates available, which i downloaded, and the installed and restarted the program.

Upon restarting, I got this error message: 

The program has been modified!
The code signature of the process has become invalid.  This indicates that the process was modified and may not behave as intended by its developer.  If you have not modified the program or one of its libraries intentionally, it may have been modified by a malware attack.  If this was an intentional change, disable validation here.

The only two choices of actions are:  "Disable Identity Check", or "Deny Any Connection".

What is causing this, and what are the consequences of each choice?

 

[Juan Conejero]

From the information you are providing I assume you are running PixInsight on macOS. Please do the following to verify integrity of your PixInsight installation:

- Open the Terminal application.

- Enter the following command:

Code: [Select]

shasum /Applications/PixInsight/PixInsight.app/Contents/MacOS/PixInsight
If you have the latest 1.8.6.1475 version of PixInsight, the checksum must be: ae0a37faa499119e379512560e49fd36317b72b1

- Enter the following command to assess validity of our digital signature:

Code: [Select]

codesign --verify --verbose /Applications/PixInsight/PixInsight.app
The result must be:

/Applications/PixInsight/PixInsight.app: valid on disk
/Applications/PixInsight/PixInsight.app: satisfies its Designated Requirement


If the above tests are passed, then you can be sure that your installed PixInsight application is valid. In other case the application has been modified out of our control and you probably have a malware, or an external process has tampered with application binaries.

Are you using the Little Snitch application? I guess that from the warning messages you have provided. In such case, depending on Little Snitch's configuration or working method, it may be incompatible with our update system. We sign our application bundles carefully to allow replacement of the PixInsight core application executable file without breaking the application bundle's code signature. Our update system performs secure encrypted transactions with cryptographic validation of downloaded update packages, and all of our executable files (including .so files) are digitally signed by us. When you install an update package from one of our official repositories using their default https:// repository URLs, you can be completely sure that updated files have been replaced with the original files we have produced. However, viruses and other malwares, including poor virus protection software, may alter files beyond our control. Code signing and cryptographic checksums exist and are deployed to prevent these attacks from having nasty consequences.

[dfrost]

Thanks Juan!  Everything checked out fine with the checksums.  I am running little snitch, and apparently that was the issue that popped up the warning message.  Thanks for your help.

David