1072538 - Show help link for OSX 10.9.5/10.10 users on mozilla.org download pages

Status: RESOLVED FIXED

(www.mozilla.org :: Pages & Content, defect)

Description

[Lawrence Mandel [:lmandel] (use needinfo)]

OSX 10.9.5 introduced Gatekeeper v2 signature requirements. Until Firefox 34 is released, users on this version of the OS may have difficulty installing a new copy of Firefox until builds are whitelisted by Apple. We had tried serving old builds in bug 1069545, but that caused confusion for users (bug 1069754). Instead, let's provide a link to a SUMO article that describes a workaround.

Target: OSX users on 10.9.5 or above
URL: https://support.mozilla.org/kb/firefox-cant-be-installed-mac-how-fix-it
Text: Installation on OS X Mavericks 10.9.5 or later

Comment 2

[Chris More [:cmore]]

This is set up in optimizely.

The audience targeting is:

function checkVersion()
{
  if (navigator.userAgent.match(/Macintosh; Intel Mac OS X 10_9_5/)) {
    return true;
  }else{
    return false;
  }
}
checkVersion(); 

This is the JS I am executing to change the alert text to something specific to OSX 10.5.9.

$(".version-message-container").css({"display":"block"});
$("#version-message-desktop-old").replaceWith("<div id=\"version-message-desktop-old\" class=\"version-message\">\n      Please read this <a href=\"https://support.mozilla.org/kb/firefox-cant-be-installed-mac-how-fix-it\" target=\"_blank\" class=\"sumo-osx-link\">important message on <br>installation instructions</a> for OSX Mavericks 10.9.5.\n    </div>");
$("#version-message-desktop-old").css({"display":"block"});

Comment 3

[Chris More [:cmore]]

Attachment: Screenshot of message

Comment 4

[Chris More [:cmore]]

I will be on PTO the next two days. If you need this turned off, ping garethc or habber.

The experiment is called: Project Target Unsigned OSX

Comment 5

[Chris More [:cmore]]

Attachment: Added to /firefox/all/

Comment 6

[Chris More [:cmore]]

Attachment: Added to /firefox/channel/

Comment 7

[Chris More [:cmore]]

I also added it to firefox, beta, and aurora channels on the /firefox/channel/ page.

Comment 8

[Steve Chessin]

I like the help page you created; thanks!

Comment 9

[Chris More [:cmore]]

(In reply to Lawrence Mandel [:lmandel] from comment #0)
> OSX 10.9.5 introduced Gatekeeper v2 signature requirements. Until Firefox 34
> is released, users on this version of the OS may have difficulty installing
> a new copy of Firefox until builds are whitelisted by Apple. We had tried
> serving old builds in bug 1069545, but that caused confusion for users (bug
> 1069754). Instead, let's provide a link to a SUMO article that describes a
> workaround.
> 
> Target: OSX users on 10.9.5 or above
> URL: https://support.mozilla.org/kb/firefox-cant-be-installed-mac-how-fix-it
> Text: Installation on OS X Mavericks 10.9.5 or later

lmandel: can you verify this problem doesn't also exist on 10.8.5? A friend of mine just started having this problem.

Comment 10

[Chris More [:cmore]]

His user agent is: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:32.0) Gecko/20100101 Firefox/32.0

He's running 10.8.5

Comment 11

[Chris More [:cmore]]

Here's what he said:

I had an overnight notification that a new Firefox was available. It downloaded and installed as usual but when I clicked to open Firefox it threw me the dialog box that said this app from an unknown developer and could not be opened.

I then opened Safari, downloaded the newest OS version for mozilla.org via Safari. It installed fine again. When I tried to click it open...it ground away in a "Verifying" box before finally throwing the same unknown developer box at me. I fixed it by changing my preference in the privacy box to accept apps from any developer.

Comment 12

[Chris More [:cmore]]

Garethc: See latest comments above. If the issue is more than 10.9.5, we will have to adjust targeting to match multiple user agents. We will also need to change the text on each of the pages in the experiment. The channel page has the text 3 times for the firefox, beta, and aurora channels because of the separate div's for each page state.

Comment 13

[Chris More [:cmore]]

Attachment: Screenshot of what OSX 10.9.5 Firefox latest versios see now

Comment 14

[Gareth Cull [:garethc]]

Ok. Will follow the bug and wait for confirmation on other potential user agents that could be affected.

Comment 15

[Ray Z.]

I also want to say the error message (firefox cannot be opened because the identity of the developer cannot be confirmed) is showing on OS X 10.8.5 too. I think it has something to do with the latest "Security Update 2014-004" that Apple also updated code sign version in the package. I also downloaded the fresh latest firefox 32.0.3 and thunderbird 31.1.2 (sept 24) same error there. I cannot believe it, Mozilla is block away from new users and new Mac customers, and asking them to HACK to open it. I don not want to compare it with other browser companies, but I have to say that Google updated chrome code sign version right after Apple releases OS X 10.9.5 ON THE SAME DAY (sept 18). Just to complain a little here.

Comment 16

[Gareth Cull [:garethc]]

Hey Chris,

I've adjusted the Optimizely targeting and pages to update whether the user is running OSX 10.8.5 or 10.9.5 as per comments above.

Gareth

Comment 17

[Chris More [:cmore]]

I made changes to the experiment to capture the larger audience.

1) Adjusted the targeting to capture 10.8.5 and 10.9.5. This wasn't not super easy because user agent strings with Firefox vs non-Firefox are different. For Firefox users, I can only see 10.8 or 10.9, which means that 10.9.* Firefox users will see the message too. Not much I can do about that.

Updated targeting JS:

function checkVersion()
{
  if (navigator.userAgent.match(/Macintosh; Intel Mac OS X 10(_|\.)(9|9_5|8|8_5)/)) {
    return true;
  }else{
    return false;
  }
}
checkVersion(); 

I also updated the message to make it more generic:

" Please read this important message on installation instructions for Macintosh OSX."

I will attach a few screenshots.

Comment 18

[Chris More [:cmore]]

Attachment: Up to date Firefox Mac OSX 10.8 or 10.9 visitor

Comment 19

[Chris More [:cmore]]

Attachment: Screenshot non-Firefox OSX users see

Comment 20

[Chris More [:cmore]]

Would love to get some QA on the following use cases given the mixed messages of affected users.

3 use cases:

1) No Firefox profile on 10.8.5 and fresh install latest from: https://www.mozilla.org/en-US/firefox/new/

2) Firefox profile on 10.8.5 with re-install paveover to latest from https://www.mozilla.org/en-US/firefox/all/

3) Firefox profile on 10.9.5 with re-install paveover to latest from https://www.mozilla.org/en-US/firefox/all/

Let's hope it is just 10.9.5 fresh install only and the user I found who had the same problem 10.8.5 in comment 10 and Ray in comment 14 aren't part of a larger issue.

Adjusting the regex in optimizely only takes a second to do.

Comment 21

[Tyler Downer [He/Him]]

Just for reference, Apple states that the new signing requirements only affect 10.9.5 and higher, https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG205.
Users on 10.8.* should NOT be seeing these new signing requirements.

Comment 22

[Chris More [:cmore]]

Quick note. The targeted messages for these OSX users is in en-US only, but luckily 75% of the OSX visitors to the download page(s) are en-US. All other locales won't see the install note, but all of those locales are 2% or less of the traffic.

Comment 23

[Chris More [:cmore]]

(In reply to Tyler Downer [:Tyler] from comment #21)
> Just for reference, Apple states that the new signing requirements only
> affect 10.9.5 and higher,
> https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//
> apple_ref/doc/uid/DTS40007919-CH1-TNTAG205.
> Users on 10.8.* should NOT be seeing these new signing requirements.

Ok, good. Should we get someone from QA to verify this?

Comment 24

[Ray Z.]

I have tested this on a couple of other 10.8.5 Macs with "Security Update 2014-004", it seems like if the fresh downloaded copy can be opened directly if the Mac has received "Gatekeeper Configuration Data" silence update (can be found via System Information > Installations), do not know if that updates the Gatekeeper's white list. Again, I can not be SURE about it. Could not find any more info related on the internet.

Comment 25

[Ray Z.]

Also tested fresh copy of firefox 32.0 and thunderbird 31.0 they all can be opened directly without a problem. I think because they are packed and released before the 2014-004 patch and 10.9.5 release (sept 18).

Comment 26

[Chris More [:cmore]]

(In reply to Ray M. from comment #24)
> I have tested this on a couple of other 10.8.5 Macs with "Security Update
> 2014-004", it seems like if the fresh downloaded copy can be opened directly
> if the Mac has received "Gatekeeper Configuration Data" silence update (can
> be found via System Information > Installations), do not know if that
> updates the Gatekeeper's white list. Again, I can not be SURE about it.
> Could not find any more info related on the internet.

Can you check pave overs of a pre-Firefox-32 existing install pave over to Firefox 32.0.3 on 10.8.5?

Comment 27

[Chris More [:cmore]]

Ok, until we figure out the 10.8.5 issue, I've removed displaying the message for 10.8 visitors and also removed Firefox visitors from seeing the message.

New regex:

function checkVersion()
{
  if (navigator.userAgent.match(/Macintosh; Intel Mac OS X 10(_|\.)(9|9_5)\)/)) {
    return true;
  }else{
    return false;
  }
}
checkVersion(); 

I also ignore Firefox and ignore mobile users.

Comment 28

[Ray Z.]

I do not think that is necessary, if someone has an older working install of firefox, it will not give any trouble to update it via the built in auto update, because the self update does not generate the OS X resource folk file (downloaded from url etc) I think, so Gatekeeper will simply pass/ignore it. It is all about the newest version 32.0.3. I think you will need to get more 10.8.5 people to check it.

Comment 29

[Steve Chessin]

In case you want "user experience", I recently upgraded to OSX 10.9.5. I had downloaded 32.0.2 previous to the upgrade but hadn't bothered to open it; I was still using 32.0.1. (I never auto-update, I always download the dmg myself. I open it, copy the app to a temporary location, rename it by appending the complete version number, and then move the renamed app to the Applications directory. I keep the last five dmg files, the last four apps in the Application directory, and the last three in the dock.)

When I opened 32.0.2 after the update OSX gave me the warning and I had to re-open it using the control-click trick to approve it. (Note that control-click works from both the dock and the finder window.)

BTW, when I went to https://www.mozilla.org/en-US/firefox/new/ while still running 32.0.1 all I saw was the "congratulations" message that I was running the latest; I didn't see the "important message" for Mac users. I gather the trick for transmitting the complete version number hasn't happened yet?

Comment 30

[Sylvestre Ledru [:Sylvestre]]

Chris, not sure what you want from me here :)

Comment 31

[Chris More [:cmore]]

(In reply to Sylvestre Ledru [:sylvestre] from comment #30)
> Chris, not sure what you want from me here :)

I'm good now. I needinfo you during the 10.8.5 vs 10.9.5 question, but we are fine now. We think it is another unrelated issue.

Comment 32

[Chris More [:cmore]]

Tyler: can you update this bug when I can turn off the OSX 10.9.5 notification?

Comment 33

[Tyler Downer [He/Him]]

Let's leave it up until we get 34 signed by Apple and we don't have to deal with this anymore

Comment 34

[Chris More [:cmore]]

lmandel: I currently have the OSX 10.9.5 notification paused. Can you confirm if I should turn it back on and how long for?

Comment 35

[Lawrence Mandel [:lmandel] (use needinfo)]

(In reply to Chris More [:cmore] from comment #34)
> lmandel: I currently have the OSX 10.9.5 notification paused. Can you
> confirm if I should turn it back on and how long for?

Yes, please reenable the notification. The notification should likely be enabled until the end of this week. I will ask Steven Michaud to confirm when Firefox 33.0 has been added to Apple's whitelist at which point we can pause the notification again.

Comment 36

[Chris More [:cmore]]

The notification is back up for those OSX users. Let me know when I can take it back down.

Comment 37

[Steven Michaud [:smichaud] (Retired)]

Firefox 33.0 is now whitelisted on OS X 10.9.5 (in the latest Gatekeeper Configuration Data, v26.0).

(I haven't been running 10.9.5 continuously, so I don't know exactly when v26.0 came out.  But after running 10.9.5 for the last few hours I can see the v26.0 is the latest version, and that it does whitelist FF 33.)

Comment 38

[Lawrence Mandel [:lmandel] (use needinfo)]

Thanks Steven!

cmore - I assume that Apple added Firefox 33.0 to the whitelist and pushed an update on Mon or Tue of this week. Guidance from Apple is that it may take up to 48 hours for full adoption of the updated whitelist. Let's leave the notification in place until Thursday, when it can be paused again.

Comment 39

[Lawrence Mandel [:lmandel] (use needinfo)]

cmore - It has now been 48+ hours since Firefox 33 was added to the whitelist. However, we are likely to have to release 33.0.1 next week, which will not be included on the whitelist at release. If it's not too much trouble, we can pause the notification now and reenable it when 33.0.1 is released. If you'd prefer to keep the notification active until 33.0.1 has been added to the whitelist, I think that's fine as well.

I also noticed that the notification displays for Aurora and Beta. These notifications are not required as Aurora and Beta now support Gatekeeper v2 signatures. Can you selectively remove the notification from Beta and Aurora download pages?

Comment 40

[Chris More [:cmore]]

I've removed it from beta/aurora and kept the notification running for release on /firefox/all, /firefox/new/, and /firefox/new/. It is not consuming a bunch of optimizely hits, so we should be fine leaving it on.

What's your estimate on how long we'll have to run it for 33.0.1?

Thanks for the info.

Comment 41

[Lawrence Mandel [:lmandel] (use needinfo)]

(In reply to Chris More [:cmore] from comment #40)
> What's your estimate on how long we'll have to run it for 33.0.1?

Worst case should be a week. Less time if Apple is able to process our request to sign a build more quickly than that. (Their turnaround time was significantly less for our Firefox 32 point releases.)

Comment 42

[Lawrence Mandel [:lmandel] (use needinfo)]

We have released Firefox 33.0.1. Can you please reenable the OSX notification?

Comment 43

[Chris More [:cmore]]

Still enabled. Please update when I am able to turn it off.

Comment 44

[Chris More [:cmore]]

lmandel: should I keep this running until fx 34?

Comment 45

[Lawrence Mandel [:lmandel] (use needinfo)]

Yes. Given that we just released 33.1.1 without having it whitelisted, let's just keep the message until Firefox 34 releases in a few weeks.

Comment 46

[Lawrence Mandel [:lmandel] (use needinfo)]

cmore - Firefox 34 is scheduled to release on Monday. Please remove the message on Monday.

Comment 47

[Chris More [:cmore]]

Message removed! Thanks