Closed Bug 1072538 Opened 10 years ago Closed 10 years ago

Show help link for OSX 10.9.5/10.10 users on mozilla.org download pages

Categories

(www.mozilla.org :: Pages & Content, defect)

Production
All
macOS
defect
Not set
normal

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: lmandel, Unassigned)

References

Details

Attachments

(5 files, 1 obsolete file)

OSX 10.9.5 introduced Gatekeeper v2 signature requirements. Until Firefox 34 is released, users on this version of the OS may have difficulty installing a new copy of Firefox until builds are whitelisted by Apple. We had tried serving old builds in bug 1069545, but that caused confusion for users (bug 1069754). Instead, let's provide a link to a SUMO article that describes a workaround.

Target: OSX users on 10.9.5 or above
URL: https://support.mozilla.org/kb/firefox-cant-be-installed-mac-how-fix-it
Text: Installation on OS X Mavericks 10.9.5 or later
This is set up in optimizely.

The audience targeting is:

function checkVersion()
{
  if (navigator.userAgent.match(/Macintosh; Intel Mac OS X 10_9_5/)) {
    return true;
  }else{
    return false;
  }
}
checkVersion(); 

This is the JS I am executing to change the alert text to something specific to OSX 10.5.9.

$(".version-message-container").css({"display":"block"});
$("#version-message-desktop-old").replaceWith("<div id=\"version-message-desktop-old\" class=\"version-message\">\n      Please read this <a href=\"https://support.mozilla.org/kb/firefox-cant-be-installed-mac-how-fix-it\" target=\"_blank\" class=\"sumo-osx-link\">important message on <br>installation instructions</a> for OSX Mavericks 10.9.5.\n    </div>");
$("#version-message-desktop-old").css({"display":"block"});
Attached image Screenshot of message (obsolete) —
I will be on PTO the next two days. If you need this turned off, ping garethc or habber.

The experiment is called: Project Target Unsigned OSX
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Attached image Added to /firefox/all/ —
Attached image Added to /firefox/channel/ —
Summary: Show help link for OSX 10.9.5 users → Show help link for OSX 10.9.5 users on mozilla.org download pages
I also added it to firefox, beta, and aurora channels on the /firefox/channel/ page.
I like the help page you created; thanks!
(In reply to Lawrence Mandel [:lmandel] from comment #0)
> OSX 10.9.5 introduced Gatekeeper v2 signature requirements. Until Firefox 34
> is released, users on this version of the OS may have difficulty installing
> a new copy of Firefox until builds are whitelisted by Apple. We had tried
> serving old builds in bug 1069545, but that caused confusion for users (bug
> 1069754). Instead, let's provide a link to a SUMO article that describes a
> workaround.
> 
> Target: OSX users on 10.9.5 or above
> URL: https://support.mozilla.org/kb/firefox-cant-be-installed-mac-how-fix-it
> Text: Installation on OS X Mavericks 10.9.5 or later

lmandel: can you verify this problem doesn't also exist on 10.8.5? A friend of mine just started having this problem.
Flags: needinfo?(lmandel)
His user agent is: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:32.0) Gecko/20100101 Firefox/32.0

He's running 10.8.5
Here's what he said:

I had an overnight notification that a new Firefox was available. It downloaded and installed as usual but when I clicked to open Firefox it threw me the dialog box that said this app from an unknown developer and could not be opened.

I then opened Safari, downloaded the newest OS version for mozilla.org via Safari. It installed fine again. When I tried to click it open...it ground away in a "Verifying" box before finally throwing the same unknown developer box at me. I fixed it by changing my preference in the privacy box to accept apps from any developer.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Garethc: See latest comments above. If the issue is more than 10.9.5, we will have to adjust targeting to match multiple user agents. We will also need to change the text on each of the pages in the experiment. The channel page has the text 3 times for the firefox, beta, and aurora channels because of the separate div's for each page state.
Flags: needinfo?(garethcull.bugs)
Ok. Will follow the bug and wait for confirmation on other potential user agents that could be affected.
Flags: needinfo?(garethcull.bugs)
I also want to say the error message (firefox cannot be opened because the identity of the developer cannot be confirmed) is showing on OS X 10.8.5 too. I think it has something to do with the latest "Security Update 2014-004" that Apple also updated code sign version in the package. I also downloaded the fresh latest firefox 32.0.3 and thunderbird 31.1.2 (sept 24) same error there. I cannot believe it, Mozilla is block away from new users and new Mac customers, and asking them to HACK to open it. I don not want to compare it with other browser companies, but I have to say that Google updated chrome code sign version right after Apple releases OS X 10.9.5 ON THE SAME DAY (sept 18). Just to complain a little here.
Hey Chris,

I've adjusted the Optimizely targeting and pages to update whether the user is running OSX 10.8.5 or 10.9.5 as per comments above.

Gareth
Summary: Show help link for OSX 10.9.5 users on mozilla.org download pages → Show help link for OSX 10.9.5 and 10.8.5 users on mozilla.org download pages
I made changes to the experiment to capture the larger audience.

1) Adjusted the targeting to capture 10.8.5 and 10.9.5. This wasn't not super easy because user agent strings with Firefox vs non-Firefox are different. For Firefox users, I can only see 10.8 or 10.9, which means that 10.9.* Firefox users will see the message too. Not much I can do about that.

Updated targeting JS:

function checkVersion()
{
  if (navigator.userAgent.match(/Macintosh; Intel Mac OS X 10(_|\.)(9|9_5|8|8_5)/)) {
    return true;
  }else{
    return false;
  }
}
checkVersion(); 

I also updated the message to make it more generic:

" Please read this important message on installation instructions for Macintosh OSX."

I will attach a few screenshots.
Attachment #8494823 - Attachment is obsolete: true
Would love to get some QA on the following use cases given the mixed messages of affected users.

3 use cases:

1) No Firefox profile on 10.8.5 and fresh install latest from: https://www.mozilla.org/en-US/firefox/new/

2) Firefox profile on 10.8.5 with re-install paveover to latest from https://www.mozilla.org/en-US/firefox/all/

3) Firefox profile on 10.9.5 with re-install paveover to latest from https://www.mozilla.org/en-US/firefox/all/

Let's hope it is just 10.9.5 fresh install only and the user I found who had the same problem 10.8.5 in comment 10 and Ray in comment 14 aren't part of a larger issue.

Adjusting the regex in optimizely only takes a second to do.
Flags: needinfo?(tdowner)
Flags: needinfo?(sledru)
Summary: Show help link for OSX 10.9.5 and 10.8.5 users on mozilla.org download pages → Show help link for OSX 10.9.5 users on mozilla.org download pages
Just for reference, Apple states that the new signing requirements only affect 10.9.5 and higher, https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG205.
Users on 10.8.* should NOT be seeing these new signing requirements.
Flags: needinfo?(tdowner)
Quick note. The targeted messages for these OSX users is in en-US only, but luckily 75% of the OSX visitors to the download page(s) are en-US. All other locales won't see the install note, but all of those locales are 2% or less of the traffic.
(In reply to Tyler Downer [:Tyler] from comment #21)
> Just for reference, Apple states that the new signing requirements only
> affect 10.9.5 and higher,
> https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//
> apple_ref/doc/uid/DTS40007919-CH1-TNTAG205.
> Users on 10.8.* should NOT be seeing these new signing requirements.

Ok, good. Should we get someone from QA to verify this?
I have tested this on a couple of other 10.8.5 Macs with "Security Update 2014-004", it seems like if the fresh downloaded copy can be opened directly if the Mac has received "Gatekeeper Configuration Data" silence update (can be found via System Information > Installations), do not know if that updates the Gatekeeper's white list. Again, I can not be SURE about it. Could not find any more info related on the internet.
Also tested fresh copy of firefox 32.0 and thunderbird 31.0 they all can be opened directly without a problem. I think because they are packed and released before the 2014-004 patch and 10.9.5 release (sept 18).
(In reply to Ray M. from comment #24)
> I have tested this on a couple of other 10.8.5 Macs with "Security Update
> 2014-004", it seems like if the fresh downloaded copy can be opened directly
> if the Mac has received "Gatekeeper Configuration Data" silence update (can
> be found via System Information > Installations), do not know if that
> updates the Gatekeeper's white list. Again, I can not be SURE about it.
> Could not find any more info related on the internet.

Can you check pave overs of a pre-Firefox-32 existing install pave over to Firefox 32.0.3 on 10.8.5?
Ok, until we figure out the 10.8.5 issue, I've removed displaying the message for 10.8 visitors and also removed Firefox visitors from seeing the message.

New regex:

function checkVersion()
{
  if (navigator.userAgent.match(/Macintosh; Intel Mac OS X 10(_|\.)(9|9_5)\)/)) {
    return true;
  }else{
    return false;
  }
}
checkVersion(); 

I also ignore Firefox and ignore mobile users.
I do not think that is necessary, if someone has an older working install of firefox, it will not give any trouble to update it via the built in auto update, because the self update does not generate the OS X resource folk file (downloaded from url etc) I think, so Gatekeeper will simply pass/ignore it. It is all about the newest version 32.0.3. I think you will need to get more 10.8.5 people to check it.
In case you want "user experience", I recently upgraded to OSX 10.9.5. I had downloaded 32.0.2 previous to the upgrade but hadn't bothered to open it; I was still using 32.0.1. (I never auto-update, I always download the dmg myself. I open it, copy the app to a temporary location, rename it by appending the complete version number, and then move the renamed app to the Applications directory. I keep the last five dmg files, the last four apps in the Application directory, and the last three in the dock.)

When I opened 32.0.2 after the update OSX gave me the warning and I had to re-open it using the control-click trick to approve it. (Note that control-click works from both the dock and the finder window.)

BTW, when I went to https://www.mozilla.org/en-US/firefox/new/ while still running 32.0.1 all I saw was the "congratulations" message that I was running the latest; I didn't see the "important message" for Mac users. I gather the trick for transmitting the complete version number hasn't happened yet?
Chris, not sure what you want from me here :)
Flags: needinfo?(sledru)
(In reply to Sylvestre Ledru [:sylvestre] from comment #30)
> Chris, not sure what you want from me here :)

I'm good now. I needinfo you during the 10.8.5 vs 10.9.5 question, but we are fine now. We think it is another unrelated issue.
Flags: needinfo?(lmandel)
Tyler: can you update this bug when I can turn off the OSX 10.9.5 notification?
Flags: needinfo?(tdowner)
Flags: needinfo?(tdowner)
Let's leave it up until we get 34 signed by Apple and we don't have to deal with this anymore
lmandel: I currently have the OSX 10.9.5 notification paused. Can you confirm if I should turn it back on and how long for?
Flags: needinfo?(lmandel)
(In reply to Chris More [:cmore] from comment #34)
> lmandel: I currently have the OSX 10.9.5 notification paused. Can you
> confirm if I should turn it back on and how long for?

Yes, please reenable the notification. The notification should likely be enabled until the end of this week. I will ask Steven Michaud to confirm when Firefox 33.0 has been added to Apple's whitelist at which point we can pause the notification again.
Flags: needinfo?(lmandel) → needinfo?(smichaud)
The notification is back up for those OSX users. Let me know when I can take it back down.
Firefox 33.0 is now whitelisted on OS X 10.9.5 (in the latest Gatekeeper Configuration Data, v26.0).

(I haven't been running 10.9.5 continuously, so I don't know exactly when v26.0 came out.  But after running 10.9.5 for the last few hours I can see the v26.0 is the latest version, and that it does whitelist FF 33.)
Flags: needinfo?(smichaud)
Thanks Steven!

cmore - I assume that Apple added Firefox 33.0 to the whitelist and pushed an update on Mon or Tue of this week. Guidance from Apple is that it may take up to 48 hours for full adoption of the updated whitelist. Let's leave the notification in place until Thursday, when it can be paused again.
cmore - It has now been 48+ hours since Firefox 33 was added to the whitelist. However, we are likely to have to release 33.0.1 next week, which will not be included on the whitelist at release. If it's not too much trouble, we can pause the notification now and reenable it when 33.0.1 is released. If you'd prefer to keep the notification active until 33.0.1 has been added to the whitelist, I think that's fine as well.

I also noticed that the notification displays for Aurora and Beta. These notifications are not required as Aurora and Beta now support Gatekeeper v2 signatures. Can you selectively remove the notification from Beta and Aurora download pages?
Flags: needinfo?(chrismore.bugzilla)
Summary: Show help link for OSX 10.9.5 users on mozilla.org download pages → Show help link for OSX 10.9.5/10.10 users on mozilla.org download pages
I've removed it from beta/aurora and kept the notification running for release on /firefox/all, /firefox/new/, and /firefox/new/. It is not consuming a bunch of optimizely hits, so we should be fine leaving it on.

What's your estimate on how long we'll have to run it for 33.0.1?

Thanks for the info.
Flags: needinfo?(chrismore.bugzilla)
(In reply to Chris More [:cmore] from comment #40)
> What's your estimate on how long we'll have to run it for 33.0.1?

Worst case should be a week. Less time if Apple is able to process our request to sign a build more quickly than that. (Their turnaround time was significantly less for our Firefox 32 point releases.)
We have released Firefox 33.0.1. Can you please reenable the OSX notification?
Flags: needinfo?(chrismore.bugzilla)
Still enabled. Please update when I am able to turn it off.
Flags: needinfo?(chrismore.bugzilla)
lmandel: should I keep this running until fx 34?
Flags: needinfo?(lmandel)
Yes. Given that we just released 33.1.1 without having it whitelisted, let's just keep the message until Firefox 34 releases in a few weeks.
Flags: needinfo?(lmandel)
cmore - Firefox 34 is scheduled to release on Monday. Please remove the message on Monday.
Flags: needinfo?(chrismore.bugzilla)
Message removed! Thanks
Status: REOPENED → RESOLVED
Closed: 10 years ago10 years ago
Flags: needinfo?(chrismore.bugzilla)
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: