Universal Autofill broken for Fastmail/Fastmate

The purpose of checking code signatures is to make sure the app you're running is the unmodified version the developer published. Intentionally circumventing that is out of scope for 1Password support I'm afraid.

Ben

As it currently stands, 1Password will only offer to fill into apps that have been signed by an Apple developer account.

That's what I thought.

Unfortunately I was/am signing using a Personal Team. That won't do then?

I do have an Enterprise Apple developer account, but bundle ID's & provisioning profiles are managed by a corporate department that very likely won't create a bundle ID and profile for this purpose.

Hey XIII:

As it currently stands, 1Password will only offer to fill into apps that have been signed by an Apple developer account. If you've signed this using an ad-hoc certificate, 1Password won't be able to fill into it.

Jack

Can you explain in a bit more detail how this works?

Why does the signature from the original developer work, but mine not? (I signed my build too)

XIII

I'm happy to hear that Universal Autofill is working with the official build on your Mac!

Some kind of whitelisting? (Allowing a specific build, manual action only once?) Yes, I think that would help.

Thank you for the feedback, I've passed it along to our developers so that they can see if this is something that we can introduce in the future. 😊

We now verify the code signature of apps before we allow filling using Universal Autofill.

I read that quite some time ago and immediately tested the "official" Fastmate build, but Universal Autofill did not work in that build either, back then.

However, when I tried the same build again today (with a newer version of 1Password) it does work!

Would a manual override when code signing verification fails be something that would work for you?

Some kind of whitelisting? (Allowing a specific build, manual action only once?) Yes, I think that would help.

PS: "My" local build only changes the icon to the official Fastmail icon, so for now I'll use the "official" Fastmate build and manually modify the icon, which does not seem to break the signature.

XIII

Thank you for following up. Users should be able to use Universal Autofill with Fastmate (as mentioned by my colleague Tommy on May 25th). However the following change in 1Password version 8.7.1 is relevant to the issue that you're running into:

We now verify the code signature of apps before we allow filling using Universal Autofill.

Source

Since you've mentioned that you "compile [your] own version of Fastmate" this is likely causing your version of Fastmate to fail the new code signature check. If you download and run an official version of Fastmate then are you able to use Universal Autofill?

Our developers are looking to see if we can improve the situation for users of ad-hoc signed apps but I don't have any public-facing updates to share at the moment. Would a manual override when code signing verification fails be something that would work for you? If it would then let me know and I can file a feature request on your behalf. 🙂

ref: dev/core/core#15513

ref: dev/core/core#15558

Any update on this?

I haven't received anything after the obligatory feedback on May 30 that it's on your internal tracker.

Can you please at least explain why you removed support for this App from v8's tentpole feature, after initially supporting it?

Hey XIII:

Great, I located your message to us, so we'll be in touch soon after we've taken a look. Thanks!

Jack

ref: IWT-84158-372

I can add/link Fastmate to Fastmail again with build 80800112, but Universal Autofill still does not work.

Diagnostics Report sent; BitBot's Support ID: #IWT-84158-372