David, we are having the same problem: an extension signed with a valid certificate and with timestamp, using ucf.jar, valid manifest, installs without problems on some machines, but gives "The extension does not contain valid signature." error on some customers' machines (the reported one is Mac OS 10.7.1, with CS5.5).

I checked the "signatures.xml", it does contain a "TimeStamps" section.

You can download the extension here: http://bit.ly/nzChAJ

Can you please take a look? I suspect there is some problem with the signature checker in CS5.5 as Pierre reports similar problems.

Thank you,

Anatoly

Thank you David,

Sorry for the delay with response - I was swamped with other activities.

You are correct, the extension doesn't work even if it succeeds to install, however the problem is that on some Mac machines it fails to install.

I'm glad that the Extension Manager team have managed to reproduce it. All I can say that the problem does not happen on all Macs - I couldn't reproduce it on my Mac OS 10.7.1, but a customer with the same version of Mac OS said that they got the "incorrect signature" error.

Do you think that the fix will be in the extension, or the users will need to update Extension Manager?

Please keep me updated on this issue if it's possible.

Thank you,

Anatoly

David, do you know if there is a temporary workaround for this problem? Would unchecking the "Show warnings when installing unsigned ZXP extension" in the Extension Manager settings help?

Thanks,

Anatoly

Hello Carl,

Thank you for your response.

I've signed our extension with the new ucf tool and sent it to a customer for testing - I will let you know once we get some feedback.

I cannot attach files to posts here (looks like it's a privelege of Adobe's employees), but the file I used was download from here: http://download.macromedia.com/pub/developer/creativesuite/extension-b uilder/signingtoolkit.zip

I am not quite sure what exactly I need to pay attention to regarding canonicalization limitations - I have no idea how the ucf tool works, and even if I did, I have no control over the verification process, so I am not sure why you are referring me to that document. Can you please elaborate?

Thank you,

Anatoly,

PixelNovel

Hi,

We are facing the same issues and urgently need to provide an update to our customers but its hard when we know they won't be able to install the update.

We tried to revert to the previous MAC version but this didn't help. Their also doesn't seem to be a difference between CS5 and CS5.5.

Can you confirm this? As the cause been located? Is their a workarround available?

Any help is aprreciated! Thanks!

Hello!

All my customers on Lion started experiencing the same problem! The new ucf.jar does NOT help. I tried it myself installing with Extension Manager CS5.5 and Lion 10.7.2 - I got the same error!

Please fix it, as noone can now install extensions on Mac OS X Lion.

P.S. Extensions now do not run at all on Lion 10.7.2, even if I copy it to CS5.5ServiceManager/.... folder. I got the blank panels.

Thank you

I agree with Harbs.

And please, to avoid confusion, disregard my note about blank panels. If I copy files manually - the extension works.

BUT the error with the installtion through Extension Manager CS5.5 is still there. The new ucf.jar does NOT help.

Please fix it, I got more and more customers who face this bug as they update to latest Mac OS X.

All,

First let me provide a quick update on the signature bug. As pointed out, the ucf.jar solution does not seem to work. We have identified a couple of other solutions to this problem, but we need to test them internally before posting them on the forums or release them as a patch to Extension Manager and/or Extension Builder (if needed). I do not have a date yet on when this fix will be available but I can guarantee you that it is a top priority internally. I am sorry that this issue has surfaced and the entire team recognizes that it is an important issue for the developer community and has significant impact on you and your customers. I (or another member from my team) will provide an update to this thread with an ETA and or the fix.

Regarding the signature issue: I suggest we discuss this on a separate thread (and possibly in the dev con in Munich for those of you who will attend). I do not see us moving away from signatures. Granted there are problems in the workflow. Hence, we should work on addressing those and simplifying the signing and deployment process. There are benefits to having extensions signed and deleting a feature is not usually the best way to solve a problem.

--

gabriel tavridis

product manager

Thank you, Gabriel! Hardly waiting

(@harbs: already budgeted for it )

Yesterday we finalized our investigation and we now have a plan regarding the fix. Our #1 priority has been to get a working solution to customers ASAP. Here are the details:

Problem

The current implementation of Extension Manager cannot access the system root keychain on Mac 10.7.1. That is due to a particular component used by Extension Manager.

Solution

Stage 1:

We will make a manual fix available by Friday 10/28 morning Pacific time. The fix will be a .swf that end-users should download and manually replace the Extension Manager .swf on their machines. After they replace the .swf, they can go ahead and install extensions using Extension Manager. This will only apply to users who are on Mac 10.7+. In addition, your users should be running Extension Manager CS5 or CS5.5 and should download the latest update through Adobe Update Manager if they haven't done so already.

I understand that this is not optimal user experience but it is the fastest solution that we can make available.

We will post the .swf and detailed instructions on this forum thread.

Stage 2:

We are already working on an update to Extension Manager that will be available through Adobe Update Manager in mid November. The update will work even if some of your users have replaced the Extension Manager .swf on Stage 1 above (ie it will overwrite the fix from Stage 1). Only users that face this problem will be notified to download the update.

Note 1: Doing the manual fix is not necessary. You could still wait until the AUM update is available.

Note 2: The fix we do in Stage 1 is different than the one we'll do for Stage 2.

Note 3: No update is necessary for CS Extension Builder or the CS SDK.

Please let me know if you have any questions or concerns.

Thank you again for helping us in discovering and solving this issue and your understanding as we drive to a solution. I will keep you all posted as news develops.

--

gabriel tavridis

product manager

Message was edited by: PECourtejoie (corrected date)

Thanks also for the quick reply @Gabriel. Although I was able to track this down on the forum fairly quickly, but it would be good to have something on the blog for end users (I'm sure you are already planning). I feel for TypeDNA extension, they just did a big marketing push, and it was installing their extension that gave me the heads up.

- Mark

Anatoliy,

yes, no change there. This problem had nothing to do with the ucf.jar.

THANKS Gabriel! Very fast response and shows again how great the work of your group is. I wish all of Adobe were as responsive.

Our CS Extension for Fotolia (free at http://www.fotolia.com/adobeplugin ) had just been released, and we were about to promote it, yet are holding off until "around November 15th." Please let us know when the AUM update comes out, or if that date solidifies or changes.

We did validate that the fix works, which is quite awesome, so someone who really wants to use our extension can, yet some end users want things to be extremely easy, so I think waiting is prudent.

Please test future dot releases of Apple OS (these come out in beta, yes?) if possible - I don't believe Apple tests these against Adobe products, and I realize you don't have infinite testing budget, but this was quite a scare as we really count on CS Extension technology, which I believe will really take off in the next few years.

We have another bug with Lion and CS extensions that forced us to avoid the native file browser. Not sure if Ole sent you details yet, but we will.

Thanks again,

Max

Anatoly,

It should be available in the next couple of days. Apologies for the delay but we have run into some issues and wanted to make sure that all possible use cases are covered.

thanks

gabriel

All,

The patch is live on Adobe Update Manager. It will show up when users check for updates for Adobe products.

--

gabriel

Will the updated AEM also be available for download? – for users who have deactivated the AUM and prefer to install manually. I downloaded files from http://www.adobe.com/exchange/em_download/ (for CS5.5) and http://www.adobe.com/exchange/em_download/em50_download.html (for CS5) and their contents looked old.