wb_view.app is now flagged as malware in macOS 15.6

[spichardo]

Hi,

Literally overnight, macOS decided to flag wb_view.app as malware, so it does not even offer the option of "open anyway" in the Privacy and Security configuration settings.

I think that it will be important that wb_view.app gets properly signed to avoid these issues in the future.

Cheers,

S

[johnvelab]

Did you download Workbench from the Human Connectome website? Which version of wb_view (Apple Menu -> About wb_view) are you running and which version of macOS are you using (Apple Menu -> About This Mac)?

We are actively working on signing the macOS version of Workbench but there have been a number of problems that we continue to work through.

[spichardo]

Yes, I downloaded the DMG installer from the Human Connectome website. I just re-did it, and the error remains. I can't get to the "About wb_view" menu because it does not let me open it, but this is the "Get info" from Finder

As I mentioned, it was working like a couple of days ago, and today macOS decided to flag it.

My system is an M3 Max, macOS 15.6.

Let me know if there is something I can run to check the signature from my end.

PS: I fully empathize with the challenges to sign apps properly, I have my own, and it is painful.

[spichardo]

A quick update, I ran these commands to check the app,

codesign -vv /Applications/wb_view.app
/Applications/wb_view.app: valid on disk
/Applications/wb_view.app: satisfies its Designated Requirement

spctl --assess -v /Applications/wb_view.app
/Applications/wb_view.app: CSSMERR_TP_CERT_REVOKED

So it seems one of your certificates got revoked just recently, I guess maybe resigning the app with a new one may be worth trying.

[johnvelab]

I just got a new Mac that is also running 15.6 and also get the malware warning.

I had used a certificate that I requested without having an Apple Developer paid membership. That must be the one that expired. We now have an official WashU Certificate that we will use to distribute Workbench through Apple's macOS App Store. I'm still trying to validate the app so that it can be uploaded to the store.

[spichardo]

Nice, parallel to the macOS App Store, it may still be worth continuing to distribute the new signed app through your Human Connectome website, so users decide when to update or not. AFAIK, distributing through the App Store does not allow users to stay on a specific version easily. I can clearly see some users not appreciating being updated halfway through a study, without any mechanism to roll back to a previous version.

[tomfrankkirk]

Hi, having this same issue on v2.1 with macOS 15.6. Is there an alternative distribution yet?

[glasserm]

We are still working on this. It is complicated between Apple, our university, and us. More recently the issue has been Apple allowing Connectome Workbench to see arbitrary file system paths so that one can view data whereever it is located (e.g., on remote file system mounts).

[tomfrankkirk]

Thanks @glasserm. I've been able to copy v1.5 executables from another Mac machine and that works.

[johnvelab]

We are aware of the certificate problem. There is a version of Connectome Workbench available from the macOS store. However, file access is limited to the application’s “sandbox”. If you want to use any of your data with this Connectome Workbench, the data must be copied to the directory "~/Library/Containers/edu.washu.connectomeworkbench”. Requests to access files outside of the sandbox have been denied by Apple. Effort continues to resolve this issue. Note that if you install the version from the macOS store, it may overwrite any existing version of workbench (wb_view) anywhere on your computer. In addition, this version is wb_view only, it does not contain wb_command. https://apps.apple.com/us/app/connectomeworkbench/id6749463288?mt=12 John Harwell From: glasserm ***@***.***> Date: Monday, October 13, 2025 at 8:40 AM To: Washington-University/workbench ***@***.***> Cc: Harwell, John ***@***.***>, Comment ***@***.***> Subject: Re: [Washington-University/workbench] wb_view.app is now flagged as malware in macOS 15.6 (Issue #94) [https://avatars.githubusercontent.com/u/1517260?s=20&v=4]glasserm left a comment (Washington-University/workbench#94)<#94 (comment)> We are still working on this. It is complicated between Apple, our university, and us. More recently the issue has been Apple allowing Connectome Workbench to see arbitrary file system paths so that one can view data whereever it is located (e.g., on remote file system mounts). — Reply to this email directly, view it on GitHub<#94 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AALSGXEM7QTZUJBOB7OM4KD3XOTT7AVCNFSM6AAAAACEIYHEDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGOJXGU4DIOJVHA>. You are receiving this because you commented.

…

________________________________ The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.

[DieSache]

A local-only fix for this: Put wb_view.app in /Applications/wb_view.app, remove quarantine, remove signature, sign locally.

xattr -dr com.apple.quarantine "/Applications/wb_view.app"
codesign --remove-signature "/Applications/wb_view.app"
codesign --force --deep --sign - "/Applications/wb_view.app"

[johnvelab]

Does this allow you to run wb_view on your Mac without getting Apple's security warnings? Do you have an Apple developer account with certificates installed in KeyChain? We are working on properly signing the version of Workbench that we distribute on macOS. However, we have not been able to get the code signing to work successfully. John Harwell From: Konrad Christensen ***@***.***> Date: Thursday, February 5, 2026 at 6:19 AM To: Washington-University/workbench ***@***.***> Cc: Harwell, John ***@***.***>, Comment ***@***.***> Subject: Re: [Washington-University/workbench] wb_view.app is now flagged as malware in macOS 15.6 (Issue #94) [https://avatars.githubusercontent.com/u/61785112?s=20&v=4]DieSache left a comment (Washington-University/workbench#94)<#94 (comment)> A local-only fix for this: Put wb_view.app in /Applications/wb_view.app and remove signature. Afterwards, sign locally. codesign --remove-signature "/Applications/wb_view.app" codesign --force --deep --sign - "/Applications/wb_view.app" — Reply to this email directly, view it on GitHub<#94 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AALSGXE5IJQAASROPPBEBQL4KMYLRAVCNFSM6AAAAACEIYHEDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQNJTGI4TMOBWG4>. You are receiving this because you commented.

…

________________________________ The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.

[DieSache]

Yes, this lets me run wb_view without the security warnings. This is because the invalid signature is replaced by an ad-hoc signature (codesign --sign -) that is valid locally.

That does not require an Apple Developer account or any certificates in Keychain BUT it’s not suitable for distribution to other users. They’d still need a properly signed and notarized build (or to apply the same workaround).

[johnvelab]

Thanks for your response. Unfortunately, the codesign commands did not work for me. I am running macOS Tahoe 26.2. % codesign --remove-signature "/Applications/wb_view.app" % codesign --force --deep --sign - "/Applications/wb_view.app" [image.png] John Harwell From: Konrad Christensen ***@***.***> Date: Thursday, February 5, 2026 at 2:26 PM To: Washington-University/workbench ***@***.***> Cc: Harwell, John ***@***.***>, Comment ***@***.***> Subject: Re: [Washington-University/workbench] wb_view.app is now flagged as malware in macOS 15.6 (Issue #94) [https://avatars.githubusercontent.com/u/61785112?s=20&v=4]DieSache left a comment (Washington-University/workbench#94)<#94 (comment)> Yes, this lets me run wb_view without the security warnings. This is because the invalid signature is replaced by an ad-hoc signature (codesign --sign -) that is valid locally. That does not require an Apple Developer account or any certificates in Keychain BUT it’s not suitable for distribution to other users. They’d still need a properly signed and notarized build (or to apply the same workaround). — Reply to this email directly, view it on GitHub<#94 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AALSGXC6EVPYDTGDTWR7WUL4KOROHAVCNFSM6AAAAACEIYHEDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQNJWGAYTEOJUG4>. You are receiving this because you commented.

…

________________________________ The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.

[DieSache]

Hi John.

Did you also run xattr -dr com.apple.quarantine "/Applications/wb_view.app"? I edited my comment after posting but maybe you don't see it because you're on mail? I can't see the [image.png] you posted either.

The codesigning bypasses the security error. The xattr bypasses the warning.

[johnvelab]

I use email for these messages so I did not see that your comment had been edited. After running the "xattr" command before the other two commands, I was able sign and run the DMG version of wb_view. Without running the "xattr" command, the error message (missing from my last response) was "wb_view" Not Opened Apple could not verify "wb_view" is free of malware that may harm your Mac or compromise your privacy. John Harwell From: Konrad Christensen ***@***.***> Date: Friday, February 6, 2026 at 2:22 AM To: Washington-University/workbench ***@***.***> Cc: Harwell, John ***@***.***>, Comment ***@***.***> Subject: Re: [Washington-University/workbench] wb_view.app is now flagged as malware in macOS 15.6 (Issue #94) [https://avatars.githubusercontent.com/u/61785112?s=20&v=4]DieSache left a comment (Washington-University/workbench#94)<#94 (comment)> Hi John. Did you also run xattr -dr com.apple.quarantine "/Applications/wb_view.app"? I edited my comment after posting but maybe you don't see it because you're on mail? I can't see the [image.png] you posted either. The codesigning bypasses the security error. The xattr bypasses the warning. — Reply to this email directly, view it on GitHub<#94 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AALSGXCG656K5NBTZFX4CZ34KRFMJAVCNFSM6AAAAACEIYHEDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQNJYG42TKOBYGU>. You are receiving this because you commented.

…

________________________________ The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.