I installed the 2017 Tex package earlier this year and I have managed to update using Tex Live Utility without any issues thus far.

I just lately installed Little Snitch and it flagged the mirror via wget.x86_64-darwin and the explanation was that the mirror does not have a valid signature whilst Tex Live Utility itself has a valid signature and so the rule requires a valid signature on both the process's.

Any suggestions as to how I should proceed?


I am on a iMac OS High Sierra Version 10.13.3

I edited the second paragraph and hopefully it is gives a better description of the issue than the unedited second paragraph did.

Here is the warning I got from Little Snitch:

TeX Live Utility via wget.x86_64-darwin want to connect to mirror.ctan.org

Caution: "wget.x86_64-darwin" has no code signature. The executable can be maliciously modified without being detected. The matching rule is therefore not being applied.

A matching rule exists that requires a valid code signature of "TeX Live Utility", but it does not explicitly specify a requirement for the via process(in this case, "wget.x86_64-darwin"). The rules is therefore only applied if the via process's signature is also valid.

TeX live Utility has a valid code signature, but "wget.x86_64-darwin" does not. The matching rule is therefore not applied.

I could write a new rule for TeX Live Utility via wget.x86_64-darwin that ignores any code signature but I am reluctant to do that since the Little Snitch warning is clear that, that would be less secure.

Not having sufficient confidence to overwrite the existing rule is maybe a reflection of my paranoia of corrupting my files and even my computer.

Little Snitch Network Monitor.log

Here is the relevant log pertaining to wget.x86_64-darwin:

2018-02-01 14:00:19.638 Little Snitch Network Monitor[530:4903] Error loading external Internet Access Policy for bundle: /usr/local/texlive/2017/tlpkg/installer/wget/wget.x86_64-darwin: Code signatue of bundle is not valid: /usr/local/texlive/2017/tlpkg/installer/wget/wget.x86_64-darwin

  • I'm afraid the sentence "I just lately installed Little Snitch and it denies access to the via wget.x86_64-darwin since it does not have a valid signature whilst Tex Live Utility has a valid signature" is nearly incomprehensible. One or more words seem to be missing, for sure. Please rephrase, preferably less tersely. – Mico Feb 1 '18 at 21:44
  • How could a programme on your computer flag a mirror? Assuming your computer is not doing the mirroring and you don't have write access, that seems impossible. And what do you mean that it flagged it 'via wget.x86_64-darwin'? I assume that the latter is a binary wget, compiled for 64 bit x86 architecture running whatever version of Darwin is the basis for OS X 10.13.3. But that leaves me none the wiser. A link to information about Little Snitch would help, but not a lot - I know what Little Snitch does (vaguely) and I still don't understand your question. – cfr Feb 1 '18 at 22:41
  • Doesn't it let you grant an exception? I don't see how a mirror could have a signature. Usually, files have signatures (binaries, archives, documents etc.). And the mirror is not a process. My best guess is that something doesn't have a signature and Little Snitch won't let whatever it is contact the mirror for that reason. But what doesn't have a signature? The wget binary? Something else? – cfr Feb 1 '18 at 22:45
  • Thank you for your patience ... I will have to do some more digging to get you the information you asked for so that my question is a lot clearer ... clearly I do not understand it in the depth necessary to articulate it so that it make sense. – railsdancer Feb 1 '18 at 22:53
  • 1
    I sign TeX Live Utility and all binaries I include with it. However, the binaries such as wget shipped with MacTeX/TeX Live are not code signed and probably never will be, unlike tools shipped with the OS. Note that wget is a fallback when direct downloading in tlmgr fails, so you might also see warnings about tlmgr being unsigned. Or perhaps not, since /usr/bin/perl is codesigned; I don't use Little Snitch, so I'm not familiar with how it checks. – Adam Maxwell Feb 2 '18 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.