Little Snitch is a third party security application for Mac. Most Little Snitch users have no problems, but for some users Little Snitch reports a code signing mismatch with our application, giving messages such as:
"Code signature mismatch detected. The running process differs from the version on disk. It has no code signature, but the disk version does."
Again, most Little Snitch users do not see this. Given that SpiderOak ONE and Groups is accepted by most installations of Little Snitch, this appears to be an issue with that application and not with ONE or Groups. We are investigating the matter and will report in this space any additional information that we discover.
As background information, the purpose of code signing is to verify that the installer that you have downloaded is indeed from us and has not been tampered with by malicious third parties. Code signing is not the only way you can verify this, however. We encourage anyone affected by this problem, or indeed anyone who simply wishes to be doubly sure, to compare the SHA-256 hash of what you downloaded to our installer's published hash.
In the meantime, SpiderOak ONE and Groups 6.4.0 and later on Mac can be safely run. The code signing matter is something we take seriously and are working on, but the application itself has not been tampered with and can be safely run. If you wish, you can verify this by calculating the SHA-256 hash of the installer you downloaded and comparing it to its correct hash. To do that:
- Find the SHA-256 hash for the version of SpiderOak ONE or Groups that you downloaded, which we publish in the release notes. For example, there you will see that the SHA-265 hash for SpiderOak ONE 6.4.0 for Mac 10.13 High Sierra is aff9fd77d2af05ee122ef12a4bb62ee74089bbcda5f3506bd4e3aeffc72f892c.
- Calculate the SHA-265 hash for the .dmg file that you downloaded.
- Compare the hashes. They should match.
Usually it is sufficient to instruct Little Snitch to ignore the code signature mismatch on this software. Once that is done there should be no further warning messages or interruptions. A few users report that the warning messages continue despite having told Little Snitch to ignore the mismatch. In that case the solution is to disable LAN-Sync.