Panorama on macOS Sierra

Panorama X
1

I have not yet installed the new macOS Sierra beta on any of my own machines yet. But I did get to spend about an hour with it on a friend’s computer on Tuesday. The quick summary is that Panorama X works fine, but Panorama 6 won’t install.

Of course I’m not surprised that Panorama X works – compatibility with future OS versions has been a major goal of the project. To that end, Panorama X is completely modern, it doesn’t use any deprecated APIs, and it compiles completely cleanly with zero warnings, as shown in the screenshot from Xcode below. It was great to see the payoff for all this work with Panorama X working flawlessly on macOS 10.12 Sierra the first time.

One thing I was curious about was what the new 10.12 “window tabs” feature would do in Panorama X. It turns out it does nothing — there are no out of the box window tabs in Panorama X. I think that is good, it is unlikely Panorama’s multi-window document approach would work well with any automatic solution Apple could come up with. Hopefully eventually I can add specific window tab support for Panorama in the future, probably integrating tabs with the View menu. This could be a great way to open multiple procedures in a single window, for example. (Whether you could mix forms, windows and data sheets in different tabs in the same window will have to be investigated.)

Unfortunately, I was unable to install Panorama 6 due to the new Gatekeeper Path Randomization feature in 10.12. This is a new security feature in macOS Sierra. If you are not familiar with it (it was only introduced last week, after all), here is a page with a lot of information about it.

http://mjtsai.com/blog/2016/06/16/gatekeeper-path-randomization/

Gatekeeper Path Randomization is designed to prevent applications from using external resources, which Panorama 6 heavily relies on. So there is no easy fix on the Panorama 6 side. I spent quite a bit of time trying to trick the system into allowing the install without luck. Perhaps further efforts will come up with a trick that works, but at this point it doesn’t look like there will be any trick that will be suitable for ordinary, non-technical users.

Since Gatekeeper Path Randomization is related to the installation of applications, it’s possible that an already installed copy of Panorama 6 would continue working after an upgrade to macOS Sierra. I wasn’t able to test that.

This is the first beta of macOS Sierra. It’s possible that Apple may make further adjustments that may mitigate this problem. Since I wasn’t able to do further testing, it’s also possible that there will be additional problems with Panorama 6 beyond just installation.

For the past few years, I would hold my breath at WWDC time wondering if Panorama would continue to work. It isn’t definite and concrete yet, but this year may be the end of the road for “classic” Panorama. Fortunately Panorama X is very far along, so at the moment my plan is to push forward with the development of Panorama X as fast as possible.

2

It was clear that this change was coming and it is now in our face. Fortunately, it does appear that Panorama may slide through by the skin of its teeth as if it was all planned to happen this way. :slight_smile:

3

The only thing that prevents me from putting PanX into service is the server. Every application we use in our office is server based, and I have converted them all to PanX, as stand alone apps, and made what I think are some major improvements. (Some are possible due to PanX features that did not exist earlier, and some are possible because I took the course and learned a lot of stuff.) Go Server! I retire on October 31, 2016, so I wish I could install PanX before then.

4

I hope you find a way to make Panorama 6 work on Sierra. All of my clients use shared databases. As they buy new machines (at least once a year), it could cause major problems. I have a feeling they are going to be upgrading before Panorama 10 will be multiuser.

5

I just installed the MacOS Sierra Beta on a retired Mac which I was using with Pan6 and PanX until about a month ago. After the installation, Pan6 lost it’s serial number, so I had to re-enter that, after changing the permissions on the root folder. After 15 minutes of trying things out, all my databases seem to work normally, including connecting to the Panorama server.

6

Jim’s original advice was that Pan 6 can’t be installed in Sierra but it seems that it can be made to work if Sierra is installed on a machine on which Pan 6 already exists.

Cooper, do you reckon you could determine which things revived Pan 6 in your “15 minutes of trying things out”? A clear set of procedural steps would be very helpful to anybody who wants to move to Sierra whilst retaining Pan 6.

michael

7

I am sure there are many people on this list who know more about this than I and could give a better explanation, starting with Jim’s comment above. But I understand that part of Apple’s security strategy is to set up obstacles to installing executable software and I assume that the Pan6 installation procedures were stymied by Apple’s latest security. After installing the MacOS Sierra beta, the only thing I did with Panorama was to enter my serial number again. This requires changing the permissions at the root level to give yourself read/write permissions for the root directory. That was it. It worked after that. I have a very limited set of Panorama functions and statements employed, so it was hardly a thorough test, and I would not find it acceptable to use MacOS Sierra and Pan6 in a production environment, such as my office, where we have 10+ people using it, without more thorough evaluation and strategies for using them together.

8

I hope that you will report these problems to Apple. I can understand the need for security, but then, there are the needs for people to be able to do what they have done before, as well. There are many things that I need to do with Pan 6, as long as Pan X is not ready for prime time, and I am finding too many glitches to switch over, even without using the server version.

9

There is nothing to report to Apple. Panorama was violating the recommendations for security that Apple had designed into the system. When it was necessary to adjust the write permissions for the root of the directory to install Panorama, this opened the Mac up to other malware type of threats. Do not think that Apple viewed this as anything other than wrong. Apple’s position relative to Pano X not being ready is to continue to use the computers and operating systems that work for you, but do not expect Apple to modify their security designs to accommodate software that violates recommended methods.

10

That is fine if you are more sophisticated than the average end user. But the fact that Apple has released Sierra as a public beta means that they want to hear about problems that the public will run into.

That is the same with Pan X. So far I am batting zero with conversions, and the work-arounds have been anything with simple. So while it may bore people to read about the problems I am having, I will continue to report them.

11

Bruce, I am very sympathetic to what you are saying. I took the course starting last fall and have spent a lot time learning new stuff and converting my old databases to PanX. OMG I had a lot of crashes with some of those converted files in the beginning. I have very little left from the Pan6 versions, in part because there are better tools in PanX to do things, in part because I learned a lot in the course, and in part because some things did not work in PanX, so I had to change them. Just in the last week I concluded that I have done everything I can for the converted databases. Early in the process, Jim had not finished the Text List/Matrices, and originally he thought there would be no View-As-List forms, but that too has been added. (I wondered how I would live without View-as-list forms, but I don’t need them at all.) I have been through several iterations of some tasks and improved them as I learned new stuff. I have also been forced to do various work arounds, but the results have mostly been better than the original approach. So I hope you find, as I did, that it is worth the effort and things are better in PanX than they ever were in Pan 6.

12

I agree that Pan X is the way of the future, but the future will be slower getting here, and not as good, unless people report what does not work.

13

This is not really correct. First of all, the issue of adjusting write permissions to install the serial number isn’t the problem here. That apparently still works fine.

The problem is that the Panorama application isn’t a single file, but a collection of files in a folder. This was never a problem before. Earlier this year there was an exploit that took advantage of a loophole in MacOS, the new Gatekeeper Path Randomization feature is an attempt by Apple to close that loophole. If you follow the links on the page I sent earlier you’ll see that Panorama isn’t the only program encountering problems with this, and it is also not clear that this really closes the loophole either.

http://mjtsai.com/blog/2016/06/16/gatekeeper-path-randomization/

We’re still quite early in the macOS Sierra beta period, so there may be changes in all of this before Sierra ships. My goal with my original post was to give all of you a maximum heads up of the possibility of problems down the line.

14

Curious here. What in the part of what I wrote and was quoted is not ‘really correct’?

I was not implying that the installation was a problem, but the act of opening the root to ‘write’ and then never adjusting it back to read only. I’ve not seen the suggestion to re-adjust the permissions to the Apple preferred ‘read only’ after the Pano install.

Robert Ameeti
(949) 422-6866

15

You can certainly change the permissions back, Panorama won’t care. I didn’t include that in the instructions because most users seem overwhelmed by this as it is. The permissions only need to be changed while you are activating the serial number.

It’s not clear to me why the top directory of the drive is now set to require root permissions for modification. I think this change was made in 10.7 or 10.8, with no comment from Apple as to the reason. There’s really not anything sensitive in there that I am aware of.

But most importantly, the permission change you are talking about has absolutely nothing to do with the problem in installing Panorama on macOS Sierra. Zero. Nada. Zilch. The problem is that macOS Sierra no longer allows an application to reference other files in the same folder. This was never a restriction before, so that is what I wanted to clarify in your post. Because of this, the Panorama Installer can’t access its libraries and wizards (the Panorama Installer is actually a modified copy of Panorama – so in a way, Panorama installs itself), so it doesn’t work.

Panorama isn’t the only program affected by this change, so Apple may be making changes to this before Sierra is released.

16

Is it not possible to put these in an application package? ( so if you double click it, it opens Panorama but if you right click it, is says ‘show package contents’)

cw

17

That is what Panorama X does. But you can’t just move the items into the package – everything has to be recoded to work in a different way.

18

OS X Cocktail just came out with a new release that has a feature to disable Gatekeeper.

We would like to inform you that Cocktail 10.1.1 (Sierra Edition) for users running macOS Sierra (10.12) has been released. Here are the release notes for this version:
Added ability to disable Gatekeeper
Gatekeeper is a feature in macOS designed to help protect your Mac from malware and misbehaving apps downloaded from the Internet. Though most Mac users will want to keep Gatekeeper enabled for security purposes, some advanced users find that Gatekeeper is overly zealous in preventing third party apps from being used in macOS.

The Gatekeeper settings can be found in System Preferences > Security & Privacy > General. Gatekeeper offers two settings of increasing security: “App Store” and “App Store and identified developers”. The first choice limits users to running apps obtained from the App Store only, the second choice allows users to run apps from the App Store as well as from software developers who have registered with Apple and securely sign their applications. By disabling Gatekeeper you can add third “Anywhere” option that allows users to launch applications from any source.

And it works. On Sierra I just downloaded Panorama 6 and ran the installation successfully.