“iTunes.app” to accept incoming network connections?

Question

Every time I open iTunes I get the the following warning:

I always click allow but it still pops up.

I set the OS X firewall to allow incoming connections for iTunes.

Any suggestions on how to fix this?

Answer 1

It's probably easiest to reinstall iTunes.

If the firewall does not remember your choice, then the digital signature (Code Signing) of iTunes is broken. By default, the OS X firewall accepts any software that was signed by Apple without even asking you. So: it should not have asked you. And once asked, it should be able to remember, based on the digital signature. A broken signature (for example caused by changing the contents of the iTunes.app package) will prevent all this.

(Did you by any chance manually change the iTunes icon the application somehow? Or did you install some plugins?)

You can validate the signature of your iTunes by copying the first line and paste it in Terminal:

codesign -vvv /Applications/iTunes.app/

/Applications/iTunes.app/: valid on disk
/Applications/iTunes.app/: satisfies its Designated Requirement

(More details at If Mac code signing is tampered with, what might fail?)

Answer 2

If you see

$ codesign -vvv /Applications/iTunes.app/
/Applications/iTunes.app/: a sealed resource is missing or invalid
/Applications/iTunes.app/Contents/Resources/English.lproj/iTunesDJSettings.nib/objects.xib: resource added

just delete the files that say "resource added" and verify against codesign again. Once it validates iTunes.app should not popup any more message.

If you wish to resign the thing yourself you can create a signing identity from http://developer.apple.com/mac/library/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html

However, I don't recommend it for iTunes, though I used it for other apps.

Answer 3

If reinstalling worked then fine, but I just wanted to mention that in my experience if firewall Deny/Allow settings don't seem to stick it's because you're setting them in a non-admin account. I think in that case they then only stick for as long as you're logged in.

Perhaps reinstalling seemed to work because you then started iTunes in an admin account?

Just a thought.

Answer 4

Just wanted to report that I faced a similar problem after updating iTunes with the Apple Updater and the solution suggested here worked. Go into the iTunes package and delete all of the files that this terminal command flags as a "resource added":

$ codesign -vvv /Applications/iTunes.app/

When you rerun the terminal command, it will indicate that iTunes.app now "satisfies its Designated Requirement" and the annoying popup should go away.

Note that I don't have any deep understand of why any of this works. Seems like Apple broke something minor in their last software update and the firewall noticed. For any power-Googlers with little experience in these things, make sure you always backup your files before mucking about with anything like this--for your work, those preferences might be important.

Answer 5

I had this in iTunes 9.0 on Snow Leopard. It went away when I upgraded to 9.0.1. (Probably because of the reinstall, as that worked for you.)

Answer 6

An easier approach if you want to avoid messing with the terminal, modifying packages or resigning apps is as follows:

1) Download the iTunes installer ( http://www.apple.com/itunes/download/ ).

2) Move your current copy of the iTunes app from the Applications folder into the trash (but don't touch your preferences or other iTunes folders).

3) Install a fresh copy of iTunes from the .dmg file you downloaded.

4) Launch the fresh copy and see that everything is in place with no more annoying popups!

It's important to move the old app to the trash before you reinstall iTunes; if not, the offending files in the package do not get removed. Once you've confirmed this worked, go ahead and empty the trash.

Answer 7

Sometimes it's not related to a codesign or signature validation as much as you're simply using Home Sharing in your iTunes which prompts you if you want to allow incoming connections.