Full Disk Access remains undetected after enabling it in System Settings

[pipashu]

I updated to Burrow 0.8.2 and confirmed that strict code-signature verification now succeeds. However, Full Disk Access is still not recognized.

The macOS TCC log reports:

Failed to match existing code requirement for subject dev.caezium.Burrow

It appears that the existing TCC entry still references the CDHash of an older ad-hoc-signed build. Removing and re-adding the app through System Settings alone did not clear the stale identity.

[pipashu]

tccutil reset SystemPolicyAllFiles dev.caezium.Burrow——It doesn't work either.

[caezium]

maybe MacOS 27 compatibility issues, idk if other people are experiencing this same issue, but for me on two Macs both on MacOS 26.5 and 26.5.1 , this is not happening, even prior to your first issue report

[caezium]

Failed to match existing code requirement / SecStaticCodeCheckValidity -67050 is the ad-hoc signing limitation: an ad-hoc signature has no stable identity, so TCC can't keep a designated requirement across builds, which is why even tccutil reset doesn't stick.

Can you try these in order if you have the time?

• Fully quit Burrow — it's a menu-bar agent, so killall Burrow (closing the window isn't enough; FDA binds at launch).
• tccutil reset SystemPolicyAllFiles dev.caezium.Burrow
• Reboot (tccd caches the old requirement until then).
• Re-add Burrow under Full Disk Access, reopen.
• If it still fails, could you share sw_vers (exact version + build), whether Full Disk Access shows "managed by your organization", and mdfind 'kMDItemCFBundleIdentifier == "dev.caezium.Burrow"' (to rule out a leftover old copy)?

The durable fix is a stable signing identity so the grant persists across updates, I am working on getting this app signed, but would not be that fast/soon.

Thanks for the detailed reports.

[pipashu]

I tried the full sequence you suggested:

1. killall Burrow
2. tccutil reset SystemPolicyAllFiles dev.caezium.Burrow
3. rebooted macOS
4. removed and re-added Burrow under Full Disk Access
5. launched Burrow again

Unfortunately, Full Disk Access is still not detected.

Here is the requested diagnostic information:

ProductName:        macOS
ProductVersion:     27.0
BuildVersion:       26A5368g

Full Disk Access is not shown as “managed by your organization”.

mdfind 'kMDItemCFBundleIdentifier == "dev.caezium.Burrow"'

/Applications/Burrow.app

So there does not appear to be an old duplicate copy of Burrow on the system.

codesign -dv /Applications/Burrow.app 2>&1

Executable=/Applications/Burrow.app/Contents/MacOS/Burrow
Identifier=dev.caezium.Burrow
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20400 size=126251 flags=0x2(adhoc) hashes=3935+7 location=embedded
Signature=adhoc
Info.plist entries=31
TeamIdentifier=not set
Sealed Resources version=2 rules=13 files=15
Internal requirements count=0 size=12

Given that the reset + reboot + re-add sequence did not help, and there is only one Burrow.app on the system, this seems consistent with a macOS 27 / ad-hoc signing / TCC identity issue rather than a stale duplicate-app issue.

[caezium]

damn, ok. ill stop trying to find ways to patch this and get the signing down asap to just fix all this fluff, i dont have the apple dev license yet so ill go do that asap.

and yes, the 26A5368g build is a macOS 27 beta, and 27 requires a stable signed identity for Full Disk Access, so an ad-hoc build can't hold it no matter how you reset.

[caezium]

keeping this open to track when I Developer ID-sign it + notarized build

[cheemskc]

same problem