Kibana fails to start on macOS Catalina

[ba0708]

Kibana version:
7.4.2

Elasticsearch version:
7.4.2

Server OS version:
10.15.1 (19B88)

Original install method (e.g. download page, yum, from source, etc.):
Download page

Describe the bug:
When starting up Kibana 7.4.2 (and almost certainly previous versions, too), the below dialog appears.

Clicking "Cancel" triggers the below stack trace within the terminal and causes Kibana to fail starting up.

log   [14:12:50.064] [fatal][root] Error: dlopen(/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node, 1): no suitable image found.  Did find:
	/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node: code signature in (/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node) not valid for use in process using Library Validation: library load disallowed by system policy
    at Object.Module._extensions..node (internal/modules/cjs/loader.js:718:18)
    at Module.load (internal/modules/cjs/loader.js:599:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:538:12)
    at Function.Module._load (internal/modules/cjs/loader.js:530:3)
    at Module.require (internal/modules/cjs/loader.js:637:17)
    at require (internal/modules/cjs/helpers.js:22:18)
    at Object.<anonymous> (/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/dist/nodegit.js:12:12)
    at Module._compile (internal/modules/cjs/loader.js:689:30)
    at Module._compile (/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/pirates/lib/index.js:99:24)
    at Module._extensions..js (internal/modules/cjs/loader.js:700:10)
    at Object.newLoader [as .js] (/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/pirates/lib/index.js:104:7)
    at Module.load (internal/modules/cjs/loader.js:599:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:538:12)
    at Function.Module._load (internal/modules/cjs/loader.js:530:3)
    at Module.require (internal/modules/cjs/loader.js:637:17)
    at require (internal/modules/cjs/helpers.js:22:18)
  log   [14:12:50.067] [info][plugins-system] Stopping all plugins.
  log   [14:12:50.067] [info][data][plugins] Stopping plugin
  log   [14:12:50.067] [info][plugins][translations] Stopping plugin
  log   [14:12:50.067] [info][plugins][security] Stopping plugin

 FATAL  Error: dlopen(/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node, 1): no suitable image found.  Did find:
	/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node: code signature in (/Users/example/Desktop/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node) not valid for use in process using Library Validation: library load disallowed by system policy

Steps to reproduce:

1. Download & extract tarball for macOS
2. Start up Elasticsearch
3. bin/kibana

Expected behavior:
Kibana starts up correctly.

Any additional context:
It seems like this is related to the new security mechanism in macOS Catalina, which require apps to be signed and notarized. The same was an issue for Elasticsearch (although for different files), but it was fixed in version 7.4.1 (see elastic/elasticsearch#46498 and elastic/elasticsearch#48490).

[elasticmachine]

Pinging @elastic/kibana-operations (Team:Operations)

[khalisaran]

@elasticmachine any updates on above issue ?

[tylersmalley]

We're working to notarize our assets, but we're blocked on some upstream dependencies to do so, like Node.

The issues you linked are for Elasticsearch, not Kibana.

You can either download with cURL (or something that does not apply the com.apple.quarantine attribute). Or, after downloading and before extracting, you can remove the attribute with xattr -d com.apple.quarantine kibana-7.4.2-darwin-x86_64.tar.gz

[Neyadav2]

I have similar issue on my upgraded Catalina mac

$ bin/kibana
log [13:00:34.004] [info][plugins-system] Setting up [4] plugins: [security,data,inspector,translations]
log [13:00:34.022] [info][plugins][security] Setting up plugin
log [13:00:34.026] [warning][config][plugins][security] Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in kibana.yml
log [13:00:34.027] [warning][config][plugins][security] Session cookies will be transmitted over insecure connections. This is not recommended.
log [13:00:34.050] [info][data][plugins] Setting up plugin
log [13:00:34.051] [info][plugins][translations] Setting up plugin
log [13:00:34.054] [info][plugins-system] Starting [3] plugins: [security,data,translations]
log [13:01:03.597] [fatal][root] Error: dlopen(/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node, 1): no suitable image found. Did find:
/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node: code signature in (/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node) not valid for use in process using Library Validation: library load disallowed by system policy
at Object.Module._extensions..node (internal/modules/cjs/loader.js:718:18)
at Module.load (internal/modules/cjs/loader.js:599:32)
at tryModuleLoad (internal/modules/cjs/loader.js:538:12)
at Function.Module._load (internal/modules/cjs/loader.js:530:3)
at Module.require (internal/modules/cjs/loader.js:637:17)
at require (internal/modules/cjs/helpers.js:22:18)
at Object. (/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/dist/nodegit.js:12:12)
at Module._compile (internal/modules/cjs/loader.js:689:30)
at Module._compile (/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/pirates/lib/index.js:99:24)
at Module._extensions..js (internal/modules/cjs/loader.js:700:10)
at Object.newLoader [as .js] (/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/pirates/lib/index.js:104:7)
at Module.load (internal/modules/cjs/loader.js:599:32)
at tryModuleLoad (internal/modules/cjs/loader.js:538:12)
at Function.Module._load (internal/modules/cjs/loader.js:530:3)
at Module.require (internal/modules/cjs/loader.js:637:17)
at require (internal/modules/cjs/helpers.js:22:18)
log [13:01:03.604] [info][plugins-system] Stopping all plugins.
log [13:01:03.605] [info][plugins][translations] Stopping plugin
log [13:01:03.605] [info][data][plugins] Stopping plugin
log [13:01:03.605] [info][plugins][security] Stopping plugin

FATAL Error: dlopen(/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node, 1): no suitable image found. Did find:
/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node: code signature in (/Users/neeraj/Elasticsearch/kibana-7.4.2-darwin-x86_64/node_modules/@elastic/nodegit/build/Release/nodegit.node) not valid for use in process using Library Validation: library load disallowed by system policy

[ba0708]

@Neyadav2 Looks like the exact same error. I was able to fix it temporarily by running the command shared by @tylersmalley (thanks!).

[Neyadav2]

@andy0708 Yes this error is fixed by mentioned command. Thanks @tylersmalley and @andy0708

[pavankomandur]

I am also facing same issue with 7.4.2 version. i did not understand how to remove the attribute with xattr -d com.apple.quarantine kibana-7.4.2-darwin-x86_64.tar.gz, Can u tell exactly what need to do after downloading from elastic search website ?

[tylersmalley]

Closing, as there is a workaround in prior versions and we are notarizing assets as of 7.5.0

[ba0708]

Although the error is different, this still seems to be an issue. I have been experiencing this all the way from version 7.4.x to 7.7.0. I am not 100% sure if this is directly related, as my technical insight into what causes this is non-existent. However, the proposed workaround does solve the issue, so I guess it is related.

[rd67]

Try this: system preferences > security and privacy > developer tools. Edit to allow the terminal to run software that doesn't meet the system security preferences.

[Conky5]

There is documentation here on how to allow the node binary to run https://www.elastic.co/guide/en/kibana/7.7/targz.html#install-darwin64.

Node started providing notarized releases somewhat recently nodejs/node#29216 (comment), so once the newer node is bundled into Kibana hopefully this workaround won't be necessary.