Invalid code signature preventing kernel extension from loading on macOS Sierra

Question

I have an LTO tape drive with a built-in ATTO Thunderlink SH 1068 that relies on an end-of-life(EOL) ATTO SAS/HBA kernel extension, the ATTO ThunderLink SAS HBA Driver 1.25.

Upon upgrading to macOS Sierra, the kernel extension won't load, so the LTO tape drive doesn't show up in the SAS device tree. It was working fine on El Capitan 10.11.6.

It seems that Gatekeeper in Sierra is now blocking this kernel extension.

Running kextutil -t in Terminal as a diagnostic reveals that the code signature is invalid:

MacBook-Pro:~ user$ sudo kextutil -t /Library/Extensions/ATTOThunderLinkSASHBA.kext 
Password:
Diagnostics for /Library/Extensions/ATTOThunderLinkSASHBA.kext:
Code Signing Failure: code signature is invalid
Untrusted kexts are not allowed
ERROR: invalid signature for com.ATTO.driver.ATTOThunderLinkSASHBA, will not load

What do I need to do to safely load the kernel extension so that my LTO tape drive will work again?

Answer 1

It turns out that it is just not viable to run this outdated kernel extension on Sierra.

My solution was just to retain a dedicated El Capitan system so that I could use this particular hardware.

Answer 2

I think I've got this to to work. Further to Jason Conrad's answer above, ATTO seem to have rolled the SH 1068 driver into the SH 2068 package.

Now, why they don't make this clear to anyone without actually downloading the driver and attempting to install, I don't know.

What I do know is that after installing the driver for the SH 2068 (that is signed, so works on Sierra) I can now see my LTO tape library.

Grab the installers from here: https://www.atto.com/downloads/165/

Answer 3

you can turn off System Integrity Check in Sierra by following the instructions on this page: http://osxdaily.com/2015/10/05/disable-rootless-system-integrity-protection-mac-os-x/

Also try and get a newer version of the drivers from Atto's website. For example the Thunderlink NT 1101 is discontinued but the driver, version 2.0.7, for the NT2101 says it supports the 1101 and seems to work.