Mac - HP Printing Issues

This seems to be a growing issue today: https://discussions.apple.com/thread/251949085

I would highly suggest you check your ability to network print to a HP driver on your Macs today.

The workaround for now is to reinstall the HP printer with a Generic Postscript Driver

Option two is two AirPrint if your organization allows it. I've gotten the error trying to network print but prints fine on AirPrint.

Seeing the same issues here. Unable to print from 10.15 or 10.14. I'll have to set them up with a generic driver and see how that goes.

Another options appears to be downloading the latest drivers from HP and installing them.

Same issue here.. using HP Driver 5.1 - tried to re-install it today.. and got same failed results.

Another option is replacing the code signature of the process with an adhoc signed one. I used console to determine that ,in my case, the code signatures for hpPostProcesing and hpPreProcessing were invalid. I used the following terminal commands to replace the code signatures of each binary and now users are able to print. I have only tested this on macs with issues on HP printers.

sudo codesign -f -s - /Library/Printers/hp/filter/hpPostProcessing.bundle/Contents/MacOS/hpPostProcessing
sudo codesign -f -s - /Library/Printers/hp/filter/hpPreProcessing.filter/Contents/MacOS/hpPreProcessing

replacing code signature got me further but still failed.. running through Novell iPrint though, i'm assuming this might work if it was directly IP installed

Does anybody seen an advisory Directly from HP regarding this issue. Seems to be a widespread problem.

We found that the code signing cert was revoked for some of the HP software including frameworks at /Library/Printers/hp/Frameworks

Download the HP Easy Admin app. Then download hp-printer-essentials-S-5_15_8_4.

https://support.hp.com/us-en/drivers/selfservice/hp-laserjet-pro-m404-m405-series/19203833/model/19202535 Scroll down to "Basic Drivers" to get easy admin.

Someone on MacAdmins Slack posted that Apple recommended downloading HP Easy Admin. Looks like the suggestion is to download the lasted driver packages for your printer(s) and installing them.

HP Easy Admin

Note: I used the app "What's your sign" to confirm that the signing cert was expired. Very cool app, check it out.

This is the only website so far (that I know of) that explains whats going on about this HP Printing issues.
https://www.theregister.com/2020/10/23/hp_printer_macos/

Here are some further resources:

https://discussions.apple.com/thread/251950478
https://discussions.apple.com/thread/251950462
https://eclecticlight.co/2020/10/23/why-have-my-hp-printers-stopped-working-how-to-check-their-software-signature/
https://appleinsider.com/articles/20/10/23/some-mac-users-being-warned-that-amazon-music-app-and-hp-drivers-are-malware

Apparently Apple is pushing a software update to address this issue?:
https://twitter.com/stuartjash/status/1319765909234352128

Here is the update that fixes the issue
ftp://ftp.hp.com/pub/softlib/software12/HP_Quick_Start/osx/Installations/Essentials/hp-printer-essentials-S-5_14_8_4.pkg
UPDATE: The troublesome signature is no longer showing as revoked today. The old software should work now without any changes

Confirmed the file that @coachwhite22 posted is the same file you get when using HP Easy Admin. Use that link to bypass HP Admin GUI setup
Update: It seems they pulled MRT 1.68 and re-issued MRT 1.67 on 10/24/20

Whewph! Everything working today without making changes on our end. Looks like it's going to be a better week

It appears as though Apple un-revoked the code signing certificate.

https://eclecticlight.co/2020/10/23/why-have-my-hp-printers-stopped-working-how-to-check-their-software-signature/
https://www.theregister.com/2020/10/23/hp_printer_macos/

Been getting hit with this issue all morning. Mr. Macintosh seems to have the most information collected about the issue. #yourock
https://mrmacintosh.com/hp-printer-driver-certificate-issue-driver-will-damage-your-computer/

Actually, would this have affected Macs that had Gatekeeper set to "Allow apps downloaded from: Anywhere"?

When running the following command to look at the HP Utility app
spctl --assess --type install --context context:primary-signature -v /Library/Printers/hp/Utilities/HP Utility.app

For problem machines if they are set to only allow apps downloaded from the "App Store" or "App Store and Identified developers" then you will get the following back:

/Library/Printers/hp/Utilities/HP Utility.app: rejected Source=Unnotarized Developer ID

If you run this command on a machine set to "Allow apps downloaded from: Anywhere"
You will get the following back:

/Library/Printers/hp/Utilities/HP Utility.app: accepted override=security disabled

We are getting hit fairly hard with this problem. My solution:

1 Download the hp-printer-essentials-S-5_15_8_4 package (from HP FTP or the HP Easy Admin app).
2 Create a script to remove /Library/Printers/hp directory.
3 Create a new policy:
Payload 1: Run the script to remove HP dir first.
Payload 2: Install new hp-printer-essentials-S-5_15_8_4 pkg second.
4 Run policy once on all Macs at next check-in time OR via a custom trigger for a case-by-case basis: (Example: sudo jamf policy -event remediate-hp)

So far so good here.

Thanks, HP!