Invalid Signature and signed app isn't running correctly
See original GitHub issueSorry in advance if I overlooked something obvious. I’ve tried to make this work for some hours now, and I’m out of ideas.
I developed a Mac app using electron and everything works as expected after packaging with electron-packager. Now I want to submit the app to the mac app store.
After packaging I’m signing the app using electron-osx-sign --identity="xyz" name.app
and then I’m flattening it with electron-osx-flat --identity="xyz" name.app
(it doesn’t work without me specifying the identity, although this is the first app that I’m signing) and submit the created .pkg file to Application Loader.
The first problem is that the signed .app file doesn’t work correctly anymore. If I try to execute it, the app starts with a window it usually doesn’t have and doesn’t respond at all:
![bildschirmfoto 2016-06-19 um 18 23 28](https://cloud.githubusercontent.com/assets/1564556/16178522/ff546f74-364a-11e6-9253-fbda7d894f5f.png)
I’m not sure if I’m still supposed to be able to execute apps that were signed for the MAS, so maybe this is just expected behaviour? Otherwise this may hint to something going wrong when signing.
The second problem: Application Loader accepts the .pkg file without any errors and uploads it to iTunes, but afterwards I get an email stating this error:
Invalid Signature - This error occurs when you have signed your app’s installer incorrectly. There are two certs required for this process: the “3rd Party Mac Developer Application” cert and the “3rd Party Mac Developer Installer” cert. When signing your package, you need to ensure that you are using the Installer cert to sign your package. Ensure that you are specifying this cert when submitting your app via the Xcode Organizer or when running productbuild from the command line.
I do have those two certs and when signing/flattening several certs were requested, so I’m not sure what’s going wrong. I’m not calling productbuild
myself, electron-osx-flat
is doing that right?
Do you guys have any idea what I might do wrong?
(The xyz
in --identity="xyz"
from above is the string in the parentheses of "3rd Party Mac Developer Installer: myname (xyz)"
.)
Issue Analytics
- State:
- Created 7 years ago
- Comments:46 (23 by maintainers)
Yeah, I just did that and it worked. 😃 Finally! However I wasn’t sure what default entitlements from this repo I should extend, default.entitlements.mas.inherit.plist or default.entitlements.mas.plist?
And after all, there also seems to be a bug in electron-packager, right? The signing is only working when using electron-osx-sign on its own.
I submitted the HN app to the MAS today and everything seemed to work fine. So it looks like the original issue is solved 😃
@sethlu This isn’t regarding electron-osx-sign not working, but I thought I’d ask you since you seem to be very knowledgeable with signing/entitlements. I’ll try on StackOverflow if you don’t have any advice or no time for this. So feel free to ignore this if you don’t want to spend time on it. 😃
My app executes AppleScript, e.g. to copy the currently selected text to the clipboard. Executing AppleScript in node is only possible by using
/usr/bin/osascript
. I’ve spent quite some time trying different entitlements, but I found none that stop this console errors:I guess the problem is also that running
/usr/bin/osascript
spawns a new process that doesn’t have the same entitlements.My entitlements:
The AppleScripts tell “System Events” to do stuff, thus the scripting target.