macOS Store Crash: Entitlements as Binary Plist instead of Plist

MAS-signed App crashes which results in the apps rejection by Apple.

After a few hours of investigation I figured out that there is an issue with the entitlements of the App. In the Console Application the following message is thrown.

failed to parse entitlements for MyApp[84767]: OSUnserializeXML: syntax error near line 1

I then enabled DEBUG=electron-osx-sign* which allowed me to see that the entitlements of the app were in binary plist format, not in plist format. The entitlements are provided as a valide plist, but codesign somehow “converts” it to the binary format.

In fact the current version available in the AppStore has the entitlements provided as plist, not as binary plist.

Any input on this odd behaviour?

[tinacious]

I found this because I am also experiencing a similar error related to entitlements parsing:

  ⨯ Command failed: codesign --sign XXXX --force --timestamp --entitlements build/entitlements.mas.inherit.plist /path/to/project/dist/mas/MyAppName.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib
Failed to parse entitlements: AMFIUnserializeXML: syntax error near line 6

I was able to find a solution. In case anyone comes across this, I will share what worked for me.

I ran the following scripts on my plist files:

plutil -convert xml1 build/entitlements.mas.plist
plutil -convert xml1 build/entitlements.mas.loginhelper.plist
plutil -convert xml1 build/entitlements.mas.inherit.plist

This modified each of my plist files to change whitespace characters. It looks like spaces have been converted to tabs, so perhaps some kind of auto-formatting ran in my editor to reformat the Plist files incorrectly. Running plutil -convert xml1 on them seems to fix it. Code signing is now passing for me.

Example diff:

diff --git a/build/entitlements.mas.inherit.plist b/build/entitlements.mas.inherit.plist
index 57d0b41..4759d0a 100644
--- a/build/entitlements.mas.inherit.plist
+++ b/build/entitlements.mas.inherit.plist
@@ -1,14 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
-  <dict>
-    <key>com.apple.security.app-sandbox</key>
-    <true />
-    <key>com.apple.security.inherit</key>
-    <true />
-    <key>com.apple.security.cs.allow-jit</key>
-    <true />
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true />
-  </dict>
+<dict>
+       <key>com.apple.security.app-sandbox</key>
+       <true/>
+       <key>com.apple.security.cs.allow-jit</key>
+       <true/>
+       <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+       <true/>
+       <key>com.apple.security.inherit</key>
+       <true/>
+</dict>
 </plist>

[1rach]

I’ve identified that when I open the file entitlements.mac.inherit.plist with vscode, and save it (tested on mac), the bug appears.

Solution ? Maybe there is an option in vscode about formatting the file… I don’t know.

Submit an issue to vscode ?