Missing --deep flag prevents signing of packages that contain other binaries

Adding --deep to the args array in function signApplicationAsync (opts) allows signing of MacOS apps that contain other executables. If this flag is not included the signing fails with the error message “code object is not signed at all”.

[eriedl-kiban]

Yes, that was indeed the problem. Thank you so much for providing this. It might be helpful to add this link to the general documentation of electron-builder for when build MacOS apps. I moved now my executables to Contents/MacOS as they are indeed helper apps and tools.

[sethlu]

Hi @eriedl-kiban, my understanding from the Apple doc (table 3-1 at https://developer.apple.com/library/content/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html, retrieved Jan 19, 2017) is that pretty much all components should be placed at their corresponding locations:

Location	Description
Contents	Top content directory of the bundle
Contents/MacOS	Helper apps and tools
Contents/Frameworks	Frameworks, dylibs
Contents/PlugIns	Plug-ins, both loadable and extensions
Contents/XPCServices	XPC services
Contents/Helpers	Helper apps and tools
Contents/Library/Automator	Automator actions
Contents/Library/Spotlight	Spotlight importers
Contents/Library/LoginItems	Installable login items
Contents/Library/LaunchServices	Privileged helper tools installed by the ServiceManagement framework

And I think placing your files outside the Contents dir’s the reason of causing this issue?

---

Amend: electron-osx-sign currently starts walking from Contents, but may feature file misplacement detection if that may help?