Error signing after upgrade of NodeJS

• Version: 22.4.1-22.6.0

• Electron Version: 8.2.5
• Electron Type (current, beta, nightly): current

• Target: Zip,DMG

• OS Version: macOS v10.13.6

Heads up it might be long,

Summary: After upgrade node version from 8.11.1 to 12.16.3, I started getting sign errors, which were ignored with older version of NodeJS (using the same electron-builder version!).

Longer story: I wanted to update electron-builder from version 22.4.1 to 22.6.0, I saw that a new syntax was used in the newer version that didn’t fly welll with the older NodeJS version

a catch without () brackets was throwing syntax error as part of the install-app-deps step

    catch { ....}

So I’ve upgraded the station to node V12.16.3 and started getting sign errors.

I include another app (“Another.app”) in the electron app (“My.app”) both are developed in-house.

Everything was signed and packaged smoothly with Node 8.11.1.

The error I’m getting with the NodeJS 12.16.3 is “code object is not signed at all” error code when signing the electron app

[14:43:10] Starting 'pack'...
  • electron-builder  version=22.6.0 os=17.7.0
  • loaded configuration  file=package.json ("build" field)
  • packaging       platform=darwin arch=x64 electron=8.2.5 appOutDir=/path/to/dist/mac
  • signing         file=/path/to/dist/mac/My App.app identityName=Developer ID Application: My DevID (MyDevCode) identityHash=MY-HASH-CODE provisioningProfile=none
[14:43:38] 'pack' errored after 28 s
[14:43:38] Error: Command failed: codesign --sign MY-HASH-CODE --force --timestamp --options runtime --entitlements build/entitlements.mac.inherit.plist /path/to/dist/mac/My App.app/Contents/Resources/My Other.App
/path/to/dist/mac/My App.app/Contents/Resources/Contents/Resources/My Other.App/Contents/MacOS/another: replacing existing signature
/path/to/dist/mac/My App.app/Contents/Resources/Contents/Resources/My Other.App/Contents/MacOS/another: code object is not signed at all
In subcomponent: /path/to/dist/mac/My App.app/Contents/Resources/My Other.App/Contents/Info.xml

    at ChildProcess.exithandler (child_process.js:303:12)
    at ChildProcess.emit (events.js:310:20)
    at ChildProcess.EventEmitter.emit (domain.js:505:15)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:443:11)
    at Socket.emit (events.js:310:20)
    at Socket.EventEmitter.emit (domain.js:505:15)
    at Pipe.<anonymous> (net.js:672:12)
From previous event:
    at bound (domain.js:426:14)
    at MappingPromiseArray.runBound (domain.js:439:12)
    at processImmediate (internal/timers.js:456:21)
    at process.topLevelDomainCallback (domain.js:137:15)
From previous event:
    at MacPackager.signApp (/path/to/app/node_modules/app-builder-lib/src/macPackager.ts:329:27)
    at MacPackager.doPack (/path/to/app/node_modules/app-builder-lib/src/platformPackager.ts:244:16)
    at MacPackager.pack (/path/to/app/node_modules/app-builder-lib/src/macPackager.ts:130:7)
    at Packager.doBuild (/path/to/app/node_modules/app-builder-lib/src/packager.ts:444:9)
    at executeFinally (/path/to/app/node_modules/builder-util/src/promise.ts:12:14)
    at Packager._build (/path/to/app/node_modules/app-builder-lib/src/packager.ts:373:31)
    at Packager.build (/path/to/app/node_modules/app-builder-lib/src/packager.ts:337:12)
    at executeFinally (/path/to/app/node_modules/builder-util/src/promise.ts:12:14)
    at pack (/path/to/app/tasks/pack.js:68:13)

What I tried:

• Running with DEBUG=electron-builder doesn’t provide more info to the error

• I’ve looked at https://github.com/electron-userland/electron-builder/issues/2125 My apps don’t have special characters, just letters and space

• https://github.com/electron-userland/electron-builder/issues/1546 I could not find how add the --deep programatically

• I made sure that the internal app is not changed(process still working on another machine that has Node 8.11.1 & builder 22.4.1)

• with the Node 12.16.3 it fails also with electron-builder version 22.4.1

I suspect that codesign returns “warning” in the stderr which was ignored on earlier combination of Node & electron-builder, but are not ignored anymore.

To summarise my very long issue - what I am asking is

1. Is it possible to add the --deep to the sign programatically (or as package.json prop for mac)?
2. Is it possible to customise the sign process for mac, the same way we can customise in windows (package.json --> build --> win --> sign)
3. Is it possible to add ignore sign error flag for internal applications ?
4. Is it possible to add an handler to sign errors ? for example if the text is “Object is not signed at all” then ignore…

[pfrazee]

I’ve submitted a fix PR https://github.com/electron-userland/electron-builder/pull/4993/files

I’ve tested this multiple times (I had to apply the patch manually in my node_modules to create a recent release of my Electron project).

[idanwork]

Hi just leaving this here, in case someone runs into the same issue.

The problem was not in the electron-builder but was related to how the internal app is signed before including it in the main electron app.

for detailed info see here https://stackoverflow.com/questions/54149144/cannot-codesign-an-app-with-python-and-node

The main gist of it is, Dont include non-code in the Contents/MacOS folder Dont sign it with --deep, instead do sign the files yourself in the same way as pfrazee wrote the (deeper levels first)

Thanks all!