Steamworks.NET.txt breaks Unity Cloud notarization

After adding Steamworks.NET to our project, our Unity Cloud Build setup stopped working for macOS builds. The builds completed successfully but the resulting .app bundle was not properly signed and macOS rejected it with the dreaded:

"MyGame.app" cannot be opened because the developer cannot be verified.

The cause of the problem was the Steamworks.NET.txt file which was not signed by Unity Cloud Build probably because it was added from a [PostProcessBuild] method and it wasn’t picked up by fastlane. We resolved the problem by removing this portion of RedistCopy.cs:

string pluginsDir = Path.Combine(baseDir, "Plugins");

// Create if it doesn't exist yet
Directory.CreateDirectory(pluginsDir);

string[] DebugInfo = {
    "Steamworks.NET created by Riley Labrecque",
    "http://steamworks.github.io",
    "",
    "Steamworks.NET Version: " + Steamworks.Version.SteamworksNETVersion,
    "Steamworks SDK Version: " + Steamworks.Version.SteamworksSDKVersion,
    "Steam API DLL Version:  " + Steamworks.Version.SteamAPIDLLVersion,
    "Steam API DLL Size:     " + Steamworks.Version.SteamAPIDLLSize,
    "Steam API64 DLL Size:   " + Steamworks.Version.SteamAPI64DLLSize,
    ""
};
File.WriteAllLines(Path.Combine(pluginsDir, "Steamworks.NET.txt"), DebugInfo);

After we did that, the app got properly notarized by Unity Cloud Build and the problem was gone.

I strongly recommend that either this code be removed, or redone so that it doesn’t interfere with fastlane. Notarizing macOS apps is already frustrating, so that could at least partially ease the process.

Here is the command that put us on the right track when we tried to find out what was going on:

codesign -vv --deep-verify MyGame.app

returned:

MyGame.app/: code object is not signed at all
In subcomponent: [...]/MyGame.app/Contents/PlugIns/Steamworks.NET.txt

We also used these two commands:

codesign -dvv MyGame.app

spctl -a -vvvvvv MyGame.app

The first one returned the signature details which were correct. The second command only said:

MyGame.app: rejected
source=no usable signature

But it didn’t say what was wrong. codesign -vv --deep-verify MyGame.app did.

[bartlomiej-dawidow]

My suggestion would be to replace the Steamworks.NET.txt file with a basic Debug.Log. That way everyone who wants to look up the versions of the libraries can still do so, but it doesn’t affect the build output / the app bundle.

[rlabrecque]

Thanks for the detailed report!!