Electron-builder: Help overcoming two errors building macOS app - Electron doesn't recognize my Apple developer certificate ERROR ITMS-90237 and App sandbox not enabled ERROR ITMS-90296

Created on 8 Apr 2020 · 16Comments · Source: electron-userland/electron-builder

"electron": "3.0.10",
"electron-builder": "21.2.0",

"mac": {
      "category": "public.app-category.productivity",
      "target": [
        "pkg"
      ],
      "identity": "My Company. (4VJSSKP824)",
      "hardenedRuntime": true,
      "gatekeeperAssess": false,
      "entitlements": "dist/entitlements.mac.plist",
      "entitlementsInherit": "dist/entitlements.mac.inherit.plist"
    },

"dist/entitlements.mac.plist"

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
   <key>com.apple.security.cs.allow-jit</key>
       <true/>
       <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
       <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
       <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
       <true/>
  </dict>
</plist>

"dist/entitlements.mac.inherit.plist"

<!--?xml version="1.0" encoding="UTF-8"?-->
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>com.apple.security.app-sandbox</key>
        <true/>
        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
        <true/>
        <key>com.apple.security.cs.allow-jit</key>
        <true/>
        <key>com.apple.security.application-groups</key>
        <array>
            <string>TEAMID_AND_PACKAGE NAME</string>
        </array>
    </dict>
</plist>

I have placed the correct Developer ID certificates.

Have any of you successfully overcome these two problems I am facing to create a build of my electron app for the macOS store? I have included the correct apple certificate and entitlement properties but still electron is not detecting these things in the build process.

Errors:

ERROR ITMS-90237: "The product archive package's signature is invalid. Ensure that it is signed with your "3rd Party Mac Developer Installer" certificate."

ERROR ITMS-90296: "App sandbox not enabled. The following executables must include the "com.apple.security.app-sandbox" entitlement with a Boolean value of true in the entitlements property list

backlog

Source

ahmadwaliesipick

Most helpful comment

Here is my entitlements.mac.plist -
Screenshot 2020-04-13 at 12 22 44 PM

entitlements.mas.plist -
Screenshot 2020-04-13 at 12 22 58 PM

sonamgupta-kiwi on 13 Apr 2020

👍2 ❤1

All 16 comments

@codebytere @sonamgupta-kiwi @amargautam @sangeeth96 @heydon you all have chimed in on similar electron build issues. @ahmadwaliesipick is the expert here and we are back to figuring this out so we can get our angular app compiled and working in the Mac and Windows stores. Do you have any ideas on a fix to the above issue?

kellerchch on 8 Apr 2020

@ahmadwaliesipick @kellerchch

Can you check if build.dmg.sign = false in package.json?

amargautam on 8 Apr 2020

@ahmadwaliesipick @kellerchch

Can you check if build.dmg.sign = false in package.json?
@amargautam
i am creating pkg not dmg or mas

ahmadwaliesipick on 8 Apr 2020

Here's what I've done to get a working MAS pkg: https://github.com/electron/electron-osx-sign/issues/223#issuecomment-611070794

Based on your post, I see that you've set target to pkg. It should be mas instead which will pick up the right certificates.

Also, I suggest you remove setting of custom entitlements.inherit.plist. It should only contain the sandbox and security.inherit keys (unless you know what you're doing).

Lastly, I'd suggest making a mas-dev build as well.

sangeeth96 on 8 Apr 2020

Thanks for replying @sangeeth96
I had tried 'mas' but build failed because if identity issue; ' _skipped macOS application code signing reason=Identity name is specified, but no valid identity with this name in the keychain identity=XYZ. (4VXKRTP824) allIdentities_'.
Even that i have placed all corect identities at KeyChain.

I saw your issue comment link above, you have created build via mas and manually signed using electron-osx-sign. But if we used mas in electron-builder internally it used electron-osx-sign lib to sign the app.