Electron-osx-sign: iTunes: Files Only Readable By The Root User

[mynetx]

After submitting my package to iTunes, I got this message back:

Files Only Readable By The Root User - The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app.

How to fix?

[mynetx]

I tried to check the permissions of the .app package contents before flattening it, and could not find any files with permissions 400, 600 or 700.

[sethlu]

Hi @jublo, thanks for filing this issue! Sorry for that I haven't had time to respond in time. Having not encountered this issue myself, I had found the following online. Hope they help:

I deleted some files that weren't readable by the system, files that showed a white blank icon

From: http://stackoverflow.com/questions/6302948/mac-app-store-error

ERROR ITMS-90255: "The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app."
It was resolved by setting manually the permissions, before signing:
cd YourApp.app/Contents/Resources/app.nw && find . -type f -exec chmod 664 {} \;

From: https://github.com/nwjs/nw.js/issues/3609

As we're utilizing Electron here, would you mind checking if you app uses asar while packaging?

[mynetx]

The issue is caused for the .pkg folder inside the flattened installer. Currently we circumvent it by expanding the installer, fixing the permission on the contained .pkg bundle, then flattening again and re-signing. Of course, this is annoying.

The .pkg bundle inside the flattened installer is 700.

Create flat installer

electron-osx-flat "Clipppy-mas-x64/Clipppy.app"

Expand installer

pkgutil --expand "Clipppy-mas-x64/Clipppy.pkg" "Clipppy-mas-x64/expanded"

Fix file permissions

chmod 755 "Clipppy-mas-x64/expanded/net.jublo.clipppy.pkg"

Replace into system version

sed -i _bakup -E 's/10.8.0/10.12.0/g' "Clipppy-mas-x64/expanded/Distribution"

Flatten the installer again

pkgutil --flatten "Clipppy-mas-x64/expanded" "Clipppy-mas-x64/Clipppy.pkg"

Delete expanded folder

rm -rf "Clipppy-mas-x64/expanded"

Rename to unsigned

mv "Clipppy-mas-x64/Clipppy.pkg" "Clipppy-mas-x64/Clipppy-unsigned.pkg"

Sign the installer package

productsign --sign "3rd Party Mac Developer Installer: Jublo IT Solutions (JX22X77UYU)" "Clipppy-mas-x64/Clipppy-unsigned.pkg" "Clipppy-mas-x64/Clipppy.pkg"

[sethlu]

@jublo wow it seems like an awful amount of additional work; glad to know that these steps get your app working eventually!

Should we recognize this issue as a bug? I'm not sure what really causes the flat package to behave in this way.

[mynetx]

I tried to investigate, but all I found was require('../').flat, so I could not continue to read the source. And yes, it seems to be a bug.

[sethlu]

Sure, we'll look into it further! It would be really appreciated if anyone may offer ways to recreate this issue. 😺

[adamjacob]

@jublo Is this method of expanding, fixing permissions and repackaging still working for you? I'm running into the same issues right now "Files Only Readable By The Root User". I followed your steps above with no success. Just curious if anyone else has found a way to fix this?

[mynetx]

@adamjacob Currently building and taking a look.

[jpgupta]

@jublo any updates on this? Currently experiencing the same issue as @adamjacob after going through the steps above. Tried re-expanding the package and looking at the contained package which is 755, can't actually find any files that aren't readable in the package so maybe something else / application loader playing up?

[jpgupta]

Screenshots:

[sethlu]

@jpgupta I'm not very sure about how to resolve this issue. Have you tested _recursively_ chmod the all access to 755?

[jpgupta]

Hi @sethlu thanks for the suggstion... unfortunately no luck!

Let me know if you have any suggestions / debugging steps beyond this

[jpgupta]

@adamjacob have you managed to find a workaround by any chance?

[jpgupta]

@sethlu @jublo - Fixed!

Everything jublo said about the package is correct, and those instructions are really helpful.

In my case, prior to flattening .app into a .pkg, there was an unreadable directory (my /app directory). I found it by running

$ find . ! -perm -g+r

from the app directory, then did a manual CHMOD to correct it.

Then re-packaged / signed the app, unflattened and corrceted the .pkg bug etc and it works!

For reference, I built the app using ember-electron, and I think the issue might be related to the way I have npm set up... I don't know exactly what's wrong but I find myself having to use sudo a lot to get it to do things, so maybe its generated a root only project directory as a result of that.

[sethlu]

@jpgupta 🎉 thanks for the solution! I don't really know how to reproduce this... Do you by chance know if it's a dependency package that's causing the file permission issue or it's the app?

[jpgupta]

@sethlu np! It's the app directory for me, generated by ember electron:package, output below

[sethlu]

@jpgupta thanks for testing! 🎉 I'll try out ember-electron later today and see what may have caused the issue.

[jpgupta]

@sethlu amazing! Thanks for all your work on this project... its really cool man

[oller]

Just encountering this issue myself, is above still the suggested way to tackle this, or is there a way to prevent this issue occurring in the first place. You'd have thought everyone would be encountering this issue otherwise?

[sethlu]

@oller I guess calling find . ! -perm -g+r then manually chmod the permissions is the way to resolve this issue for now.

[oller]

Thanks @sethlu, I did exactly that after the build phase before the code-signing. Worked a charm! Thank you for the prompt response

[sethlu]

Cool! Let us know if you have other questions 😸