Electron-osx-sign: codesign command fails by unrecognized option `--strict'

[KazuyaHayashi]

Hi!
I failed application signing by [email protected] due to unrecognized option --strict.
codesign supports --strict option from Mac OS X 10.11 El Capitan.
But, I'm using MacOS X 10.10.5 Yosemite.
Does electron-osx-sign close Yosemite support since merging the following pull request?
https://github.com/electron-userland/electron-osx-sign/pull/91/files

• a part of output

Sign failed:
Exit code: 2. Command failed: codesign --verify --deep --strict --verbose=2 pack/osx/my-darwin-x64/my.app
codesign: unrecognized option `--strict'
Usage: codesign -s identity [-fv*] [-o flags] [-r reqs] [-i ident] path ... # sign
       codesign -v [-v*] [-R testreq] path|[+]pid ... # verify
       codesign -d [options] path ... # display contents
       codesign -h pid ... # display hosting paths

[sethlu]

Hi @KazuyaHayashi thanks for reporting this issue! I didn't see the incompatibility #91 could bring forward; I will have a think about a solution soon as --strict starting El Capitan proved very useful when detecting small issues usually caught by Gatekeeper only, which is not available for mas.

[McPo]

If strict simply fails faster, I don't think it would be unreasonable to simply exclude it your < El Capitan.

Currently running into this issue myself.

[sethlu]

@McPo I think the issue from this thread is that --strict is recommended whenever it may be applied to codesign. In earlier versions of codesign, this option is not made available; so error is raised about this unrecognized strict option. Gatekeeper enforces strict mode when checking codesign I think.

[aaronfalloon]

This has also caught me out. I've had to freeze the electron-builder and electron-osx-sign-tf versions in my app's package.json. Is it possible to sniff OS version and call codesign without the --strict option as @McPo has suggested?

[sethlu]

@aaronfalloon Sorry for the inconvenience. I'm currently trying to find a way to sniff the OS version so electron-osx-sign could apply --strict flag where applicable.

[Eugeny]

It's require('os').release().

El Capitan is "15.0.0". See https://en.wikipedia.org/wiki/Darwin_(operating_system) for others.

[sethlu]

110 merged. Before a next release is published, the patch may be tested from installing the latest module: npm install -g github:electron-userland/electron-osx-sign.

Thanks to @KazuyaHayashi @McPo @aaronfalloon @Eugeny for your contributing in this issue!