Electron-osx-sign: Error ITMS-90287 when trying to deploy a MAS app built with electron-builder

[tleunen]

from https://github.com/electron-userland/electron-builder/issues/1023

• Version: Electron Builder 10.8.1

I'm trying to publish a new version of my app on the Mac App Store but I'm having difficulties with Application Loader. When Apple analyses the pkg file created by Electron-Builder, I receive 2 errors:

ERROR ITMS-90287: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'com.apple.developer.team-identifier' in 'com.xyz.xxxyyyzzz.pkg/Payload/xxxyyyzzz.app/Contents/MacOS/xxxyyyzzz'."
ERROR ITMS-90287: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'com.apple.application-identifier' in 'com.xyz.xxxyyyzzz.pkg/Payload/xxxyyyzzz.app/Contents/MacOS/xxxyyyzzz'."

Any reason why? I've a valid and active profisionning profile for the distribution. And I have a build/entitlements.mas.plist file with

<key>com.apple.security.application-groups</key>
<string>123ABC.com.xyz.xxxyyyzzz</string>

When running build -m I don't have any signing warnings/errors. It takes the right certificate. So I wonder what's missing.

The value of application-groups is the same as the one in my provisioning profile under com.apple.application-identifier, and com.apple.developer.team-identifier contains the right 123ABC value.
And when I inspect the plist file in the .app package created by electron-builder, I'm seeing the team id under ElectronTeamID, and the application id under CFBundleIdentifier.

Any help is welcome.
Thanks.

cc @bryan-jowers

[sethlu]

Hi @tleunen thanks for filing this issue! Would you mind setting export DEBUG=electron-osx-sign*, running the signing flow again and posting a copy of the debug log here? I am not sure which certificate is used to sign your app bundle and if the provisioning profile match your signing identity.

[tleunen]

~Log removed~

[sethlu]

@tleunen thanks for the info! From the debug log I didn't find embedding of provisioning profile and that may be one cause of this issue. Or you may have already placed the embedded provisioning profile so electron-osx-sign didn't say much about that. 😕

In case you haven't, would you try to create a provisioning profile for distribution in the Mac App Store and either place that under the current working directory where electron-osx-sign is called and that will be embedded by electron-osx-sign or manually place the provisioning profile, renamed to embedded.provisioningprofile embedded.provisionprofile under the Contents directory of your app bundle before signing?

[tleunen]

Thank you @sethlu. It seems that was the issue.
I didn't have the provisioning profile in my project. I'm using electron-builder and it wasn't clear I had to add the profile in the project.

[sethlu]

@tleunen No worries, but I will recommend having a copy of the provisioning profile while signing the app bundle as it works with team identifier and application group better and adheres to the project standard in Xcode.

Let us know if there be further questions regarding code signing. 😸

[nunziotocci]

Hi, I am trying to sign Postage for the Mac App Store. I was getting the above errors, alongside an immediate crash when running the app (EXC_CRASH, Code Signature Invalid).

I tried putting my provision profile in the directory where I run npm run dist, but it still gives me the same errors, even though the embedded.provisionprofile is in the app bundle.

[sethlu]

Hi @nunziotocci, are you signing your app for development or for distribution (ready to submit to App Loader)?

[nunziotocci]

Distribution.

[nunziotocci]

@sethlu, I fixed it, I had to put my own entitlements file in the build directory in addition to having the provisioning profile in the current directory.

[DuBistKomisch]

Same issue and solution here. Note that it has to be named embedded.provisionprofile, not embedded.provisioningprofile.

[preethamsridhar]

What is the process of debugging the same when you are electron-forge package to package the application and electron-os-sign the .app. I get the same error when I use the application loader.

[realkimmy]

@tleunen same issue. How to solve it?