Electron-osx-sign: Signing different entitlements to app extension

[maczikasz]

Hi, I am using OSX-SIGN through electron builder, but I want to understand if what I am trying to achieve is possible at all.

I have an app, that has an app extension inside its plugins folder. This extension requires different entitlements than the app itself. The extension must be sandboxed while the app must not be.

If I sign the app after I copied the extension into the PlugIns folder then the codesign tool overwrites the original entitlements which are non sandboxed and my extension will get rejected by osx. If I sign my app then move my extension then ofc macs will fail to verify the signature

Is there a way to sign my app and my extension using the different entitlements? I am open to any suggestion :)

Actually my extension is already signed with the proper entitlements file and the same certs as the rest of the application would be, would it be enough just to specify it as an ignore?

[sethlu]

Hi @maczikasz, I would suggest providing the --ignore option for electron-osx-sign while signing the whole app bundle, so the codesign tool won't touch any of the ignored files. In this case, your command for signing (with electron-osx-sign) will be something like:

electron-osx-sign "your.app" --ignore="PlugIns" ...

And electron-osx-sign will skip every file containing PlugIns in its path.

---

Side note: I haven't worked with plugins in app bundles myself... but I think it probably is fine to skip those already-signed files with App Sandbox enabled, since you are using the same cert just with some different entitlements.

[develar]

https://github.com/electron-userland/electron-builder/issues/1699

I don't want to expose this low-level option in the electron-builder blindly. Why not just by default ignore PlugIns in the electron-builder? So, users will not worry about it at all.

[maczikasz]

For me that would be perfectly fine ofc but I am not 100% sure that the PlugIns folder is not used for anything else

[sethlu]

@develar Mhm... With that, I think we then should additionally provide an option in electron-builder to embed signed plug-ins into the *.app/Contents/PlugIns directory as part of the building process for macOS?

Not sure if it would be a little bit confusing for some users to sign the embedded plug-ins in advance (sandbox/not) and then to embed them in app bundles for distribution inside/outside the App Store. I haven't experimented with this myself.

---

@maczikasz

[PlugIns] contains loadable bundles that extend the basic features of your application. You use this directory to include code modules that must be loaded into your application’s process space in order to be used. You would not use this directory to store standalone executables.

Ref: https://developer.apple.com/library/content/documentation/CoreFoundation/Conceptual/CFBundles/BundleTypes/BundleTypes.html#//apple_ref/doc/uid/10000123i-CH101-SW19

[develar]

@sethlu Cool. So, electron-builder will automatically mark PlugIns as ignore.

Not sure if it would be a little bit confusing for some users to sign the embedded plug-ins in advance

I have also no experience. But I think for now it will be ok to do nothing. Maybe, someone want to just put some 3d-party plugin as part of app.

[sethlu]

@develar sounds good. Is there a current way for the user to inject files into the Contents/PlugIns folder?

I'm also updating some part in electron-osx-sign so it does something similar to https://github.com/electron-userland/electron-packager/blob/53e4606388829299d89c344a55e830d73324be93/ignore.js#L56 that can take in an array of ignore options. The proposed changes should be backward-compatible.

Ref: #142

[develar]

Is there a current way for the user to inject files into the Contents/PlugIns folder?

Yes, https://github.com/electron-userland/electron-builder/wiki/Options#Config-extraFiles (and @maczikasz uses it now).

[sethlu]

Closing this issue for now since it's been inactive for quite a while.