Electron-osx-sign: App does not launch after sign - macOS 10.14.5 (Code Signature Invalid)

Created on 19 Jul 2019  Â·  41Comments  Â·  Source: electron/electron-osx-sign

Development app does not launch after sign - macOS 10.14.5
It runs fine before signing.

Signing:

DEBUG=electron-osx-sign* electron-osx-sign "dist_electron/mas-dev/AppName.app" --platform=mas --type=development --identity="***@gmail.com (***)" --entitlements="entitlements.mas.plist" --entitlements-inherit="entitlements.mas.inherit.plist" --provisioning-profile="development.provisionprofile" --hardened-runtime                                                                                                                                                              electron-osx-sign [email protected] +0ms
  electron-osx-sign `identity` passed in arguments. +12ms
  electron-osx-sign Executing... security find-identity -v +0ms
  electron-osx-sign Identity: 
 > Name: Mac Developer: ***@gmail.com (***) 
 > Hash: F9E676C025F153B486DECA3F69881B389C905FAC +157ms
  electron-osx-sign Found 1 identity. +0ms
  electron-osx-sign Pre-sign operation enabled for provisioning profile: 
 * Disable by setting `pre-embed-previsioning-profile` to `false`. +1ms
  electron-osx-sign Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`: 
 * Disable by setting `pre-auto-entitlements` to `false`. +0ms
  electron-osx-sign `provisioning-profile` passed in arguments. +0ms
  electron-osx-sign Executing... security cms -D -i development.provisionprofile +1ms
  electron-osx-sign Provisioning profile: 
 > Name: development 
 > Platforms: [ 'darwin', 'mas' ] 
 > Type: development 
 > Path: development.provisionprofile 
 > Message: { AppIDName: 'AppName Desktop Application',
  ApplicationIdentifierPrefix: [ 'xxx' ],
  CreationDate: 2019-07-19T16:37:31.000Z,
  Platform: [ 'OSX' ],
  IsXcodeManaged: false,
  DeveloperCertificates:
   [ <Buffer 30 82 05 8b 30 82 04 73 a0 03 02 01 02 02 08 61 3d dd 51 06 9a 11 6b 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 81 96 31 0b 30 09 06 03 55 04 06 ... 1373 more bytes> ],
  Entitlements:
   { 'com.apple.application-identifier': 'xxx.com.appname.AppName',
     'keychain-access-groups': [ 'xxx.*' ],
     'com.apple.developer.team-identifier': 'xxx' },
  ExpirationDate: 2020-07-18T16:37:31.000Z,
  Name: 'development',
  ProvisionedDevices: [ 'xxx' ],
  TeamIdentifier: [ 'xxx' ],
  TeamName: 'AppName AS',
  TimeToLive: 365,
  UUID: 'xxx',
  Version: 1 } +54ms
  electron-osx-sign Looking for existing provisioning profile... +5ms
  electron-osx-sign Found embedded provisioning profile: 
 * Please manually remove the existing file if not wanted. 
 * Current file at: dist_electron/mas-dev/AppName.app/Contents/embedded.provisionprofile +0ms
  electron-osx-sign Automating entitlement app group... 
 > Info.plist: dist_electron/mas-dev/AppName.app/Contents/Info.plist 
 > Entitlements: entitlements.mas.plist +0ms
  electron-osx-sign `ElectronTeamID` found in `Info.plist`: xxx +5ms
  electron-osx-sign `com.apple.application-identifier` found in entitlements file: xxx.com.appname.AppName +0ms
  electron-osx-sign `com.apple.developer.team-identifier` found in entitlements file: xxx +0ms
  electron-osx-sign `com.apple.security.application-groups` found in entitlements file: xxx.com.appname.AppName +0ms
  electron-osx-sign Entitlements file updated: 
 > Entitlements: /var/folders/zh/7d9c784d5mb2wd4tmmw6jj0m0000gn/T/tmp-entitlements-1c70-0.plist +7ms
  electron-osx-sign Signing application... 
 > Application: dist_electron/mas-dev/AppName.app 
 > Platform: mas 
 > Entitlements: /var/folders/zh/7d9c784d5mb2wd4tmmw6jj0m0000gn/T/tmp-entitlements-1c70-0.plist 
 > Child entitlements: entitlements.mas.inherit.plist 
 > Additional binaries: [] 
 > Identity: { name: 'Mac Developer: ***@gmail.com (***)',
  hash: 'F9E676C025F153B486DECA3F69881B389C905FAC' } +0ms
  electron-osx-sign Walking... dist_electron/mas-dev/AppName.app/Contents +12ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +20ms
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +0ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +3s
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +1ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/Frameworks/Electron Framework.framework +170ms
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/Frameworks/Electron Framework.framework +0ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/Frameworks/AppName Helper.app/Contents/MacOS/AppName Helper +2s
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/Frameworks/AppName Helper.app/Contents/MacOS/AppName Helper +0ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/Frameworks/AppName Helper.app +121ms
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/Frameworks/AppName Helper.app +0ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/Library/LoginItems/AppName Login Helper.app/Contents/MacOS/AppName Login Helper +118ms
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/Library/LoginItems/AppName Login Helper.app/Contents/MacOS/AppName Login Helper +1ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/Library/LoginItems/AppName Login Helper.app +111ms
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/Library/LoginItems/AppName Login Helper.app +0ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app/Contents/MacOS/AppName +114ms
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements entitlements.mas.inherit.plist dist_electron/mas-dev/AppName.app/Contents/MacOS/AppName +1ms
  electron-osx-sign Signing... dist_electron/mas-dev/AppName.app +317ms
  electron-osx-sign Executing... codesign --sign F9E676C025F153B486DECA3F69881B389C905FAC --force --options runtime --entitlements /var/folders/zh/7d9c784d5mb2wd4tmmw6jj0m0000gn/T/tmp-entitlements-1c70-0.plist dist_electron/mas-dev/AppName.app +0ms
  electron-osx-sign Verifying... +295ms
  electron-osx-sign Verifying application bundle with codesign... +1ms
  electron-osx-sign Executing... codesign --verify --deep --strict --verbose=2 dist_electron/mas-dev/AppName.app +0ms
  electron-osx-sign Verified. +896ms
  electron-osx-sign Displaying entitlements... +0ms
  electron-osx-sign Executing... codesign --display --entitlements :- dist_electron/mas-dev/AppName.app +0ms
  electron-osx-sign Entitlements: 
 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.application-identifier</key>
    <string>xxx.com.appname.AppName</string>
    <key>com.apple.developer.team-identifier</key>
    <string>xxx</string>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>xxx.com.appname.AppName</string>
    </array>
    <key>com.apple.security.network.client</key>
    <true/>
  </dict>
</plist> +34ms
  electron-osx-sign Application signed. +1ms
  electron-osx-sign Application signed: dist_electron/mas-dev/AppName.app +0ms
Application signed: dist_electron/mas-dev/AppName.app

entitlements.mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.application-identifier</key>
    <string>XXX.com.appname.AppName</string>
    <key>com.apple.developer.team-identifier</key>
    <string>XXX</string>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>XXX.com.appname.AppName</string>
    </array>
    <key>com.apple.security.network.client</key>
    <true/>
  </dict>
</plist>

entitlements.mas.inherit.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

Crash log:

Process:               AppName [7616]
Path:                  /Users/USER/Documents/*/AppName.app/Contents/MacOS/AppName
Identifier:            com.appname.AppName
Version:               ???
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           AppName [7616]
User ID:               501

Date/Time:             2019-07-19 20:40:41.462 +0200
OS Version:            Mac OS X 10.14.5 (18F132)
Report Version:        12
Anonymous UUID:        xxx-xxx-xxx-xxx-xxx


Time Awake Since Boot: 100000 seconds

System Integrity Protection: enabled

Crashed Thread:        0

Exception Type:        EXC_CRASH (Code Signature Invalid)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    Namespace CODESIGNING, Code 0x1

kernel messages:

VM Regions Near 0 (cr2):
--> 
    __TEXT                 00000001052d8000-0000000105301000 [  164K] r-x/rwx SM=COW  

Thread 0 Crashed:
0                                   0x0000000112688000 _dyld_start + 0

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x0000000000000000  rbx: 0x0000000000000000  rcx: 0x0000000000000000  rdx: 0x0000000000000000
  rdi: 0x0000000000000000  rsi: 0x0000000000000000  rbp: 0x0000000000000000  rsp: 0x00007ffeea927b08
   r8: 0x0000000000000000   r9: 0x0000000000000000  r10: 0x0000000000000000  r11: 0x0000000000000000
  r12: 0x0000000000000000  r13: 0x0000000000000000  r14: 0x0000000000000000  r15: 0x0000000000000000
  rip: 0x0000000112688000  rfl: 0x0000000000000200  cr2: 0x0000000000000000

Logical CPU:     0
Error Code:      0x00000000
Trap Number:     0


Binary Images:
       0x1052d8000 -        0x105300ff7 + (0) <3788637B-0A53-3737-B3B6-C827ABF3E314> 
       0x112687000 -        0x1126f16ef + (655.1.1) <CE635DB2-D47E-3C05-A0A3-6BD982E7E750> 

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 3857626
    thread_create: 0
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=776K resident=0K(0%) swapped_out_or_unallocated=776K(100%)
Writable regions: Total=8404K written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=8404K(100%)

                                VIRTUAL   REGION 
REGION TYPE                        SIZE    COUNT (non-coalesced) 
===========                     =======  ======= 
STACK GUARD                       56.0M        1 
Stack                             8192K        1 
__DATA                             244K        4 
__LINKEDIT                         184K        2 
__TEXT                             592K        2 
shared memory                        8K        2 
===========                     =======  ======= 
TOTAL                             65.0M       12 

Model: Macmini6,2, BootROM 278.0.0.0.0, 4 processors, Intel Core i7, 2,6 GHz, 12 GB, SMC 2.8f1
Graphics: kHW_IntelHD4000Item, Intel HD Graphics 4000, spdisplays_builtin
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x859B, 0x43543130323436344246313630422E433136
Memory Module: BANK 1/DIMM0, 4 GB, DDR3, 1600 MHz, 0x80CE, 0x4D34373142353137334442302D594B302020
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x10E), Broadcom BCM43xx 1.0 (7.21.190.33 AirPortDriverBrcm4360-1325.2)
Bluetooth: Version 6.0.12f1, 3 services, 27 devices, 1 incoming serial ports
Network Service: Wi-Fi, AirPort, en1
Serial ATA Device: APPLE SSD SM256E, 251 GB
USB Device: USB 2.0 Bus
USB Device: Hub
USB Device: Keyboard Hub
USB Device: USB Receiver
USB Device: Apple Keyboard
USB Device: USB 2.0 Bus
USB Device: Hub
USB Device: Hub
USB Device: IR Receiver
USB Device: BRCM20702 Hub
USB Device: Bluetooth USB Host Controller
USB Device: USB 3.0 Bus
USB Device: Hub
USB Device: Hub
USB Device: SHANG CHEN HID
USB Device: Hub
USB Device: Hub
Thunderbolt Bus: Mac mini, Apple Inc., 23.4

All certs and provisioning profile is just created:

Skjermbilde 2019-07-19 kl 20 19 08

When trying to do the same with a plain project, I got another error:
https://github.com/electron/electron-osx-sign/issues/199

But the plain project (electron-quick-start) without manual sign gives the same crash log as this one.

question
Source
picture steffanhalv
👍7 👀4

Most helpful comment

While you are trying with the asar unpack things... I think it may be nice to summarize the discussion above:

  • For distribution inside the Mac App Store

    • App sandbox required

    • No need for notarization (probably just don't bother doing this) -- the app review process will check for the suspicious code, so there's no need to check that manually again

  • For distribution outside the Mac App Store

    • App sandbox not required (probably just don't bother doing this)

    • Notarization required (therefore hardened runtime as a requirement) -- this checks for suspicious code (link to Apple documentation)

    • Since we're in hardened runtime, there are exception entitlements we need to add for Electron, otherwise the app will break upon launch (note: no need to include the app sandbox entitlement entries if you're not making thee app sandboxed)

    • I haven't confirmed this yet... but since we're doing a custom codesigning workflow, we will need to include --timestamp when using codesign (electron-osx-sign --timestamp in the latest release should do this too)

picture sethlu on 26 Oct 2019
👍5

All 41 comments

This worked for me, which I used now temorarily instead of electron-osx-sign, all of these files should be placed in root of project.

Replace AppName, CompanyName (xxx) and /dist_electron/mas/$APP.app with your own.

sign-mas.sh

#!/bin/bash

CURRENT_PATH="$( cd "$(dirname "$0")" ; pwd -P )"

# Name of your app.
APP="AppName"
COMPANY_DEVELOPER_ID="CompanyName (xxx)"
# The path of your app to sign.
APP_PATH="$CURRENT_PATH/dist_electron/mas/$APP.app"
# The path to the location you want to put the signed package.
RESULT_PATH="$CURRENT_PATH/dist_electron/mas/$APP-Publish-Ready.pkg"

# The name of certificates you requested.
APP_KEY="3rd Party Mac Developer Application: $COMPANY_DEVELOPER_ID"
INSTALLER_KEY="3rd Party Mac Developer Installer: $COMPANY_DEVELOPER_ID"
# The path of your plist files.
CHILD_PLIST="$CURRENT_PATH/entitlements.mas.inherit.plist"
PARENT_PLIST="$CURRENT_PATH/entitlements.mas.plist"
LOGINHELPER_PLIST="$CURRENT_PATH/entitlements.mas.loginhelper.plist"

FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libnode.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/Contents/MacOS/$APP Login Helper"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"

productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

entitlements.mas.loginhelper.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
  </dict>
</plist>

entitlements.mas.inherit.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

entitlements.mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>XXX.com.appname.AppName</string>
    </array>
    <key>com.apple.security.network.client</key>
    <true/>
  </dict>
</plist>

Then run sh sign-mas.shto create a valid file for publishment.

steffanhalv picture steffanhalv on 22 Jul 2019
👍3

Same problem on my end, tried manually and with electron-osx-sign:
App crashes after sign, tried different variations with type, re-checked entitlements, nothing:

In my case:
"package-mac": "electron-packager ./app TrayCoinMXLite --overwrite --platform=darwin --arch=x64 --icon=build/icon.icns --prune=true --out=release-builds --app-bundle-id \"traycoinmxlite.net.wilsonmunoz\" --helper-bundle-id \"traycoinmxlite.net.wilsonmunoz\"",

"sign-mac": "electron-osx-sign release-builds/TrayCoinMXLite-darwin-x64/TrayCoinMXLite.app --entitlements=release-builds/parent-entitlement.plist --entitlements-inherit=release-builds/child-entitlement.plist --identity=\"3rd Party Mac Developer Application: Wilson Munoz (DXXXXX)\" --pre-auto-entitlements=true --no-gatekeeper-assess",

Manually gives me also errors.

  • Update: Tried javan's enttilement and still no luck, leaving my repo here
    https://github.com/Wilsonilo/TraycoinMXLite
    package has the scripts to run almost everything, inside /productionbuild can find the entitlements and a bash file to try sign manually, both give me errors.
Wilsonilo picture Wilsonilo on 30 Jul 2019

I also have the exact same issue. My packaging script uses electron-packager, which in turns uses electron-osx-sign (version 0.4.11).

Link to packaging script:
https://github.com/tobias-klein/ezra-project/blob/master/package_mac.sh

tobias-klein picture tobias-klein on 30 Jul 2019

I resolved this issue by adding an allow-unsigned-executable-memory entitlement, as described in: https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/

<dict>
  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
  <true/>
</dict>
javan picture javan on 30 Jul 2019
👍3

@javan That did not work for me

steffanhalv picture steffanhalv on 6 Aug 2019

The steps described in #188 helped me to get this resolved.
Before I was using electron-packager with the electron-osx-sign specific parameters. After enabling the debug output of electron-osx-sign I noticed that the "child entitlements" were not correctly passed to electron-osx-sign by electron-packager. The child entitlements need to be the same as the entitlements!
Then I created an independent script that just signs (independent from electron-packager) using these entitlements.
I created another independent script that does the notarization and voila - now things are working! No crash or blank window anymore on Mojave!

tobias-klein picture tobias-klein on 11 Aug 2019

@tobias-klein were you able to distribute your pkg on App Loader / Apple? I can confirm no crash using this entitlements but i get a rejection because of missing "App sandbox entitlements not enabled"

Wilsonilo picture Wilsonilo on 11 Aug 2019

@Wilsonilo
I'm only using this for distribution outside of the app store (as a dmg). I suppose for the app store you need a different configuration, including the sandbox entitlement?!

tobias-klein picture tobias-klein on 11 Aug 2019

@tobias-klein yeah it's seems like, i will give it another round of checks this week, thanks.

Wilsonilo picture Wilsonilo on 12 Aug 2019

@Wilsonilo I have the same issue - would be rejected by apple with default entitlements

mayqiyue picture mayqiyue on 5 Sep 2019

I'm going to join this club. electron-osx-sign says that the app was signed, and codesign verifies it, but when I try to run the application it crashes and the log message is:

Sep 23 20:28:56 nuttytrifle com.apple.xpc.launchd[1] (com.mycompany.MyApp.21852[475]): Binary is improperly signed.

The crash reporter message has the following:

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (Code Signature Invalid)
Exception Codes:       0x0000000000000032, 0x0000017ecb102040
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    Namespace CODESIGNING, Code 0x2

If I run spctl -a -vv ./dist/mac/MyApp.app
It says:

./dist/mac/MyApp.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: MyCompany Ltd. (ABCD1234567)

My entitlements:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true />
    <key>com.apple.application-identifier</key>
    <string>ABCD1234567.com.mycompany.MyApp</string>
    <key>com.apple.team-identifier</key>
    <string>ABCD1234567</string>
    <key>com.apple.developer.team-identifier</key>
    <string>ABCD1234567</string>
    <key>com.apple.security.application-groups</key>
    <string>ABCD1234567.com.mycompany.MyApp</string>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
  </dict>
</plist>

package.json:

  "build": {
    "appId": "com.mycompany.MyApp",
    "afterSign": "electron/notarize.js",
    "mac": {
      "category": "public.app-category.productivity",
      "icon": "build/icons/icon.icns",
      "hardenedRuntime": true,
      "gatekeeperAssess": false,
      "entitlements": "build/entitlements.mac.plist",
      "entitlementsInherit": "build/entitlements.mac.plist",
      "provisioningProfile": "embedded.provisionprofile"
    },
    "dmg": {
      "sign": false
    },
  },

Debug signing logging:

 • signing         file=dist/mac/MyApp.app identityName=Developer ID Application: mycompany Ltd. (ABCD1234567) identityHash=99CC88B28694AB60B6259D0492040AB3E23A5413 provisioningProfile=embedded.provisionprofile
  electron-osx-sign `identity` passed in arguments. +0ms
  electron-osx-sign Pre-sign operation enabled for provisioning profile: 
 * Disable by setting `pre-embed-provisioning-profile` to `false`. +2ms
  electron-osx-sign Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`: 
 * Disable by setting `pre-auto-entitlements` to `false`. +1ms
  electron-osx-sign `provisioning-profile` passed in arguments. +0ms
  electron-osx-sign Executing... security cms -D -i embedded.provisionprofile +0ms
  • spawning        command=/Users/me/gitrepos/my-app/node_modules/app-builder-bin/mac/app-builder decode-plist -f /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/c4268fc22b00dab5be25354ae494f3b70fa01b40.plist
  • map async       taskCount=1
  • exited          command=app-builder code=0 pid=99392 out=[{"Entitlements":{"com.apple.application-identifier":"ABCD1234567.com.mycompany.MyApp","keychain-access-groups":["ABCD1234567.*"],"com.apple.developer.team-identifier":"ABCD1234567","com.apple.developer.associated-domains":"*"},"AppIDName":"MyApp","ExpirationDate":"2037-09-18T09:17:27Z","TeamIdentifier":["ABCD1234567"],"Version":1,"ApplicationIdentifierPrefix":["ABCD1234567"],"IsXcodeManaged":false,"Name":"Developer Profile","TeamName":"mycompany Ltd.","TimeToLive":6570,"CreationDate":"2019-09-23T09:17:27Z","Platform":["OSX"],"DeveloperCertificates":["MIIFtDCCBJygAwIBAgIINFF7PbxS3wMwDQYJKoZIhvcNAQELBQAweTEtMCsGA1UEAwwkRGV2ZWxvcGVyIElEIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwHhcNMTkwOTIwMDkyMDQxWhcNMjQwOTIwMDkyMDQxWjCBozEaMBgGCgmSJomT8ixkAQEMCk5RTjZWOFQ3REMxRDBCBgNVBAMMO0RldmVsb3BlciBJRCBBcHBsaWNhdGlvbjogQ2FtZXJhRm9yZW5zaWNzIEx0ZC4gKE5RTjZWOFQ3REMpMRMwEQYDVQQLDApOUU42VjhUN0RDMR0wGwYDVQQKDBRDYW1lcmFGb3JlbnNpY3MgTHRkLjELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeK+ldV3Iqa7Zyb0wb5Fony5pk8QDS+1NS540Y58KzwQJYE/yD8SxY9/1a1Xoysm2QX0NbUIG2Pk76Hl56smIG2MfdcWgdi1nr3rCNj7d+4e3KtZOymD6dP3KkYXKDusYcyhVeHJzm6NjfynZxfqKpE/19dJypflHm3+tz+fzBzdnIaIRo/0mFwcpH1sxOwQYG8+d5Cpsl0esqM7a6XLUmCr8lXnlLS1/M82Qr/mJO01kv0bYR5ry3W8THLyqjKvgHuVfgaJX/4kUsJuzSSlnFXoBsI1llawlGUOtFkY9Zu1oUwcqq1rs1H5YA0qPd5n+2TGZFPZqMf7FawOYs1LcTAgMBAAGjggITMIICDzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFFcX7aLP3HyYoRDg/L6HLSzy4xdUMEAGCCsGAQUFBwEBBDQwMjAwBggrBgEFBQcwAYYkaHR0cDovL29jc3AuYXBwbGUuY29tL29jc3AwMy1kZXZpZDA2MIIBHQYDVR0gBIIBFDCCARAwggEMBgkqhkiG92NkBQEwgf4wgcMGCCsGAQUFBwICMIG2DIGzUmVsaWFuY2Ugb24gdGhpcyBjZXJ0aWZpY2F0ZSBieSBhbnkgcGFydHkgYXNzdW1lcyBhY2NlcHRhbmNlIG9mIHRoZSB0aGVuIGFwcGxpY2FibGUgc3RhbmRhcmQgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdXNlLCBjZXJ0aWZpY2F0ZSBwb2xpY3kgYW5kIGNlcnRpZmljYXRpb24gcHJhY3RpY2Ugc3RhdGVtZW50cy4wNgYIKwYBBQUHAgEWKmh0dHA6Ly93d3cuYXBwbGUuY29tL2NlcnRpZmljYXRlYXV0aG9yaXR5LzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUYx67B419GnF68EAvbc/S959uX/EwDgYDVR0PAQH/BAQDAgeAMB8GCiqGSIb3Y2QGASEEEQwPMjAxOTA5MjAwMDAwMDBaMBMGCiqGSIb3Y2QGAQ0BAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAnytABvXDcl9itsFBoPmVG8HOzVOo7ql+eX69wyXN2CU06/+lXEyJ0RMZ8morqNHELESg2MhcT70c878lQwdU7Ps5fgSF8koSnl99en3fpfRO7CcdeiM2dW5WaO1D3ApOUaVuEhfczRZrMlQy/H8VxnVXh7vzwzHFkniu8cztU4TqBnAoyNXgO0VTrqT5l92CExKRoBaF33DeoAHwUJ3GsWZPmukOns9bnjMjE1+U5XhvK36JlX4FVEuPSr1431pG2FCdojHfSJQ5k4uri+Hgvld5s23Yy+1923mwiXBsgIR1mlWzHWiVieaCvJIrFFPVhpe0f4hilH4iV7vJ/Z5+0"],"ProvisionsAllDevices":true,"UUID":"740aeb4b-3169-4a45-9c67-436bf8eeecb7"}]
  electron-osx-sign Provisioning profile: 
 > Name: Developer Profile 
 > Platforms: [ 'darwin' ] 
 > Type: distribution 
 > Path: embedded.provisionprofile 
 > Message: { Entitlements:
   { 'com.apple.application-identifier': 'ABCD1234567.com.mycompany.MyApp',
     'keychain-access-groups': [ 'ABCD1234567.*' ],
     'com.apple.developer.team-identifier': 'ABCD1234567',
     'com.apple.developer.associated-domains': '*' },
  AppIDName: 'MyApp',
  ExpirationDate: '2037-09-18T09:17:27Z',
  TeamIdentifier: [ 'ABCD1234567' ],
  Version: 1,
  ApplicationIdentifierPrefix: [ 'ABCD1234567' ],
  IsXcodeManaged: false,
  Name: 'Developer Profile',
  TeamName: 'mycompany Ltd.',
  TimeToLive: 6570,
  CreationDate: '2019-09-23T09:17:27Z',
  Platform: [ 'OSX' ],
  DeveloperCertificates:
   [ 'MIIFtDCCBJygAwIBAgIINFF7PbxS3wMwDQYJKoZIhvcNAQELBQAweTEtMCsGA1UEAwwkRGV2ZWxvcGVyIElEIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwHhcNMTkwOTIwMDkyMDQxWhcNMjQwOTIwMDkyMDQxWjCBozEaMBgGCgmSJomT8ixkAQEMCk5RTjZWOFQ3REMxRDBCBgNVBAMMO0RldmVsb3BlciBJRCBBcHBsaWNhdGlvbjogQ2FtZXJhRm9yZW5zaWNzIEx0ZC4gKE5RTjZWOFQ3REMpMRMwEQYDVQQLDApOUU42VjhUN0RDMR0wGwYDVQQKDBRDYW1lcmFGb3JlbnNpY3MgTHRkLjELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeK+ldV3Iqa7Zyb0wb5Fony5pk8QDS+1NS540Y58KzwQJYE/yD8SxY9/1a1Xoysm2QX0NbUIG2Pk76Hl56smIG2MfdcWgdi1nr3rCNj7d+4e3KtZOymD6dP3KkYXKDusYcyhVeHJzm6NjfynZxfqKpE/19dJypflHm3+tz+fzBzdnIaIRo/0mFwcpH1sxOwQYG8+d5Cpsl0esqM7a6XLUmCr8lXnlLS1/M82Qr/mJO01kv0bYR5ry3W8THLyqjKvgHuVfgaJX/4kUsJuzSSlnFXoBsI1llawlGUOtFkY9Zu1oUwcqq1rs1H5YA0qPd5n+2TGZFPZqMf7FawOYs1LcTAgMBAAGjggITMIICDzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFFcX7aLP3HyYoRDg/L6HLSzy4xdUMEAGCCsGAQUFBwEBBDQwMjAwBggrBgEFBQcwAYYkaHR0cDovL29jc3AuYXBwbGUuY29tL29jc3AwMy1kZXZpZDA2MIIBHQYDVR0gBIIBFDCCARAwggEMBgkqhkiG92NkBQEwgf4wgcMGCCsGAQUFBwICMIG2DIGzUmVsaWFuY2Ugb24gdGhpcyBjZXJ0aWZpY2F0ZSBieSBhbnkgcGFydHkgYXNzdW1lcyBhY2NlcHRhbmNlIG9mIHRoZSB0aGVuIGFwcGxpY2FibGUgc3RhbmRhcmQgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdXNlLCBjZXJ0aWZpY2F0ZSBwb2xpY3kgYW5kIGNlcnRpZmljYXRpb24gcHJhY3RpY2Ugc3RhdGVtZW50cy4wNgYIKwYBBQUHAgEWKmh0dHA6Ly93d3cuYXBwbGUuY29tL2NlcnRpZmljYXRlYXV0aG9yaXR5LzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUYx67B419GnF68EAvbc/S959uX/EwDgYDVR0PAQH/BAQDAgeAMB8GCiqGSIb3Y2QGASEEEQwPMjAxOTA5MjAwMDAwMDBaMBMGCiqGSIb3Y2QGAQ0BAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAnytABvXDcl9itsFBoPmVG8HOzVOo7ql+eX69wyXN2CU06/+lXEyJ0RMZ8morqNHELESg2MhcT70c878lQwdU7Ps5fgSF8koSnl99en3fpfRO7CcdeiM2dW5WaO1D3ApOUaVuEhfczRZrMlQy/H8VxnVXh7vzwzHFkniu8cztU4TqBnAoyNXgO0VTrqT5l92CExKRoBaF33DeoAHwUJ3GsWZPmukOns9bnjMjE1+U5XhvK36JlX4FVEuPSr1431pG2FCdojHfSJQ5k4uri+Hgvld5s23Yy+1923mwiXBsgIR1mlWzHWiVieaCvJIrFFPVhpe0f4hilH4iV7vJ/Z5+0' ],
  ProvisionsAllDevices: true,
  UUID: '740aeb4b-3169-4a45-9c67-436bf8eeecb7' } +3s
  electron-osx-sign Looking for existing provisioning profile... +4ms
  electron-osx-sign Embedding provisioning profile... +6ms
  electron-osx-sign Copying file... 
 > Source: embedded.provisionprofile 
 > Target: /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/embedded.provisionprofile +0ms
  electron-osx-sign Automating entitlement app group... 
 > Info.plist: /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Info.plist 
 > Entitlements: build/entitlements.mac.plist +1ms
  • spawning        command=/Users/me/gitrepos/my-app/node_modules/app-builder-bin/mac/app-builder decode-plist -f build/entitlements.mac.plist -f /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Info.plist
  • map async       taskCount=2
  • exited          command=app-builder code=0 pid=99393 out=[{"com.apple.application-identifier":"ABCD1234567.com.mycompany.MyApp","com.apple.team-identifier":"ABCD1234567","com.apple.developer.team-identifier":"ABCD1234567","com.apple.security.application-groups":"ABCD1234567.com.mycompany.MyApp","com.apple.security.cs.allow-unsigned-executable-memory":true,"com.apple.security.network.client":true,"com.apple.security.files.user-selected.read-write":true,"com.apple.security.app-sandbox":true},{"CFBundleIconFile":"MyApp.icns","CFBundleIdentifier":"com.mycompany.MyApp","DTXcode":"0941","LSMinimumSystemVersion":"10.10.0","NSAppTransportSecurity":{"NSAllowsLocalNetworking":true,"NSExceptionDomains":{"localhost":{"NSTemporaryExceptionRequiresForwardSecrecy":false,"NSIncludesSubdomains":false,"NSTemporaryExceptionAllowsInsecureHTTPLoads":true,"NSTemporaryExceptionAllowsInsecureHTTPSLoads":false,"NSTemporaryExceptionMinimumTLSVersion":"1.0"},"127.0.0.1":{"NSIncludesSubdomains":false,"NSTemporaryExceptionAllowsInsecureHTTPLoads":true,"NSTemporaryExceptionAllowsInsecureHTTPSLoads":false,"NSTemporaryExceptionMinimumTLSVersion":"1.0","NSTemporaryExceptionRequiresForwardSecrecy":false}},"NSAllowsArbitraryLoads":true},"NSCameraUsageDescription":"This app needs access to the camera","NSHighResolutionCapable":true,"BuildMachineOSBuild":"17D102","NSMicrophoneUsageDescription":"This app needs access to the microphone","NSHumanReadableCopyright":"Copyright © 2019 mycompany","CFBundleDisplayName":"MyApp","CFBundleInfoDictionaryVersion":"6.0","CFBundlePackageType":"APPL","DTSDKBuild":"10.13","DTSDKName":"macosx10.13","DTXcodeBuild":"9F2000","NSSupportsAutomaticGraphicsSwitching":true,"AsarIntegrity":"{\"checksums\":{\"app.asar\":\"j4ra5wt6fzw2SPE5h85MKMM8zEOW71iR7we7Cjtbnj0x3RaGvKvEAjQHUDcx0KLVPUdAtluGPIEsBqkI+hTdEw==\",\"electron.asar\":\"OEdnmHGLrpEwyEdYJAizh2B/3CjoOhwzb6Cn9W/hANU2VZ2AwFGbKWXI8Mzb1+Yv+7ClwNHrnlZ8RyCBqVoqtA==\"}}","CFBundleVersion":"0.1.8","DTCompiler":"com.apple.compilers.llvm.clang.1_0","LSApplicationCategoryType":"public.app-category.productivity","NSMainNibFile":"MainMenu","NSPrincipalClass":"AtomApplication","CFBundleName":"MyApp","CFBundleShortVersionString":"0.1.8","CFBundleExecutable":"MyApp"}]
  electron-osx-sign `ElectronTeamID` not found in `Info.plist`, use parsed from provisioning profile: ABCD1234567 +33ms
  • spawning        command=/Users/me/gitrepos/my-app/node_modules/app-builder-bin/mac/app-builder encode-plist
  • map async       taskCount=1
  • exited          command=app-builder code=0 pid=99394
  electron-osx-sign `Info.plist` updated: 
 > Info.plist: /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Info.plist +28ms
  electron-osx-sign `com.apple.application-identifier` found in entitlements file: ABCD1234567.com.mycompany.MyApp +0ms
  electron-osx-sign `com.apple.developer.team-identifier` found in entitlements file: ABCD1234567 +0ms
  electron-osx-sign `com.apple.security.application-groups` found in entitlements file: ABCD1234567.com.mycompany.MyApp +1ms
  • spawning        command=/Users/me/gitrepos/my-app/node_modules/app-builder-bin/mac/app-builder encode-plist
  • map async       taskCount=1
  • exited          command=app-builder code=0 pid=99395
  electron-osx-sign Entitlements file updated: 
 > Entitlements: /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/tmp-entitlements-1832b-0.plist +26ms
  electron-osx-sign Signing application... 
 > Application: /Users/me/gitrepos/my-app/dist/mac/MyApp.app 
 > Platform: darwin 
 > Entitlements: /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/tmp-entitlements-1832b-0.plist 
 > Child entitlements: build/entitlements.mac.plist 
 > Additional binaries: undefined 
 > Identity: { name:
   'Developer ID Application: mycompany Ltd. (ABCD1234567)',
  hash: '99CC88B28694AB60B6259D0492040AB3E23A5413' } +0ms
  electron-osx-sign Walking... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents +2ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +98ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib +4s
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libGLESv2.dylib +1s
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libGLESv2.dylib +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +1s
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libEGL.dylib +852ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libEGL.dylib +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libGLESv2.dylib +775ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libGLESv2.dylib +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler +1s
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler +1ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework +801ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Electron Framework.framework +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (GPU).app/Contents/MacOS/MyApp Helper (GPU) +3s
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (GPU).app/Contents/MacOS/MyApp Helper (GPU) +1ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (GPU).app +804ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (GPU).app +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Plugin).app/Contents/MacOS/MyApp Helper (Plugin) +827ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Plugin).app/Contents/MacOS/MyApp Helper (Plugin) +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Plugin).app +809ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Plugin).app +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Renderer).app/Contents/MacOS/MyApp Helper (Renderer) +895ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Renderer).app/Contents/MacOS/MyApp Helper (Renderer) +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Renderer).app +949ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper (Renderer).app +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper.app/Contents/MacOS/MyApp Helper +751ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper.app/Contents/MacOS/MyApp Helper +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper.app +752ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/MyApp Helper.app +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle +751ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Mantle.framework +789ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Mantle.framework +1ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa +877ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/ReactiveCocoa.framework +995ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/ReactiveCocoa.framework +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt +922ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel +821ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Squirrel.framework +841ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/Frameworks/Squirrel.framework +1ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/MacOS/MyApp +881ms
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements build/entitlements.mac.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app/Contents/MacOS/MyApp +0ms
  electron-osx-sign Signing... /Users/me/gitrepos/my-app/dist/mac/MyApp.app +3s
  electron-osx-sign Executing... codesign --sign 99CC88B28694AB60B6259D0492040AB3E23A5413 --force --keychain /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/6257d8d505812ac107e3f341879b8e7d5f795b7c20b036c02761d937767e8dcc.keychain --options runtime --entitlements /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/tmp-entitlements-1832b-0.plist /Users/me/gitrepos/my-app/dist/mac/MyApp.app +0ms
  electron-osx-sign Verifying... +2s
  electron-osx-sign Verifying application bundle with codesign... +0ms
  electron-osx-sign Executing... codesign --verify --deep --strict --verbose=2 /Users/me/gitrepos/my-app/dist/mac/MyApp.app +0ms
  electron-osx-sign Verified. +2s
  electron-osx-sign Displaying entitlements... +0ms
  electron-osx-sign Executing... codesign --display --entitlements :- /Users/me/gitrepos/my-app/dist/mac/MyApp.app +0ms
  electron-osx-sign Entitlements: 
 bplist00�

_ com.apple.application-identifier_#com.apple.developer.team-identifier_com.apple.security.app-sandbox_%com.apple.security.application-groups_6com.apple.security.cs.allow-unsigned-executable-memory_1com.apple.security.files.user-selected.read-write_!com.apple.security.network.client_com.apple.team-identifier_,ABCD1234567.com.mycompany.MyAppZABCD1234567                 <b���<X������ +68ms
  electron-osx-sign Application signed. +0ms

I literally have no idea where to go from here.

ndtreviv picture ndtreviv on 23 Sep 2019

@ndtreviv Which version of Electron are you using? I think the end of the output contains some broken entitlements content that's written into the executable?

And I wonder what app-builder is and what it's doing here?

  • spawning        command=/Users/me/gitrepos/my-app/node_modules/app-builder-bin/mac/app-builder encode-plist
  • map async       taskCount=1
  • exited          command=app-builder code=0 pid=99395
sethlu picture sethlu on 24 Sep 2019

The relevant dependencies in my package.json are:

"electron": "^6.0.8",
"electron-builder": "^21.2.0",
"electron-notarize": "^0.1.1",
"electron-osx-sign": "^0.4.13",

From yarn list:

├─ [email protected]
│  ├─ @types/node@^10.12.18
│  ├─ electron-download@^4.1.0
│  └─ extract-zip@^1.0.3

I'm using electron-builder which appears to use app-builder-lib.

As for the entitlements - are you thinking it's corrupt because of the bad printout?

I'm not sure why it's printing out like that. There are no dodgy characters in my actual file. The file that electron-osx-sign writes to /var/folders/xh/gpx8qj1j4lq356vzbtr6fgqr0000gp/T/tmp-entitlements-1832b-0.plist definitely looks like that, however. So is it writing it out incorrectly?

ndtreviv picture ndtreviv on 24 Sep 2019

@ndtreviv Yea I don't think the plist should look this dodgy 🤔 Can you try directly using electron-osx-sign to sign your app bundle and see if gives a different result? Like so:

DEBUG=electron-osx-sign* electron-osx-sign --entitlements=path/to/entitlements --entitlements-inherit=path/to/entitlements --provisioning-profile=path/to/provisioning-profile --hardened-runtime --no-gatekeeper-assess path/to/app

The debug output should have the entitlements at the end (hopefully without the dodgy format?)

@develar Do you by chance know what the app-builder's encode-plist does?

sethlu picture sethlu on 26 Sep 2019

@ndtreviv Yea I don't think the plist should look this dodgy 🤔 Can you try directly using electron-osx-sign to sign your app bundle and see if gives a different result? Like so:

DEBUG=electron-osx-sign* electron-osx-sign --entitlements=path/to/entitlements --entitlements-inherit=path/to/entitlements --provisioning-profile=path/to/provisioning-profile --hardened-runtime --no-gatekeeper-assess path/to/app

The debug output should have the entitlements at the end (hopefully without the dodgy format?)

@develar Do you by chance know what the app-builder's encode-plist does?

It's ok. I've resolved my issue, so this can be ignored.

To resolve it, I did two things:

  1. Went scorched earth on my certificates and provisioning profiles - generated new ones from scratch.
  2. My entitlements.mac.plist was wrong. I split some of the properties out to entitlements.mas.plist (even though I'm not building for mas)

After that it all worked. Next up: Signing for Windows 😰

ndtreviv picture ndtreviv on 26 Sep 2019

@ndtreviv 🤔 Would you ming sharing with us what you have in the entitlements.mac.plist now that resolved the issue? Thanks!

sethlu picture sethlu on 26 Sep 2019

Sure.

entitlements.mac.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
  </dict>
</plist>

entitlements.mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true />
    <key>com.apple.application-identifier</key>
    <string>1234ABCDEF.com.mycompany.MyApp</string>
    <key>com.apple.team-identifier</key>
    <string>1234ABCDEF</string>
    <key>com.apple.developer.team-identifier</key>
    <string>1234ABCDEF</string>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>1234ABCDEF.com.mycompany.MyApp</string>
    </array>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
  </dict>
</plist>
ndtreviv picture ndtreviv on 29 Sep 2019
👍2

@sethlu to answer your question about encode-plist, it would appear the plist dependency was replaced by biplist. I am attempting to get to the bottom of this issue myself, and it would appear it's related to that switch. I doubt it affects this project, as you still use plist, but any insight would be much appreciated.

james-criscuolo picture james-criscuolo on 7 Oct 2019

@james-criscuolo Currently electron-osx-sign uses the plist package to parse & build plist files. If the user specified entitlement files are binary encoded, I guess then it won't be parsed properly for electron-osx-sign & some of the automations for entitlements files could be affected?

sethlu picture sethlu on 8 Oct 2019
👀2

My comment was in regards to your question about electron-builder. Independent of that, I've switched my MAS build over to electron-packager and still cannot get it to work. I can make a DMG build work with electron-builder, and anticipate the same with electron-packager. It appears that adding app-sandbox leads to the issues, which is required for a MAS build.

A lot of solutions have been posted above, but it appears they are all for DMG builds, and nobody has had a MAS build work yet (please let us know if you've got it working).

james-criscuolo picture james-criscuolo on 10 Oct 2019
👀1

Same issue here! Applying the com.apple.security.app-sandbox entitlement is causing immediate crash.

patrickmichalina picture patrickmichalina on 10 Oct 2019
👀1

@patrickmichalina stupid question, I know, but I am a little desperate: Does it work without com.apple.security.app-sandbox?

johannesjo picture johannesjo on 10 Oct 2019

Unless something has changed (I don't believe it has), the app store requires you to have the sandbox entitlement. Without that entitlement, i can get the DMG (non-app store) version running.

james-criscuolo picture james-criscuolo on 10 Oct 2019

@johannesjo yeah I can sign and notarize the build without com.apple.security.app-sandbox. Works fine for distribution outside MAS.

This issue is specifically for MAS. It won't be allowed to be uploaded to the AppStore without that entitlement. I am using electron-builder

patrickmichalina picture patrickmichalina on 10 Oct 2019
👍3

@james-criscuolo @patrickmichalina thank you to very much for the information. I guessed so, but I hang on to every straw I can grab. Don't know how many late nights I put into this :)

johannesjo picture johannesjo on 10 Oct 2019

Just to clear some confusions:

electron-osx-sign injects com.apple.developer.team-identifier by default to the entitlements file to support features such as Handoff, but this entitlement key needs to be whitelisted by a provisioning profile (see https://github.com/electron-userland/electron-builder/issues/897#issuecomment-487414713).

Also, according to a technical note from Apple:

Recently, the com.apple.developer.team-identifier entitlement was added to all new Mac provisioning profiles. This means that, going forward, distribution builds of Mac apps cannot be run directly; they are for submitting to iTunes Connect for app review only.

Ref: https://developer.apple.com/library/archive/qa/qa1884/_index.html

Therefore, the app bundle is expected to crash with the default electron-osx-sign signing behavior for Mac App Store distributions. A way to have electron-osx-sign avoid injecting com.apple.developer.team-identifier is to provide the flag --no-auto-entitlements--some notes for this is also available in https://github.com/electron-userland/electron-builder/issues/897#issuecomment-487414713 (same link as above).

iirc if the app bundle is signed with a development certificate & provided with a development provisioning profile (including the whitelisted device UUID's), the app bundle should launch successfully. electron-osx-sign supports signing with development signing identities & provisioning profiles by providing the --type=development option (default to distribution).

For distributions outside the Mac App Store however, no crash is expected, because that'll eventually be the signed app bundle for notarization & shipped.

sethlu picture sethlu on 10 Oct 2019

Anyone have any luck getting MAS and MAS-DEV builds working? As mentioned, the standalone DMG build works as expected however the MAS and MAS-DEV builds crash immediately on launch with codesign errors. I understand the MAS build would crash(expected) since thats the version used to upload to the app store, however MAS-DEV should not be crashing since that's for testing. We have the correct team ID in our entitlements along with the 6 macs' UID in our dev provision profile. Everything signs and validates fine however it still crashed on launch :(

JohnTendik picture JohnTendik on 24 Oct 2019

@JohnTendik Same issue here - with hardenedRuntime: true, mas-dev is still crashing. It is being signed with the correct certificate as well, which is different than the mas certificate. Without hardenedRuntime, it opens fine.

patrickmichalina picture patrickmichalina on 24 Oct 2019
👀2

The answer for many ended up being over here: https://github.com/electron-userland/electron-builder/issues/4040#issuecomment-543252275

There are a lot of useful comments scattered throughout that thread, but the big "change" to the app store ended up involving having to exclude native dependencies from the ASAR packaging. On top of that , hardenedRuntime does not play nicely with sandbox, so leave it off. Notarization is also unnecessary for the app store, but I've successfully released my app with it (although I may look to remove that).

james-criscuolo picture james-criscuolo on 24 Oct 2019

Awesome guys thank you I'm going to try these suggestions. Also I should note, although the app crashes, we don't get a crash log- none in user logs or system logs. We used to see "binary signed improperly" type error before but now that doesn't even come up. It just crashes regardless. Ill try turning hardened mode off.

--update--
Hardened runtime set to false didnt solve it :(

JohnTendik picture JohnTendik on 24 Oct 2019

I had issues with immediate crashes when I had hardened runtime entitlements, with hardened runtime false. I believe the only necessary change (for the app store) is the asar unpack stuff, so I recommend going back to your last work build, and just adding asarUnpack option with your native modules.

james-criscuolo picture james-criscuolo on 25 Oct 2019
👍1

While you are trying with the asar unpack things... I think it may be nice to summarize the discussion above:

  • For distribution inside the Mac App Store

    • App sandbox required

    • No need for notarization (probably just don't bother doing this) -- the app review process will check for the suspicious code, so there's no need to check that manually again

  • For distribution outside the Mac App Store

    • App sandbox not required (probably just don't bother doing this)

    • Notarization required (therefore hardened runtime as a requirement) -- this checks for suspicious code (link to Apple documentation)

    • Since we're in hardened runtime, there are exception entitlements we need to add for Electron, otherwise the app will break upon launch (note: no need to include the app sandbox entitlement entries if you're not making thee app sandboxed)

    • I haven't confirmed this yet... but since we're doing a custom codesigning workflow, we will need to include --timestamp when using codesign (electron-osx-sign --timestamp in the latest release should do this too)

sethlu picture sethlu on 26 Oct 2019
👍5

I am having the same error with electron-os-x sign and electron-packager

With electron-builder I did work out how to solve all issue to get a valid package to upload in the app store (via transporter) but unfortunately by fixing the issue I made the app not running. If someone is interested in the electron-builder issues I published them here
https://david.dev/electron-cannot-build-mas-on-os-x-mojave

gurugeek picture gurugeek on 26 Oct 2019

Im happy to report we have solved our build problems. All three builds are working as expected now. Our issue was a little bit different than some of you in this thread so I'm including our fix. It was thanks to the investigation of another user that we were able to move past this problem :)

I've included my build configs there if anyone is interested in seeing how we were able to fix our problem.

https://github.com/electron-userland/electron-builder/issues/4040#issuecomment-547134627

Thanks everyone for all your help!

JohnTendik picture JohnTendik on 28 Oct 2019
🎉1

🎉 Glad to hear that you've solved this specific problem!

I'll close this issue for now since there are quite a few different issues discussed here and it's a little hard navigate with scrolling up and down the page...
Feel free to continue the discussion here 😸 If anyone has a different question I'd recommend opening a new issue for convenience of record keeping.

sethlu picture sethlu on 28 Oct 2019

As we still can't get this to work, here is an update for Electron 7.0.1 tweaked version (Which is required for MAS builds at the moment - ref. https://github.com/electron/electron/issues/20027#issuecomment-551913031) for the current workaround we are using.

Replace AppName, CompanyName (xxx) and /dist_electron/mas/$APP.app with your own.

sign-mas.sh

#!/bin/bash

CURRENT_PATH="$( cd "$(dirname "$0")" ; pwd -P )"

# Name of your app.
APP="AppName"
COMPANY_DEVELOPER_ID="CompanyName (xxx)"
# The path of your app to sign.
APP_PATH="$CURRENT_PATH/dist_electron/mas/$APP.app"
# The path to the location you want to put the signed package.
RESULT_PATH="$CURRENT_PATH/dist_electron/mas/$APP-Publish-Ready.pkg"

# The name of certificates you requested.
APP_KEY="3rd Party Mac Developer Application: $COMPANY_DEVELOPER_ID"
INSTALLER_KEY="3rd Party Mac Developer Installer: $COMPANY_DEVELOPER_ID"
# The path of your plist files.
CHILD_PLIST="$CURRENT_PATH/entitlements.mas.inherit.plist"
PARENT_PLIST="$CURRENT_PATH/entitlements.mas.plist"
LOGINHELPER_PLIST="$CURRENT_PATH/entitlements.mas.loginhelper.plist"

FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libGLESv2.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libEGL.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libGLESv2.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/Contents/MacOS/$APP Helper (GPU)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/Contents/MacOS/$APP Helper (Plugin)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/Contents/MacOS/$APP Helper (Renderer)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/Contents/MacOS/$APP Login Helper"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"

productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

entitlements.mas.loginhelper.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
  </dict>
</plist>

entitlements.mas.inherit.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

entitlements.mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>XXX.com.appname.AppName</string>
    </array>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.application-identifier</key>
    <string>XXX.com.appname.AppName</string>
  </dict>
</plist>

Then run sh sign-mas.shto create a valid file for publishment.

steffanhalv picture steffanhalv on 7 Dec 2019
👍2

@steffanhalv I've used the linked tweaked electron version (7.0.1) and tried to build with electron-builder (20.44.0) a MAS version to sign it lateron with the script file you've provided. But I can't really build with target MAS. The App (before signing) always crashes on startup with exception type EXC_BREAKPOINT (SIGTRAP). Any ideas?

michaelmika picture michaelmika on 9 Dec 2019

@michaelmika Check that all executable binaries inside your mas build is included to be signed and is correct relative to the script file. If the script is in root of your project, the mas build should be exactly ./dist_electron/mas/APPNAME.app

CD into ./dist_electron/mas/APPNAME.app/...and look for extra binaries. When all binaries are added and signed, no errors should occur in the terminal and the app should run.

We did just got our app approved for the app store two days ago following this steps.

Ex. We had the same problem until we added this lines in the script:

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/Contents/MacOS/$APP Helper (GPU)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/Contents/MacOS/$APP Helper (Plugin)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/Contents/MacOS/$APP Helper (Renderer)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/"

Also check that entitlements are correct

steffanhalv picture steffanhalv on 9 Dec 2019
👍1

@steffanhalv thanks a lot! Spent several days to figure it out and finally found your solution

geakstr picture geakstr on 21 Dec 2019

@steffanhalv Unfortunately it did not work for me. I now figured out how to sign and publish with this guide from 2020. The crucial information is that it only seems to work with Electron 5.0.13 and 6.1.7 .

michaelmika picture michaelmika on 4 Feb 2020
👀1

Can you please elaborate how to add asarUnpack option exactly? I am encountering the same issue. I code sign with parameters --force -o runtime and got this signature invalid error on launch, if I remove the parameters when codesigning, it launchs successfully. Thanks a lot

I had issues with immediate crashes when I had hardened runtime entitlements, with hardened runtime false. I believe the only necessary change (for the app store) is the asar unpack stuff, so I recommend going back to your last work build, and just adding asarUnpack option with your native modules.

belloyang picture belloyang on 2 Mar 2020
Was this page helpful?
0 / 5 - 0 ratings

Related issues

maczikasz picture maczikasz  Â·  8Comments
nikolajvonholck picture nikolajvonholck  Â·  7Comments
KazuyaHayashi picture KazuyaHayashi  Â·  7Comments
Younghun-Jung picture Younghun-Jung  Â·  5Comments
alex-zhang picture alex-zhang  Â·  9Comments