Sparkle: App Notarize cannot be done because "Hardened Runtime" is disabled in Autoupdate.app

Created on 16 Apr 2019 · 18Comments · Source: sparkle-project/Sparkle

In macOS 10.14.5 Apple will introduce Application Notarization - all apps will have to be notarized by Apple.

We've been trying to notarize our application (we are using latest Sparkle version) but while trying to send binary to the notary service we're getting an error:

2019-04-16 09:41:03 +0000 Distribution items ineligible: Error Domain=IDEDistributionMethodDeveloperIDErrorDomain Code=1 "Hardened Runtime is not enabled." UserInfo={NSLocalizedDescription=Hardened Runtime is not enabled., NSLocalizedRecoverySuggestion="Autoupdate.app" and "fileop" must be rebuilt with support for the Hardened Runtime. Enable the Hardened Runtime capability in the project editor, then test your app, rebuild your archive, and upload again.}

I've been trying to enable it on my custom build but without success. If it will start working for me I'll create PR with the fix. Before that, any help with this issue would be very helpful.

Source

sp3esu

👍9

Most helpful comment

@praveen27Kmr If it helps, here's my Run Script Phase (after embedding the framework!) from my apps.

For the XPC branch

Adjust path as necessary:

# 👇 Shorthand for the script; adjust to where you checked-out Sparkle into is 👇
alias dosign="${PROJECT_DIR}/Extern/Sparkle/bin/codesign_embedded_executable"

# Code Signing identity
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
    # If a code signing identity is not specified, use ad hoc signing
    IDENTITY="-"
fi

# Shorthand for the Sparkle.framework
SPARKLE_PATH=${BUILT_PRODUCTS_DIR}/${FRAMEWORKS_FOLDER_PATH}/Sparkle.framework

dosign "$IDENTITY" "${BUILT_PRODUCTS_DIR}/${XPCSERVICES_FOLDER_PATH}"/*.xpc
dosign "$IDENTITY" "${SPARKLE_PATH}/Versions/A/Resources/Autoupdate"
dosign "$IDENTITY" "${SPARKLE_PATH}/Versions/A/Resources/Updater.app/"
dosign "$IDENTITY" "${SPARKLE_PATH}"

For regular release/master branch

Will work on embedded frameworks inside the .app bundle, so no need to adjust anything:

LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"

# By default, use the configured code signing identity for the project/target
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
  # If a code signing identity is not specified, use ad hoc signing
  IDENTITY="-"
fi
codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A"

DivineDominion on 3 Jul 2019

🎉4 👍3

All 18 comments

This has been reported before: #1266

kornelski on 16 Apr 2019

FYI, these are the commands I have added to my Podfile to automatically sign the auto-updater with the hardened runtime whenever I run pod install:

post_install do |installer|
    # Sign the Sparkle helper binaries to pass App Notarization.
    system("codesign --force -o runtime -s 'Developer ID Application' Pods/Sparkle/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate")
    system("codesign --force -o runtime -s 'Developer ID Application' Pods/Sparkle/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop")
end

You should be able to extract the codesign commands for your local build.

MrMage on 30 Apr 2019

🎉3 👍3 ❤1

Too much customization. I want to be able to use the classic copy step in build phases and sign on copy option. All of the solutions that are described currently looks like a workaround.

Moreover, it should be mentioned in the troubleshooting section in a readme file.

sp3esu on 9 May 2019

👍1

The problem is the hardened runtime flags are added as part of the signing process. Xcode can sign as part of the copy build phase, but it won't add the hardened runtime flags.

Perhaps Autoupdate.app could come signed with a dummy self-signed identity, and then the flags would (maybe?) be preserved when Xcode resigns it with the developer's certificate in the copy phase. That's just an hypothesis though.

michelf on 9 May 2019

👀1

For those developers who does not use pod, add a 'run script' on Xcode 'Build Phases' tab, contents:

codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate
codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop

Then, drag this script up to top of your phases, (below 'Target Dependecies' maybe).

R0uter on 26 May 2019

👍3

Hi ,

I am trying Notarize application With Xcode ,but unable to do with sparkle 1.18.1 version , I have Already Added Code in My "Script Phase"

"
LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"

By default, use the configured code signing identity for the project/target

IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then

If a code signing identity is not specified, use ad hoc signing

IDENTITY="-"
fi
codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A"

But I am Getting the Error

its happened After Successfully Uploaded for notarization And When Get back the response after processing is Display a Message "Distribution failed"

Log is there:-

"logFormatVersion": 1,
"jobId": "482f8cbc-5447-4e81-afce-22a",
"status": "Invalid",
"statusSummary": "Archive contains critical validation errors",
"statusCode": 4000,
"archiveFilename": "MYAPPNAME.zip",
"uploadDate": "2019-05-29T07:51:21Z",
"sha256": "ad76875608d6f1e9775d4e017bf684081a69fdb76ec",
"ticketContents": null,
"issues": [
{
"severity": "error",
"code": null,
"path": "MYAPPNAME.zip/MYAPPNAME.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
"message": "The contents of the bundle at MYAPPNAME.zip/MYAPPNAME.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate could not be extracted.",
"docUrl": null,
"architecture": null
}
]

I have also checked Sparkle in content of Application is Also Signed , What can I do that I can able to Do Noterize My Application with current sparkle

praveen27Kmr on 29 May 2019

@kornelski Plz Reply If you have any solution, anybody any idea to resolve my error

praveen27Kmr on 3 Jun 2019

@praveen27Kmr I think your question is a better candidate for StackOverflow than the Sparkle dev team.

DivineDominion on 22 Jun 2019

Please try the latest prerelease https://github.com/sparkle-project/Sparkle/releases

kornelski on 29 Jun 2019

@kornelski , thanks for your answer ,
My issue resolve after couple of days on last week , It was issue from Apple side also, now they resolved the issue, they was delayed to me because of WWDC
for my Issue :-
"
*/Autoupdate could not be extracted.",
"

the issue is not showing more now from apple side.
When is used to code sign as

codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"

For Now when I see your reply then

@kornelski i try the prerelease version, but I am facing the same , I am trying to build without the flag '-o runtime ' i am using "Framework" from pre-release Assets

URL Framework: -

https://github.com/sparkle-project/Sparkle/releases/download/1.22.0rc1/Sparkle-1.22.0rc1.tar.bz2

Error:-

https://user-images.githubusercontent.com/21966068/60410779-77baeb00-9be7-11e9-927d-0b577ed03813.png

now I want just ask you to that I required to use ' -o runtime ' flag or I can use use framework without this flag

praveen27Kmr on 1 Jul 2019

Yes, you still have to do code signing, and I presume that requires -o runtime.

kornelski on 3 Jul 2019

👍1

@praveen27Kmr If it helps, here's my Run Script Phase (after embedding the framework!) from my apps.

For the XPC branch

Adjust path as necessary:

# 👇 Shorthand for the script; adjust to where you checked-out Sparkle into is 👇
alias dosign="${PROJECT_DIR}/Extern/Sparkle/bin/codesign_embedded_executable"

# Code Signing identity
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
    # If a code signing identity is not specified, use ad hoc signing
    IDENTITY="-"
fi

# Shorthand for the Sparkle.framework
SPARKLE_PATH=${BUILT_PRODUCTS_DIR}/${FRAMEWORKS_FOLDER_PATH}/Sparkle.framework

dosign "$IDENTITY" "${BUILT_PRODUCTS_DIR}/${XPCSERVICES_FOLDER_PATH}"/*.xpc
dosign "$IDENTITY" "${SPARKLE_PATH}/Versions/A/Resources/Autoupdate"
dosign "$IDENTITY" "${SPARKLE_PATH}/Versions/A/Resources/Updater.app/"
dosign "$IDENTITY" "${SPARKLE_PATH}"

For regular release/master branch

Will work on embedded frameworks inside the .app bundle, so no need to adjust anything:

LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"

# By default, use the configured code signing identity for the project/target
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
  # If a code signing identity is not specified, use ad hoc signing
  IDENTITY="-"
fi
codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A"

DivineDominion on 3 Jul 2019

🎉4 👍3

@kornelski @DivineDominion Thanks

praveen27Kmr on 3 Jul 2019

The diff from the latest release 1.22.0 to the prerelease 1.22.0rc1 mentioned above shows that ENABLED_HARDENED_RUNTIME was only set in version 1.22.0 and not the 1.22.0rc1.

So for anyone still experiencing this issue on the prerelease version that does not want to resign the framework in a Run Script phase, just update to 1.22.0

vastopa on 24 Sep 2019

The diff from the latest release 1.22.0 to the prerelease 1.22.0rc1 mentioned above shows that ENABLED_HARDENED_RUNTIME was only set in version 1.22.0 and not the 1.22.0rc1.

So for anyone still experiencing this issue on the prerelease version that does not want to resign the framework in a Run Script phase, just update to 1.22.0

Is it now safe to say Hardened Runtime is now supported in 1.22.0 without having to do any manual code signing?

gregcotten on 8 Oct 2019

@gregcotten yes

vastopa on 8 Oct 2019

codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate
codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop

FTR I had been --deep signing the AutoUpdate.app before - but after I upgraded to macOS 10.15 I needed to sign executables individually. No idea why exactly or whether it was just some coincidence, just posting because it could be useful to someone else as well.

dschmidt on 11 Feb 2020

Facing issue with notarising Sparkle embedded framework.
I get error for sparkle binary
The signature of the binary is invalid.

These four binaries

/MyApp.app/Contents/MacOS/MyApp
/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle
/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle
/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Sparkle

Im fairly certain all the above issues are occurring because of embedded Sparkle framework.

This is present in my runscript phase
/usr/bin/codesign --force -o runtime -s "Developer ID ApplicationXXXX" Libraries/Sparkle/Sparkle.framework/Versions/A/Sparkle
/usr/bin/codesign --force -o runtime -s "Developer ID ApplicationXXXX" Libraries/Sparkle/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop
/usr/bin/codesign --force -o runtime -s "Developer ID ApplicationXXXX" Libraries/Sparkle/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate

codesign -vvv --deep --strict /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle
/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle: a sealed resource is missing or invalid
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/Sparkle.strings
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/SUAutomaticUpdateAlert.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/SUUpdateAlert.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/SUUpdatePermissionPrompt.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/Sparkle.strings
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/SUAutomaticUpdateAlert.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/SUUpdatePermissionPrompt.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/SUUpdateAlert.nib
file missing: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj
file missing: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj

Kindly assist me, its been bugging me since a week :D