Sparkle: Issue with notarization

[Sunil-P]

Facing issue with notarising Sparkle embedded framework.
I get error for sparkle binary
The signature of the binary is invalid.

These four binaries

/MyApp.app/Contents/MacOS/MyApp
/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle
/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle
/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Sparkle

Im fairly certain all the above issues are occurring because of embedded Sparkle framework.

Updated RunScript :
This is present in my runscript phase
codesign --verbose --force -o runtime --sign "Developer ID Application: XXXXXXXX" "Pods/Sparkle/Sparkle.framework/Versions/A/Resources/AutoUpdate.app/Contents/MacOS/fileop"
codesign --verbose --force -o runtime --sign "Developer ID Application: XXXXXXXX" "Pods/Sparkle/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "Developer ID Application: XXXXXXXX" "Pods/Sparkle/Sparkle.framework"

Contents/Payload/Applications/MyApp.app/Contents/MacOS/MyApp -> The signature of the binary is invalid.
Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle -> The signature of the binary is invalid.
Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle -> The signature of the binary is invalid.
Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Sparkle -> The signature of the binary is invalid.

I tried running on each of the above binaries like this
codesign -vvv --deep --strict MyApp.app/Contents/MacOS/MyApp
codesign -vvv --deep --strict MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle
codesign -vvv --deep --strictMyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle
codesign -vvv --deep --strict MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Sparkle

I get the following response each time
valid on disk
satisfies its Designated Requirement

How do I debug this ?

[lwouis]

I ran into the AutoUpdate.app issue today, and using the other issues around this topic, I was able to successfully notarize my app by adding a build phase at the end with the following code:

# codesign --deep is only 1 level deep. It misses Sparkle embedded app AutoUpdate
# this build phase script works around the issue
codesign --verbose --force --sign "$CODE_SIGN_IDENTITY" $OTHER_CODE_SIGN_FLAGS "${PODS_ROOT}/Sparkle/Sparkle.framework/Resources/Autoupdate.app"

Note that my build settings have:

OTHER_CODE_SIGN_FLAGS = --timestamp --deep --options runtime

[Sunil-P]

Hi, can you share your full run phase scripts to handle signing of Sparkle

[lwouis]

Yes of course! I'm working on an open-source app called alt-tab-macos, so I can share the full project with you. The full setup is on that branch.

I customized nothing in the Pods folder. I worked hard to make the setup portable to you only need to run:

• git clone
• pod install
• xcodebuild -workspace alt-tab-macos.xcworkspace -scheme Release

[Sunil-P]

codesign --verbose --force --timestamp --deep -o runtime --sign "Developer ID Application: XXXXXXX" "Pods/Sparkle/Sparkle.framework/Resources/Autoupdate.app"

I only have this now in my build phases similar to how you have in your codesign_sparkle_embedded_apps.sh

Now I am getting a bunch of errors in notarisation,

{
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/MacOS/MyApp",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The executable requests the com.apple.security.get-task-allow entitlement.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The executable requests the com.apple.security.get-task-allow entitlement.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The executable requests the com.apple.security.get-task-allow entitlement.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The executable requests the com.apple.security.get-task-allow entitlement.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Sparkle",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/Autoupdate.app/Contents/MacOS/fileop",
      "message": "The executable requests the com.apple.security.get-task-allow entitlement.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyAppInstaller-1.14.627.pkg/component.pkg Contents/Payload/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
      "message": "The executable requests the com.apple.security.get-task-allow entitlement.",
      "docUrl": null,
      "architecture": "x86_64"
    }
  ]
}

[lwouis]

Looks like you are building a .pkg and not an .app like me. A package means you are in a more complex situation with one extra layer of nesting involved. I'm afraid I have no experience with signing packages 😅 I think there are related issues in this repo that could help you.

I think you have to check the cocoapods website/github for info on how it integrates with packages. I see on the official Apple docs that you're supposed to run productsign not codesign. I'm guessing that your cocoapods settings are wrong and that pod install generates the wrong shell scripts for you, which fail to properly sign your package.

[Sunil-P]

Yes, the full signing workflow what I'm trying is :

1. BuildPhases RunScript

codesign --verbose --force -o runtime --sign "Developer ID Application: XXXXXXXX" "Pods/Sparkle/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "Developer ID Application: XXXXXXXX" "Pods/Sparkle/Sparkle.framework"

1. Then MyApp.app gets signed by Xcode using provided Developer ID Application

2. Create ProductBuild into a pkg, then sign it using Productsign using same Developer ID Application.

Upload this pkg to Notarization service. Hope Im not doing anything wrong here.

[glouel]

@Sunil-P, some tips that may help from my own experience.

With Cocoapods, in your build phases, the last one should be the one that Embed Pods Frameworks (it's the same if you go the git submodule way, which I would HIGHLY recommend again from experience, the pods are often outdated).

You then need to add a Run Script after the embed (again, same with the git way, so this will be your last one in both cases). This is the script I use, I don't remember where I got it, apologies to the one who wrote it but it works great :

# Type a script or drag a script file from your workspace to insert its path.
LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"

# By default, use the configured code signing identity for the project/target
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
  # If a code signing identity is not specified, use ad hoc signing
  IDENTITY="-"
fi
codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A"

I would suggest using archive for the .app, and at that point zip it and try notarizing the zip, to make sure at least you get that bit correct. I'm pretty sure you need to use ditto to preserve some attributes or metadata, here's what I use :

/usr/bin/ditto -c -k --keepParent "your.app" "Your.zip"

If that work, then that part is OK and your issue is with the packaging.

Reading your point 3 though, I think this is your issue : "Create ProductBuild into a pkg, then sign it using Productsign using same Developer ID Application." That's not correct, you need to sign with a "Developper ID Installation certificate", it's not the same ! Check the link provided by @lwouis above, it contains some info about it.

[Sunil-P]

I figured it out. You are right @glouel , the code signatures weren't being copied if I used the cp command to do a product build in a different directory.
I used mv command it worked.

Closing this issue.

[vastopa]

@lwouis thanks so much for your script suggestion, it was a life-saver!

I'm not using Pods so I'm not sure of the differences between pods and embedding the framework directly, but I had the issue where the run script phase I added to codesign Sparkle was codesigning the Sparkle.framework in my source bundle after it had already been embedded into the .app bundle which means it wasn't signing the Autoupdate.app from my apps bundle.

I tried signing the Autoupdate.app directly from my apps bundle but then my apps signature was invalid. The solution that worked for me was to make the codesign script a pre-build run phase (aka putting the script before the Compile Sources run phase). This ensured my source Sparkle.framework was signed correctly prior to embedding it in my app output bundle.

I also added a check to ensure the script is only run for the Release configuration and put the OTHER_CODE_SIGN_FLAGS directly in the codesign call in my script as to not affect the original codesign process which had no issues other than for Sparkle.

set -exu

if [ "$CONFIGURATION" != Release ]; then
    echo "Not release configuration, skipping Sparkle codesigning"
    exit 0
fi

codesign --verbose --force --sign "$CODE_SIGN_IDENTITY" --timestamp --deep --options runtime "${SRCROOT}/Sparkle.framework/Resources/Autoupdate.app"

Lastly, I recommend adding the Autoupdate and fileop as Input File dependencies to the runscript to ensure the files are always where they need to be when the script is being run.

[vladborovtsov]

Thanks @lwouis

adding --deep and --timestamp to OTHER_CODE_SIGN_FLAGS solved my issue!