OS X Gatekeeper

Irek

Hello.
I've get issue with gatekeepr after last OS X update (10.11.6) as well as on 10.12.
So gatekeeper do not allow run my app as app from unknown developer.
But
spctl -a -t exec -vv MyAPP.app/
MyAPP.app/: accepted
source=Developer ID
origin=Developer ID Application: My Dev ID

I'm signing app with
codesign --force --verify -vvvv --deep --no-strict --sign "Developer ID Application: My Dev ID" MyAPP.app

codesign -dvvv --deep-verify MyAPP.app/ gives next:

Executable=/Users/Source/MyAPP/Build/1.1.2/MyAPP.app/Contents/MacOS/MyAPP
Identifier=net.my.app
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=199793 flags=0x0(none) hashes=6238+3 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=a3150b0dfec9445021f4cc0122ff5d69719a4f7d
CandidateCDHash sha256=95ff0a6c92c5449c327641dc9f9d6716c5717500
Hash choices=sha1,sha256
CDHash=95ff0a6c92c5449c327641dc9f9d6716c5717500
Signature size=8932
Authority=Developer ID Application: My Dev ID
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=29 july 2016 г., 23:42:13
Info.plist entries=21
TeamIdentifier=93HEPAR883
Sealed Resources version=2 rules=12 files=685
Nested=PlugIns/quick/libdialogsprivateplugin.dylib
Nested=PlugIns/quick/libqtquickcontrolsplugin.dylib
Nested=PlugIns/quick/libqtquick2plugin.dylib
Nested=PlugIns/quick/libqtgraphicaleffectsprivate.dylib
Nested=PlugIns/quick/libqtgraphicaleffectsplugin.dylib
Nested=Frameworks/QtMultimedia.framework
Nested=Frameworks/QtQml.framework
Nested=Frameworks/QtMultimediaWidgets.framework
Nested=PlugIns/mediaservice/libqtmedia_audioengine.dylib
Nested=PlugIns/mediaservice/libqavfmediaplayer.dylib
Nested=PlugIns/quick/libqtquickcontrols2materialstyleplugin.dylib
Nested=Frameworks/QtOpenGL.framework
Nested=PlugIns/quick/libqtquickcontrols2plugin.dylib
Nested=PlugIns/platforms/libqcocoa.dylib
Nested=PlugIns/quick/libwidgetsplugin.dylib
Nested=Frameworks/QtQuick.framework
Nested=PlugIns/quick/libmodelsplugin.dylib
Nested=PlugIns/mediaservice/libqavfcamera.dylib
Nested=PlugIns/bearer/libqgenericbearer.dylib
Nested=PlugIns/quick/libqtqmlstatemachine.dylib
Nested=Frameworks/QtQuickControls2.framework
Nested=PlugIns/quick/libqquicklayoutsplugin.dylib
Nested=PlugIns/quick/libdialogplugin.dylib
Nested=PlugIns/quick/libdeclarative_multimedia.dylib
Nested=PlugIns/imageformats/libqmacjp2.dylib
Nested=PlugIns/audio/libqtaudio_coreaudio.dylib
Nested=PlugIns/imageformats/libqicns.dylib
Nested=Frameworks/QtSql.framework
Nested=PlugIns/quick/libwindowplugin.dylib
Nested=Frameworks/QtNetwork.framework
Nested=PlugIns/imageformats/libqtga.dylib
Nested=Frameworks/QtMultimediaQuick_p.framework
Nested=Frameworks/QtMacExtras.framework
Nested=Frameworks/QtDBus.framework
Nested=PlugIns/quick/libqtquickcontrols2universalstyleplugin.dylib
Nested=PlugIns/quick/libqmlsettingsplugin.dylib
Nested=PlugIns/bearer/libqcorewlanbearer.dylib
Nested=PlugIns/quick/libqmllocalstorageplugin.dylib
Nested=PlugIns/imageformats/libqwbmp.dylib
Nested=PlugIns/printsupport/libcocoaprintersupport.dylib
Nested=PlugIns/imageformats/libqtiff.dylib
Nested=PlugIns/imageformats/libqico.dylib
Nested=Frameworks/QtWidgets.framework
Nested=PlugIns/sqldrivers/libqsqlmysql.dylib
Nested=Frameworks/QtPrintSupport.framework
Nested=Frameworks/QtQuickTemplates2.framework
Nested=PlugIns/quick/libqtquickextrasflatplugin.dylib
Nested=PlugIns/quick/libqmlfolderlistmodelplugin.dylib
Nested=PlugIns/imageformats/libqjpeg.dylib
Nested=Frameworks/Sparkle.framework
Nested=PlugIns/sqldrivers/libqsqlite.dylib
Nested=Frameworks/QtGui.framework
Nested=PlugIns/quick/libqtquicktemplates2plugin.dylib
Nested=PlugIns/imageformats/libqwebp.dylib
Nested=Frameworks/QtCore.framework
Nested=PlugIns/imageformats/libqgif.dylib
Nested=PlugIns/imageformats/libqdds.dylib
Internal requirements count=1 size=180

SGaist

Hi,

I haven't tested it but did you run the latest macdeployqt ? If so, and IIRC, you have a command line switch that allows to get your app bundle signed for you.

Hope it helps

Irek

Hi.
I'm using last macdeployqt to create bundle, then i'm copying sparkle framework with rsync into bundle, them qt frameworks rearrange in accordions to Apple rules and them sign with codesing. Unfortunately macdeployqt cant resolve sparkle framework dependency.

SGaist

What does macdeployqt tell you about Sparkle ? You can use the verbose option to get more information.

Irek

Ok. Now macdeployqt manage Sparkle framework, but it can't sign bundle.
It segfault on
Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_TW.lproj/SUUpdatePermissionPrompt.nib"
Segmentation fault: 11 "${DEPLOY_TOOL}" ${ARGS[@]}, where

DEPLOY_TOOL="${QT_BIN_DIR}/macdeployqt"

ARGS+=("${BUNDLE_DIR}")
ARGS+=('-verbose=3')
ARGS+=("-appstore-compliant")
ARGS+=("-always-overwrite")
ARGS+=("-codesign=94A3D63A1A501FE2730ABBBB63C37C3EB5AAAABF")

SGaist

macdeployqt segfaults ?

Irek

Yes. Macdeployqt segfaults.

SGaist

Can you trigger that segfault with a minimal project ?