Error codesigning frameworks on Xcode

DarioA

I'm using the Qt dynamic frameworks (5.13.1) in a macOS targeted project, built w/in Xcode. The Qt frameworks are all of the format:

Qt5SomeFramework.framework
  Headers                      -> Versions/Current/Headers
  Resources                    -> Versions/Current/Resources
  Versions
    5
      Headers
      Resources
      Qt5SomeFramework
      Qt5SomeFramework_debug
    Current                    -> 5
  QtSomeFramework              -> Versions/Current/Qt5SomeFramework
  QtSomeFramework.prl          -> Versions/Current/Qt5SomeFramework.prl
  QtSomeFramework_debug        -> Versions/Current/Qt5SomeFramework_debug
  QtSomeFramework_debug.prl    -> Versions/Current/Qt5SomeFramework_debug.prl

This causes an error when Xcode builds and reaches the codesigning stage. It's specifically looking to codesign something located at QtSomeFramework.framework/Versions/A/QtSomeFramework, which doesn't exist and is failing to build.

I've gone down a rabit hole of:

Renaming the Versions/5 directory to Versions/A and then updating the symlinks in the framework bundle to accordingly
Using otool to list the load paths in the binary/so and install_name_tool to modify them Qt load paths
Removing the *_debug and *.prl files as they interfere with code signing as well

But now I'm seeing that all the other dylibs and bins in the Qt installation are pointing to Versions/5. For instance, plugins/platforms/libqcocoa.dylib also needs to have otool and install_name_tool run on it, as do others. Before continuing down this rabbit hole of updating every single dynamic library and executable in the Qt installation, is there something that I'm missing here? Some googling suggests using macdeployqt, but that's not working either and I can't even get it run before codesigning w/in Xcode.

Any help would be appreciated. Thanks.

SGaist

Hi,

How did you install Qt ?
What version of Xcode are you using ?

DarioA

@sgaist I installed it using the online installer, which downloaded the prebuilt binaries. It installed to $HOME/Qt/5.13.1/clang_64
Xcode Version: 10.2.1 (10E1001)

SGaist

What parameters are you passing to macdeployqt ?

DarioA

@sgaist I call macdeployqt like this:

/Users/dario/Dev/ThirdPartyLibs/Qt/Qt-5.13.1-OSX-dynamic/bin/macdeployqt /Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app ${CODESIGNING_FOLDER_PATH} -codesign="Mac Developer: XXXXXXXXXXXXXXXXXX"

and get the following results:

ERROR: Codesign signing error:
ERROR: "/Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtGui.framework/Versions/5/QtGui: code object is not signed at all\nIn subcomponent: /Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtGui.framework/Versions/5/QtGui_debug\n"
ERROR: Codesign signing error:
ERROR: "/Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtCore.framework/Versions/5/QtCore: code object is not signed at all\nIn subcomponent: /Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtCore.framework/Versions/5/QtCore_debug\n"
ERROR: Codesign signing error:
ERROR: "/Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtWidgets.framework/Versions/5/QtWidgets: code object is not signed at all\nIn subcomponent: /Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtWidgets.framework/Versions/5/QtWidgets_debug\n"
ERROR: Codesign signing error:
ERROR: "/Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtNetwork.framework/Versions/5/QtNetwork: code object is not signed at all\nIn subcomponent: /Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtNetwork.framework/Versions/5/QtNetwork_debug\n"
ERROR: Codesign signing error:
ERROR: "/Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtMultimedia.framework/Versions/5/QtMultimedia: code object is not signed at all\nIn subcomponent: /Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtMultimedia.framework/Versions/5/QtMultimedia_debug\n"
ERROR: Codesign signing error:
ERROR: "/Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/MacOS/MyProject: code object is not signed at all\nIn subcomponent: /Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app/Contents/Frameworks/QtGui.framework\n"
ERROR: codesign verification error:
ERROR: "/Users/dario/Dev/Builds/MyProject/DerivedData/MyProject/Build/Products/Debug/MyProject.app: code object is not signed at all\nIn architecture: x86_64\n"

DarioA

Ah, I got it (I think)! So, Qt's frameworks are dynamic, which means that when you add them to your project in Xcode, Xcode adds them to an "Embed Frameworks" build phase, which copies the framework files into the app bundle at build time and codesigns them. However, macdeployqt seems to want to do that part of the job. So, if I just link with the frameworks but don't add the frameworks to the "Embed Frameworks", then run macdeployqt, the depploy tool will handle that part of the build process, and even code signing.

Does that sound right to you?

DarioA

So, I was able to get this working. I had to:

Make sure the Qt frameworks were getting linked with, but not copied in and signed in the "Embedded Binaries" Xcode section
Add a ShellScriptBuildPhase which calls macdeployqt passing in the .app path and optionally -use-debug-libs if the CONFIGURATION environment variable is DEBUG. Note that I am not code signing here because macdeployqt wants an unambiguous code signing identity (e.g. "Mac Developer: Dario XXXXXXX") but that may change per developer and I don't want to hard code that in to the shell shell script.
I need to add --deep to the project's OTHER_CODE_SIGN_FLAGS to tell Xcode's codesign build step to codesign the Qt frameworks and plugins.

DarioA

Hmmm, looks like the Debug builds are not quite working right. Building is successful but I'm getting a crash on launch. It appears the _debug binaries are pointing to release frameworks and not finding them since only the _debug binaries are in the frameworks. For instance, here is otool -L output run on the QtMultimediaWidgets_debug embedded into the app by macdeployqt:

	@rpath/QtMultimediaWidgets.framework/Versions/5/QtMultimediaWidgets_debug (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtMultimedia.framework/Versions/5/QtMultimedia (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtWidgets.framework/Versions/5/QtWidgets (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtGui.framework/Versions/5/QtGui (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtNetwork.framework/Versions/5/QtNetwork (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtCore.framework/Versions/5/QtCore (compatibility version 5.13.0, current version 5.13.1)
	/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration (compatibility version 1.0.0, current version 1.0.0)
	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
	@rpath/QtOpenGL.framework/Versions/5/QtOpenGL (compatibility version 5.13.0, current version 5.13.1)
	/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL (compatibility version 1.0.0, current version 1.0.0)
	/System/Library/Frameworks/AGL.framework/Versions/A/AGL (compatibility version 1.0.0, current version 1.0.0)
	/usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.4)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.200.5)

That doesn't seem right.

DarioA

@sgaist So, I the prebuilt _debug frameworks that are downloaded using the online installer, are they supposed to be referencing/loading debug or release versions of other libraries? I just freshly redownloaded 5.13.1 for macOS and running otool on one of the _debug binaries shows that they point to the release versions. Is that right?

$ otool -L /Users/dario/Qt/5.13.1/clang_64/lib/QtMultimediaWidgets.framework/Versions/5/QtMultimediaWidgets_debug 
/Users/dario/Qt/5.13.1/clang_64/lib/QtMultimediaWidgets.framework/Versions/5/QtMultimediaWidgets_debug:
	@rpath/QtMultimediaWidgets.framework/Versions/5/QtMultimediaWidgets_debug (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtMultimedia.framework/Versions/5/QtMultimedia (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtWidgets.framework/Versions/5/QtWidgets (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtGui.framework/Versions/5/QtGui (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtNetwork.framework/Versions/5/QtNetwork (compatibility version 5.13.0, current version 5.13.1)
	@rpath/QtCore.framework/Versions/5/QtCore (compatibility version 5.13.0, current version 5.13.1)
	/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration (compatibility version 1.0.0, current version 1.0.0)
	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
	@rpath/QtOpenGL.framework/Versions/5/QtOpenGL (compatibility version 5.13.0, current version 5.13.1)
	/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL (compatibility version 1.0.0, current version 1.0.0)
	/System/Library/Frameworks/AGL.framework/Versions/A/AGL (compatibility version 1.0.0, current version 1.0.0)
	/usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.4)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.200.5)

DarioA

OK, so according to this bug report https://bugreports.qt.io/browse/QTBUG-48800, I need to add the DYLD_IMAGE_SUFFIX=_debug environment variable when running in debug mode. Feels like it would be better for _debug binaries to reference other _debug binaries. If not that, then the need for this environment variable when using -use-debug-libs should be documented.

SGaist

Sorry I misread your first line, I thought you were using Qt Creator to build your project.

I must I'm also surprised but I haven't been in a situation requiring to deploy a debug version of an application.

hpasa

@DarioA I just ran into the same issue. To me it looks like a bug somewhere, possibly in the way that Qt frameworks are setup, that the Version/A is referenced. I'm using XCode 11.1, and I would expect "Embed & Sign" to work for Qt frameworks as well.

Emma55

Same issue here. The only workaround I've found is to use static library instead of framework. dgcustomerfirst

DarioA

@hpasa and @Emma55 see https://forum.qt.io/post/551916 for how I was able to get this to work with dynamic frameworks. This is the post build script I added:

/Path/To/Qt/bin/macdeployqt ${CODESIGNING_FOLDER_PATH}

Which will not link to debug binaries as that still appears to be an open issue.

Definitely feels like using Qt in Xcode is a second class citizen

Kerndog73

I thought macdeployqt was supposed to be a helper for deploying to macOS using Qt Creator. I thought that it was just copying and code signing frameworks but that doesn't seem to be the case. It should be possible to do whatever the tool does in Xcode but I can't figure it out. Just telling Xcode to embed and sign the frameworks isn't enough. To me, this seems like there's something wrong with the way the frameworks are built. Or maybe I just don't understand what macdeployqt does (or is meant to do).

DarioA

@Kerndog73 I agree completely. The frameworks that Qt builds and distributes are non-standard and Xcode just can't deal with them. Modifying them doesn't work either, as you can see from my OP. I think they just need to be built differently. After much trial and error, I gave up and tried macdeployqt and it seemed to do what was necessary. Definitely would like to see Qt move towards using standard frameworks.