Problem with signing Qt apps on Mac OS X 10.9.5 and later

Alexander_I

Dear colleagues,

I have faced the problem with signing my app on Mac OS X 10.9.5, Qt 4.8.6 (LGPL).
I have read about wrong Qt frameworks structure for new Mac OS X "codesign" and absent info.plist files after running macdeployqt: you can look at https://bugreports.qt-project.org/browse/QTBUG-38511 and https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG205 ("Changes in OS X 10.9.5 and Yosemite Developer Preview 5").
To localize the problem, I have created the simple Qt app using QtCore and QtGui, and tried different methods suggested in forums (after running macdeployqt).

The 1st method is to copy info.plist files from Qt location to the Resources folders in s-test.app/Contens/Frameworks/Qt*.framework/ (this folders are empty after macdeployqt); sign dylibs, frameworks, app - each call with --deep option. CODESIGN IS OK, BUT "spctl -a -t exec -vv" REJECTED THE APP ("obsolete resource envelope").

The 2nd method is to move Resources folders from s-test.app/Contents/Frameworks/Qt*.framework/ to
s-test.app/Contents/Frameworks/Qt*.framework/Versions/4/, copy info.plist files from Qt location to these Resources folders, create symlinks "Current", "Resources", "Qt*"; sign dylibs, frameworks, app - each call with --deep option. CODESIGN FAILED WITH MESSAGE "unsealed contents present in the root directory of an embedded framework In subcomponent: /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework"

(Please look at the listing below)

I also tried codesign without --depp - no success.

Could you give me simple instruction - how to fix the problem manually and sign the app to be accepted by OS X 10.9.5 and later? Or we have to wait for an update of Qt 4.8?

METHOD 1 (without fixing Frameworks structure, like in deploy.txt from https://bugreports.qt-project.org/browse/QTBUG-38511)

@

cp /Library/Frameworks/QtCore.framework/Contents/Info.plist s-test.app/Contents/Frameworks/QtCore.framework/Resources/
cp /Library/Frameworks/QtGui.framework/Contents/Info.plist s-test.app/Contents/Frameworks/QtGui.framework/Resources/
find s-test.app/Contents -name .dylib | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
find s-test.app/Contents -name Qt -type f | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" s-test.app

RESULT - CODESIGN IS OK, BUT "spctl -a -t exec -vv" REJECTED THE APP:

... (dylibs OK)
s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/QtCore:
signed Mach-O thin (x86_64) [QtCore]
s-test.app/Contents/Frameworks/QtGui.framework/Versions/4/QtGui:
signed Mach-O thin (x86_64) [QtGui]
s-test.app: signed bundle with Mach-O thin (x86_64) [com.yourcompany.s-test]

$ spctl -a -t exec -vv s-test.app
s-test.app: rejected
source=obsolete resource envelope

$ codesign --verify --deep --verbose=3 s-test.app
--prepared:/Developer/res-plan/bin/s-test.app/Contents/Framework/QtCore.framework
--validated:/Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework
s-test.app: embedded framework contains modified or invalid version
In subcomponent: /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework

METHOD 2 (with fixing Frameworks structure)

mv /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Resources s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/
cp /Library/Frameworks/QtCore.framework/Contents/Info.plist s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/Resources/
ln -s /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/ s-test.app/Contents/Frameworks/QtCore.framework/Versions/Current
ln -s /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Versions/Current/Resources/
s-test.app/Contents/Frameworks/QtCore.framework/Resources
ln -s /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Versions/Current/QtCore
s-test.app/Contents/Frameworks/QtCore.framework/QtCore

... (similar 5 instructions for QtGui)
find s-test.app/Contents -name .dylib | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
find s-test.app/Contents -name Qt -type f | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" s-test.app

RESULT - CODESIGN FAILED :

... (dylibs OK)
s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/QtCore:
signed bundle with Mach-O thin (x86_64) [4]
s-test.app/Contents/Frameworks/QtGui.framework/Versions/4/QtGui:
signed Mach-O thin (x86_64) [QtGui]
s-test.app: unsealed contents present in the root directory of an embedded framework
In subcomponent: /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework
@

Thank you in advance.

TravisK

I am also having this same issue.

I copy .../Qt/5.3/clang_64/lib/Qt*.frameworks/Contents/Info.plist files into the appropriate .../MY.app/Contents/Frameworks/Qt*.frameworks/Resources/ folders

Then proceed to sign all of the frameworks, dylibs and the app itself.

When verifying that it is signed I receive this message:

.../MY.app: embedded framework contains modified or invalid version
In subcomponent: .../MY.app/Contents/Frameworks/QtCore.framework

This seems to be a recent issue as I have followed this process without any problems before.

Any help would be much appreciated! Thanks

SGaist

Hi and welcome to devnet,

There's currently a some problem with Apple's Xcode 6 that brought some changes and new rules as for the layout of frameworks. You can follow the issue on the interest and development mailing list.

sohail

[quote author="SGaist" date="1412281800"]Hi and welcome to devnet,

There's currently a some problem with Apple's Xcode 6 that brought some changes and new rules as for the layout of frameworks. You can follow the issue on the interest and development mailing list.[/quote]

Could you link to the thread? I can't see any messages about it. I just started getting this problem today after updating...

sohail

Fixed the problem using a post-processing script in Python. Check the gist here: https://gist.github.com/kingcheez/6154462d7734e0c0f3a4

TravisK

Thanks sohail! Works perfectly