Problem with signing Qt apps on Mac OS X 10.9.5 and later



  • Dear colleagues,

    I have faced the problem with signing my app on Mac OS X 10.9.5, Qt 4.8.6 (LGPL).
    I have read about wrong Qt frameworks structure for new Mac OS X "codesign" and absent info.plist files after running macdeployqt: you can look at https://bugreports.qt-project.org/browse/QTBUG-38511 and https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG205 ("Changes in OS X 10.9.5 and Yosemite Developer Preview 5").
    To localize the problem, I have created the simple Qt app using QtCore and QtGui, and tried different methods suggested in forums (after running macdeployqt).

    The 1st method is to copy info.plist files from Qt location to the Resources folders in s-test.app/Contens/Frameworks/Qt*.framework/ (this folders are empty after macdeployqt); sign dylibs, frameworks, app - each call with --deep option. CODESIGN IS OK, BUT "spctl -a -t exec -vv" REJECTED THE APP ("obsolete resource envelope").

    The 2nd method is to move Resources folders from s-test.app/Contents/Frameworks/Qt*.framework/ to
    s-test.app/Contents/Frameworks/Qt*.framework/Versions/4/, copy info.plist files from Qt location to these Resources folders, create symlinks "Current", "Resources", "Qt*"; sign dylibs, frameworks, app - each call with --deep option. CODESIGN FAILED WITH MESSAGE "unsealed contents present in the root directory of an embedded framework In subcomponent: /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework"

    (Please look at the listing below)

    I also tried codesign without --depp - no success.

    Could you give me simple instruction - how to fix the problem manually and sign the app to be accepted by OS X 10.9.5 and later? Or we have to wait for an update of Qt 4.8?

    METHOD 1 (without fixing Frameworks structure, like in deploy.txt from https://bugreports.qt-project.org/browse/QTBUG-38511)

    @

    1. cp /Library/Frameworks/QtCore.framework/Contents/Info.plist s-test.app/Contents/Frameworks/QtCore.framework/Resources/
      cp /Library/Frameworks/QtGui.framework/Contents/Info.plist s-test.app/Contents/Frameworks/QtGui.framework/Resources/

    2. find s-test.app/Contents -name .dylib | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
      find s-test.app/Contents -name Qt
      -type f | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
      codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" s-test.app

    RESULT - CODESIGN IS OK, BUT "spctl -a -t exec -vv" REJECTED THE APP:

    ... (dylibs OK)
    s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/QtCore:
    signed Mach-O thin (x86_64) [QtCore]
    s-test.app/Contents/Frameworks/QtGui.framework/Versions/4/QtGui:
    signed Mach-O thin (x86_64) [QtGui]
    s-test.app: signed bundle with Mach-O thin (x86_64) [com.yourcompany.s-test]

    $ spctl -a -t exec -vv s-test.app
    s-test.app: rejected
    source=obsolete resource envelope

    $ codesign --verify --deep --verbose=3 s-test.app
    --prepared:/Developer/res-plan/bin/s-test.app/Contents/Framework/QtCore.framework
    --validated:/Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework
    s-test.app: embedded framework contains modified or invalid version
    In subcomponent: /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework

    METHOD 2 (with fixing Frameworks structure)

    1. mv /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Resources s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/
      cp /Library/Frameworks/QtCore.framework/Contents/Info.plist s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/Resources/
      ln -s /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/ s-test.app/Contents/Frameworks/QtCore.framework/Versions/Current
      ln -s /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Versions/Current/Resources/
      s-test.app/Contents/Frameworks/QtCore.framework/Resources
      ln -s /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework/Versions/Current/QtCore
      s-test.app/Contents/Frameworks/QtCore.framework/QtCore

      ... (similar 5 instructions for QtGui)

    2. find s-test.app/Contents -name .dylib | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
      find s-test.app/Contents -name Qt
      -type f | xargs -I $ codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" $
      codesign -vvvv --force --verify --deep --verbose --sign "Developer ID Application: Alexander Ilyin" s-test.app

    RESULT - CODESIGN FAILED :

    ... (dylibs OK)
    s-test.app/Contents/Frameworks/QtCore.framework/Versions/4/QtCore:
    signed bundle with Mach-O thin (x86_64) [4]
    s-test.app/Contents/Frameworks/QtGui.framework/Versions/4/QtGui:
    signed Mach-O thin (x86_64) [QtGui]
    s-test.app: unsealed contents present in the root directory of an embedded framework
    In subcomponent: /Developer/res-plan/bin/s-test.app/Contents/Frameworks/QtCore.framework
    @

    Thank you in advance.



  • I am also having this same issue.

    I copy .../Qt/5.3/clang_64/lib/Qt*.frameworks/Contents/Info.plist files into the appropriate .../MY.app/Contents/Frameworks/Qt*.frameworks/Resources/ folders

    Then proceed to sign all of the frameworks, dylibs and the app itself.

    When verifying that it is signed I receive this message:

    .../MY.app: embedded framework contains modified or invalid version
    In subcomponent: .../MY.app/Contents/Frameworks/QtCore.framework

    This seems to be a recent issue as I have followed this process without any problems before.

    Any help would be much appreciated! Thanks


  • Lifetime Qt Champion

    Hi and welcome to devnet,

    There's currently a some problem with Apple's Xcode 6 that brought some changes and new rules as for the layout of frameworks. You can follow the issue on the interest and development mailing list.



  • [quote author="SGaist" date="1412281800"]Hi and welcome to devnet,

    There's currently a some problem with Apple's Xcode 6 that brought some changes and new rules as for the layout of frameworks. You can follow the issue on the interest and development mailing list.[/quote]

    Could you link to the thread? I can't see any messages about it. I just started getting this problem today after updating...



  • Fixed the problem using a post-processing script in Python. Check the gist here: https://gist.github.com/kingcheez/6154462d7734e0c0f3a4



  • Thanks sohail! Works perfectly


Log in to reply
 

Looks like your connection to Qt Forum was lost, please wait while we try to reconnect.