Electron-notarize problem not signing all binaries

user_1540687 0
Viewed 2105

I'm having strange problems with electron notarization. I followed the tutorial on this page:https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/

It seemed to be pretty thorough so I don't know what I'm missing. Everything runs fine until notarize.js:

require('dotenv').config();
const { notarize } = require('electron-notarize');

exports.default = async function notarizing(context) {
  const { electronPlatformName, appOutDir } = context;  
  if (electronPlatformName !== 'darwin') {
    return;
  }

  const appName = context.packager.appInfo.productFilename;

  return await notarize({
    appBundleId: 'com.oriolgomez.beatstar',
    appPath: `${appOutDir}/${appName}.app`,
    appleId: process.env.APPLEID,
    appleIdPassword: process.env.APPLEIDPASS,
  });
};

The notarization log looks like this: { "logFormatVersion": 1, "jobId": "de0d8e6d-2f5b-4937-b2eb-124b0e831281", "status": "Invalid", "statusSummary": "Archive contains critical validation errors", "statusCode": 4000, "archiveFilename": "beatstar.zip", "uploadDate": "2020-10-02T08:02:04Z", "sha256": "e85e189e57f04af30f21e2040580830167a7f704ea6ab70b8f315e3cc9cb6a80", "ticketContents": null, "issues": [ { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/MacOS/beatstar", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/beatstar Helper (GPU).app/Contents/MacOS/beatstar Helper (GPU)", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libEGL.dylib", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libvk_swiftshader.dylib", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libGLESv2.dylib", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libGLESv2.dylib", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Helpers/chrome_crashpad_handler", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/beatstar Helper.app/Contents/MacOS/beatstar Helper", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/beatstar Helper (Plugin).app/Contents/MacOS/beatstar Helper (Plugin)", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" }, { "severity": "error", "code": null, "path": "beatstar.zip/beatstar.app/Contents/Frameworks/beatstar Helper (Renderer).app/Contents/MacOS/beatstar Helper (Renderer)", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": null, "architecture": "x86_64" } ] }

electron
1 Answers

I don't know if the reason I ran into this is the same as yours, but here's what I discovered, in case this helps anyone else.

Before manually notarizing your app (using electron-notarize), make sure the certificate type you're signing your app with is correct. You specifically need a Developer ID Application certificate (the last one):

Apple Developer certificate type selection

I had been using Apple Distribution before, and notarization failed because of it. The list of files you're seeing are probably the first few files Apple checked, and they were signed with an incorrect type of certificate (don't quote me on this), and so it failed.

Either way, once I generated an Developer ID Application certificate, defined my entitlements this way:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
  </dict>
</plist>

and used this config in the build section of my package.json:

    "mac": {
      "category": "public.app-category.developer-tools",
      "icon": "assets/icon.png",
      "hardenedRuntime": true,
      "gatekeeperAssess": false,
      "entitlements": "assets/mac/entitlements.plist",
      "entitlementsInherit": "assets/mac/entitlements.plist"
    },
    "afterSign": "./scripts/notarizeApp.js",

I was able to get notarization to work.

This is what my notarizeApp script looks like, FWIW:

const path = require('path')
var notarize = require('electron-notarize')

module.exports = async function (params) {
  // Notarization only applies to macOS
  if (process.platform !== 'darwin') {
    return
  }

  let appId = '<your-app-id>'
  let appPath = path.join(
    params.appOutDir,
    `${params.packager.appInfo.productFilename}.app`
  )

  try {
    console.log(`  • Notarizing`)
    await notarize.notarize({
      appBundleId: appId,
      appPath: appPath,
      appleId: process.env.APPLE_ID_EMAIL,
      appleIdPassword: process.env.APPLE_ID_PASSWORD,
    })
  } catch (error) {
    console.error(error)
  }
}

This app was very useful to check if notarization was successful (Taccy): https://eclecticlight.co/taccy-signet-precize-alifix-utiutility-alisma/

user_17087060
Related