Invalid Signature - The nested app bundle Electron Framework #436

jechazelle · 2016-05-24T20:30:25Z

Hi,

I try to sign my app with electron builder, with my package.json :

{
  "scripts": {
    "start": "electron ./app --enable-logging",
    "dev": "NODE_ENV='development' npm run start",
    "dist": "npm run dist:osx",
    "dist:osx": "build --platform darwin"
  },
  "devDependencies": {
    "gulp": "~3.9.0",
    "gulp-concat": "~2.6.0",
    "gulp-rename": "~1.2.0",
    "gulp-uglify": "~1.5.0",
    "gulp-sass": "~2.3.1",
    "gulp-sourcemaps": "~1.6.0",
    "gulp-cssnano": "~2.1.0",
    "electron-builder": "3.23.0",
    "electron-prebuilt": "1.1.0"
  },
  "build": {
    "productName": "MyApp",
    "app-bundle-id": "com.myapp",
    "app-category-type": "public.app-category.productivity",
    "osx": {
      "title": "MyApp",
      "background": "build/background.png",
      "icon": "build/icon.icns",
      "icon-size": 128,
      "target": "mas",
      "identity": "Developer ID Application: Jeremie Chazelle (XXXXXXXXX)",
      "contents": [
        {
          "x": 355,
          "y": 125,
          "type": "link",
          "path": "/Applications"
        },
        {
          "x": 155,
          "y": 125,
          "type": "file"
        }
      ]
    },
    "mas": {
      "identity": "Jeremie Chazelle"
    }
  }
}

I done this tutoriel
https://github.com/nwjs/nw.js/wiki/MAS%3A-Requesting-certificates
to make the certificates

I launch the build and sign with
sudo npm run-script dist

pc3:my-app jeremiechazelle$ sudo npm run-script dist
> @ dist /Users/jeremiechazelle/Sites/my-app
> npm run dist:osx
> @ dist:osx /Users/jeremiechazelle/Sites/my-app
> build --platform darwin
Rebuilding app dependencies for arch x64 to /Users/jeremiechazelle/Sites/my-app/app
Packaging app for platform mas x64 using electron v1.1.0
Signing app (identity: Developer ID Application: Jeremie Chazelle (XXXXXXXXXX))
pc3:my-app jeremiechazelle$

With Application Loader, I upload my app. The upload it's done

But, after 30 secondes, I have an email from Apple

Dear developer,

We have discovered one or more issues with your recent delivery for "MyApp". To process your delivery, the following issues must be corrected:

Invalid Signature - ...

Once these issues have been corrected, you can then redeliver the corrected binary.

Regards,

The App Store team

I don't understand what I'm missing...

The text was updated successfully, but these errors were encountered:

develar · 2016-05-25T06:43:01Z

Please use https://itunes.apple.com/us/app/rb-app-checker-lite/id519421117?mt=12 to check your app.

Please set DEBUG env to * to get debug output and attach it here.

develar · 2016-05-25T11:44:59Z

Maybe related electron/packager#371

develar · 2016-05-25T11:56:46Z

If you use latest electron, you need to wait electron/packager#371 fix.

develar · 2016-05-25T18:52:33Z

@mcfedr @sethlu Do you have any clue?

sethlu · 2016-05-25T19:06:52Z

@develar I'm not sure but electron-builder doesn't yet use electron-osx-sign right? 😕
It seems to me like that the frameworks embedded in the app bundle aren't properly signed.

develar · 2016-05-25T19:16:36Z

@sethlu No, we use your excellent module (but fork — my PR was accepted, thanks).

sethlu · 2016-05-25T19:30:47Z

@develar Sorry I looked at the wrong part of the code...

sethlu · 2016-05-25T19:36:54Z

@develar Just read this: https://discussions.agilebits.com/discussion/37099/verification-of-app-signature. Not sure if it's related to this issue. His app-bundle-id only has a prefix com.releasespro. Not sure if this triggered the issue. (Let me check if the error could be reproduced.)

sethlu · 2016-05-25T19:41:59Z

@jechazelle May I ask which identifier you used on iTC? Was it com.releasespro.something? Thanks.

jechazelle · 2016-05-25T19:45:21Z

Hi @sethlu

On iTunes Connect I use : com.myapp

sethlu · 2016-05-25T19:58:34Z

@jechazelle thanks for confirming. Sorry but I'm out of clues right now. Would you do the following test of designated requirements on your local machine?

codesign --verify --verbose path/to/my.app

jechazelle · 2016-05-25T20:03:20Z

@sethlu Yes, of course !

pc3:my-app jeremiechazelle$ sudo codesign --verify --verbose ./dist/my app-darwin-x64/my app.app
./dist/my app-darwin-x64/MyApp.app: valid on disk
./dist/my app-darwin-x64/MyApp.app: satisfies its Designated Requirement
pc3:my-app jeremiechazelle$

sethlu · 2016-05-25T20:09:23Z

@jechazelle Thanks for testing... Now this is very weird 😿
I'll have to look into this a bit more. Seems like something to do with code-signing.

jechazelle · 2016-05-25T20:23:24Z

@develar @sethlu thank you for your help !

jechazelle · 2016-05-25T23:51:01Z

I re-signed my .app from mas folder with this script :

child.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

parent.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <string>XXXXXXXXXX.com.myapp</string>
  </dict>
</plist>

sign.sh

#!/bin/bash

# Name of your app.
APP="MyApp"
# The path of your app to sign.
APP_PATH="./dist/my-app-mas-x64/My App.app"
# The path to the location you want to put the signed package.
RESULT_PATH="/Users/jeremiechazelle/Desktop/$APP.pkg"
# The name of certificates you requested.
APP_KEY="3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX)"
INSTALLER_KEY="3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXX)"

FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"

codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libnode.dylib"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/Electron Framework.framework"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/$APP Helper.app/"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/$APP Helper EH.app/Contents/MacOS/$APP Helper EH"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/$APP Helper EH.app/"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/$APP Helper NP.app/Contents/MacOS/$APP Helper NP"
codesign -s "$APP_KEY" -f --entitlements child.plist "$FRAMEWORKS_PATH/$APP Helper NP.app/"
codesign -s "$APP_KEY" -f --entitlements child.plist "$APP_PATH/Contents/MacOS/$APP"
codesign -s "$APP_KEY" -f --entitlements parent.plist "$APP_PATH"

productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

Now it's done, I see my build on iTunes Connect ! I wait if Apple valid my app with this pkg...

sethlu · 2016-05-26T00:52:09Z

@jechazelle Yea, this script reminded me of something!
The identity provided for electron builder is Developer ID Application which doesn't really satisfy the MAS requirements. However, 3rd Party Mac Developer Application is used with your custom Shell script. Not sure if that's the cause.

mcfedr · 2016-05-26T05:52:20Z

If you use electron-builder for the MAS build you should set env vars CSC_INSTALLER_NAME="...Developer Installer..." and CSC_NAME="...Developer Application..."
Then your .app and .pkg come out with the correct signatures

https://github.com/electron-userland/electron-builder/wiki/Code-Signing

develar · 2016-05-26T06:11:25Z

@sethlu codesign checks cert — no way to use invalid not installer cert (so, I doubt that it is a electron-builder bug). But there is some user error and my goal to add extra check when this issue will be solved.

FYI: codesign verify on electron-osx-sign side is not complete — #377 is not prevented.

mcfedr · 2016-05-26T06:17:08Z

I am fairly sure that if Application Loader takes your pkg then its correctly signed

sethlu · 2016-05-26T11:18:41Z

@develar I'll try to reproduce this error... see if export DEBUG could get anything from electron-osx-sign. I'm thinking now that some lines in package.json may need some tweaking.

   "osx": {
      [... skipped]
      "target": "mas",
      "identity": "Developer ID Application: Jeremie Chazelle (XXXXXXXXX)",
      [... skipped]
    },
    "mas": {
      "identity": "Jeremie Chazelle"
    }

jechazelle · 2016-05-26T17:44:36Z

I checked my env vars :

CSC_INSTALLER_NAME=3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXX)
CSC_NAME=Developer ID Application: Jeremie Chazelle (XXXXXXXX)

I have no CSC_LINK, CSC_KEY_PASSWORD, CSC_INSTALLER_LINK, CSC_INSTALLER_KEY_PASSWORD

I must use it "3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXX)" somewhere ?

jechazelle · 2016-05-26T21:36:48Z

@develar @sethlu
Apple just send me a message :

2.2 Here is how we found this bug: The app does not respond on launch, and does not display any windows.

when I build with target: mas, the app does not respond on launch, and does not display any windows (myapp.app => 140,8Mo).
when I build without target: mas, identity, it's ok, my app respond on launch, when I click on myApp.app (myapp.app => 142,9Mo).

May be it's a link with the certificate problem ?

I used

    "electron-builder": "3.25.0",
    "electron-prebuilt": "1.0.1",

    "electron-builder": "3.27.0",
    "electron-prebuilt": "1.0.2",

sethlu · 2016-05-27T05:04:05Z

@jechazelle let me respond to the comment regarding CSC first. I believe 3rd Party Mac Developer Application/Installer should be used to sign off any app bundles/installers sent to iTC for review.
If Developer ID Application was used for signing, it may not work; probably it explains why previously Application Loader throws the error message.

sethlu · 2016-05-27T05:09:38Z

@jechazelle As a quick solution, would you do the following with your app bundle either signed/unsigned? Previous signings should be overwritten by default. 💭

npm install -g electron-osx-sign
# OR sudo npm install -g electron-osx-sign IF EACCES error thrown

# Display logs while signing or packing flat installer
export DEBUG=electron-osx-sign*

# This should automatically discover certs for signing
electron-osx-sign path/to/my/app.app --entitlements path/to/my/entitlements.plist
# And this for flatting
electron-osx-flat path/to/my/app.app

(also note that Info.plist needs updating with team id added before signing)

I think we may track down this issue slightly better if with the script above works (as I expect). Then we may take some time looking into the signing part of using electron-builder.

mcfedr · 2016-05-27T07:38:20Z

@jechazelle That sounds like it might be a sandbox issue, electron have just released 1.1.2 that addresses a problem with sandboxing, check out the latest instructions about entitlements, https://github.com/electron/electron/blob/master/docs/tutorial/mac-app-store-submission-guide.md

sethlu · 2016-05-27T07:52:44Z

@mcfedr I think what @jechazelle did earlier (#436 (comment)) adheres to the latest MAS submission guide, (not sure about his Info.plist though).
I'm not sure if it's the incorrect certs for signing or if a different build other than mas that is used for packing that caused this issue.

jechazelle · 2016-05-27T08:03:27Z

@sethlu "I believe 3rd Party Mac Developer Application/Installer should be used to sign off any app bundles/installers sent to iTC for review. If Developer ID Application was used for signing, it may not work; probably it explains why previously Application Loader throws the error message."

So, I must modify my env var ?

CSC_INSTALLER_NAME=3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXX)
CSC_NAME=Developer ID Application: Jeremie Chazelle (XXXXXXXX)

by

CSC_INSTALLER_NAME=3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXX)
CSC_NAME=3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXX)

from wiki :
export CSC_NAME="Developer ID Application: Your Name (code)"
https://github.com/electron-userland/electron-builder/wiki/Code-Signing

my info.plist

<plist version="1.0">
<dict>
  <key>ElectronTeamID</key>
  <string>XXXXXXXX</string>
</dict>
</plist>

sethlu · 2016-05-27T08:10:32Z

@jechazelle I think @develar may know more on the set up of this module.
However, generally when building apps for distribution inside the MAS, 3rd Party Mac Developer Application and 3rd Party Mac Developer Installer should be the correct ones to be used. When for distribution outside the MAS, Developer ID Application and Developer ID Installer should be used (as far as I understand).

develar · 2016-05-27T08:15:37Z

I have never yet published to MAS, so, I trust @sethlu And as I see in the code https://github.com/electron-userland/electron-osx-sign/blob/master/index.js#L298 yes, 3rd Party Mac Developer Application must be used.

So, such check must be added to electron-builder.

sethlu · 2016-05-27T08:18:15Z

@jechazelle Thanks for posting your Info.plist. So far I believe with the identities 3rd Party Mac Developer/Installer used for signing, your app should pass the iTC check. 👍

jechazelle · 2016-05-28T22:25:58Z

So, it's strange, when I build my project with mas, I click on myapp.app, launch application, and I don't use the http request (get) in my application (angularjs) : error name not resolve

When I build without mas, the file .app generate allow to use http request (get)

jechazelle · 2016-05-29T10:50:12Z

@sethlu After many tests with electorn-builder, I try to use electron-osx-sign to found why my sign doesn't work with electorn-builder

./dist/osx/My App.app
myApp.app

sudo electron-osx-sign "./dist/osx/My App.app" --identity="3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX)"
and after :
sudo electron-osx-flat "./dist/osx/My App.app" --identity="3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXXX)"

But when I upload my pkg with Application Loader, I have this :

So I try this:

./default_mas_entitlements

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
  </dict>
</plist>

./default_mas_inherit_entitlements

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

sudo electron-osx-sign "./dist/osx/My App.app" --identity="3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX)" entitlements="./default_mas_entitlements" entitlements-inherit="./default_mas_inherit_entitlements"

But I have this error :

Sign failed.
Command failed: codesign --sign 3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX) -fv entitlements=./default_mas_entitlements
entitlements=./default_mas_entitlements: No such file or directory

I wonder if there is not a link with my problem with electron -builder

sethlu · 2016-05-29T12:55:01Z

@jechazelle If wish to add options, you may use the following for signing and packing. Note the two dashes -- before stating each param.

electron-osx-sign "./dist/osx/Releases Pro.app" --identity="3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX)" --entitlements="./default_mas_entitlements" --entitlements-inherit="./default_mas_inherit_entitlements"
electron-osx-flat "./dist/osx/Releases Pro.app" --identity="3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXXX)"

Additionally, export DEBUG=electron-osx-sign* before signing should give extra debug logs.

sethlu · 2016-05-29T13:00:33Z

Also, very strangely Squirrel.framework seems to be inside your app bundle. Do you mind checking if it's the correct Electron (for MAS but not for Darwin) is used to pack your app? Some private APIs are removed in the Electron MAS build; Squirrel.framework shouldn't be in a proper MAS version I think.

jechazelle · 2016-05-29T13:05:29Z

Thank you @sethlu my app is sign !

But, when I sign my app with this command

electron-osx-sign "./dist/osx/My App.app" --identity="3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX)" --entitlements="./default_mas_entitlements" --entitlements-inherit="./default_mas_inherit_entitlements"
electron-osx-flat "./dist/osx/My App.app" --identity="3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXXX)"

I can't use my xhr request in myapp.app, do you have an idea why ?

How can I remove Squirrel.framework ?

sethlu · 2016-05-29T13:14:06Z

@jechazelle theoretically you cannot send XHR requests lol.
@jasonhinkle's drafted an explanation earlier this year: https://github.com/electron-userland/electron-osx-sign/wiki/3.-App-Sandbox-and-Entitlements and this introduces/clarifies entitlements quite well, personally speaking. 😸 Just as suggestions, I think you may need to add the com.apple.security.network.client into your default_mas_entitlements file, because the default doesn't enable connecting to a remote address for a sandboxed app. A possible entitlements file may look like:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
  </dict>
</plist>

Additionally, when submitting the app eventually, you may need to provide clarification at iTC on why com.apple.security.network.client is listed among the entitlements for that you connect to somewhere else.

On the Squirrel.framework issue, I should leave this to @develar because I'm new to electron-builder. Because Electron comes with darwin and mas builds, I don't know why the darwin build seems to be used while building the app. (It's totally fine as long as it doesn't try to get into mas because iTC complains for various limitations of the app store.)

A possible internal struct of a mas build should look something like:

$ electron-osx-sign test-1.2.0.app
  electron-osx-sign:warn No `platform` passed in arguments, checking Electron platform... +0ms
  electron-osx-sign:warn No `entitlements` passed in arguments, will fallback to default settings. +4ms
  electron-osx-sign:warn No `entitlements-inherit` passed in arguments, will fallback to default settings. +1ms
  electron-osx-sign:warn No `identity` passed in arguments, discovering identities... +1ms
  electron-osx-sign Signing application... +436ms
  electron-osx-sign > application         test-1.2.0.app +1ms
  electron-osx-sign > platform            mas +0ms
  electron-osx-sign > entitlements        /Users/zhuolu/Development/electron-osx-sign/default.mas.entitlements +0ms
  electron-osx-sign > child-entitlements  /Users/zhuolu/Development/electron-osx-sign/default.mas.inherit.entitlements +0ms
  electron-osx-sign > additional-binaries  +0ms
  electron-osx-sign > identity            3rd Party Mac Developer Application: Zhuo Lu (XXXXXXXXXX) +0ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +103ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +3s
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib +272ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/Electron Framework.framework +544ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/test-1.2.0 Helper EH.app/Contents/MacOS/test-1.2.0 Helper EH +2s
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/test-1.2.0 Helper EH.app +422ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/test-1.2.0 Helper NP.app/Contents/MacOS/test-1.2.0 Helper NP +280ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/test-1.2.0 Helper NP.app +248ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/test-1.2.0 Helper.app/Contents/MacOS/test-1.2.0 Helper +236ms
  electron-osx-sign Signing... test-1.2.0.app/Contents/Frameworks/test-1.2.0 Helper.app +290ms
  electron-osx-sign Signing... test-1.2.0.app +257ms
  electron-osx-sign Verifying sign... +2ms
Application signed: test-1.2.0.app

jechazelle · 2016-05-29T13:39:16Z

@sethlu thank you ! :)

I added

<key>com.apple.security.network.client</key>
<true/>

And I have a new message from Apple after the submission with Application Loader:

Dear developer,

We have discovered one or more issues with your recent delivery for "My App". To process your delivery, the following issues must be corrected:

Deprecated API Usage - Apple no longer accepts submissions of apps that use QuickTime or QTKit APIs.

Once these issues have been corrected, you can then redeliver the corrected binary.

Regards,

The App Store team

My App doesn't use QuickTime lol !!

sethlu · 2016-05-29T13:43:22Z

@jechazelle No worries. I guess that's the conflict with non-MAS build. Check electron/electron#5749; I think our issue from message received could be resolved with a proper packing with MAS build.

jechazelle · 2016-05-29T14:15:27Z

@sethlu I tried to add --platform="mas"

electron-osx-sign "./dist/osx/My App.app" --identity="3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX)" --entitlements="./default_mas_entitlements" --entitlements-inherit="./default_mas_inherit_entitlements" --platform="mas"
electron-osx-flat "./dist/osx/My App.app" --identity="3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXXX)" --platform="mas"

But I have the same error

sethlu · 2016-05-29T14:21:31Z

@jechazelle well, the presence of Squirrel.framework doesn't get addressed with electron-osx-sign. Actually, it seeks for Squirrel.framework and decides which build the Electron is.

It's the Electron build, like electron-v1.2.0-darwin-x64 and electron-v1.2.0-mas-x64, that is different specially when shipping to MAS. The content within each is slightly different, including the many other frameworks or libs. Once we hear back from @develar, he may know how the mas version could be targeted for packing. Sorry, I've only worked directly with electron-packager.

jechazelle · 2016-05-29T14:44:33Z

@sethlu I use

    "electron-osx-sign": "^0.3.1",
    "electron-prebuilt": "0.36.12",

Because my app freeze if I upgrade electron-prebuilt :) ..

jechazelle · 2016-05-29T14:55:17Z

@sethlu How can I add

<key>com.apple.security.network.client</key>
<true/>

with electron-builder when I build the mas version ?

sethlu · 2016-05-29T15:01:28Z

@jechazelle From the doc here https://github.com/electron-userland/electron-builder/wiki/Options#buildmas I think you may add the following in your package.json:

   "mas": {
      "identity": "3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXX)",
      "entitlements": "path-to-my-entitlements"
    }

develar · 2016-05-30T07:54:34Z

Fix:

identity is removed from the build.mas.
Env CSC_INSTALLER_NAME is removed.
You don't need to specify CSC_NAME env or build.osx.identity. Valid identity from your keychain will be automatically used.
CSC_NAME env or build.osx.identity is still not removed because it is required if you have several identities. But now instead of Developer ID Installer: Your Name (XXXXXXXXXX), you should specify only Your Name — appropriate certificate will be chosen automatically.

4.x will be released soon (yes, it is a breaking change).

sethlu · 2016-05-30T12:53:05Z

@jechazelle with this issue having been closed, if you need extra help with code-signing any Electron products, you may either open an issue here https://github.com/electron-userland/electron-osx-sign/issues (I've just added a knowledge base label in case any general questions fall there) or shoot me an email.

jechazelle · 2016-05-30T19:46:17Z

@sethlu Thanks a lot for you help!! :)

I will try with the new version,

To resume, I have :

    "electron-builder": "3.27.0",
    "electron-prebuilt": "0.36.12",

./default_mas_entitlements

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
  </dict>
</plist>

./default_mas_inherit_entitlements

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

package.json :

"build": {
    "productName": "MyApp",
    "app-bundle-id": "com.MyApp",
    "app-category-type": "public.app-category.productivity",
    "osx": {
      "title": "MyApp",
      "background": "build/background.png",
      "icon": "build/icon.icns",
      "icon-size": 128,
      "target": "mas",
      "identity": "3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXX)",
      "contents": [
        {
          "x": 355,
          "y": 125,
          "type": "link",
          "path": "/Applications"
        },
        {
          "x": 155,
          "y": 125,
          "type": "file"
        }
      ]
    },
    "mas": {
      "identity": "3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXX)",
      "entitlements": "./default_mas_entitlements",
      "entitlementsInherit": "./default_mas_inherit_entitlements"
    }
  }

And I added this on iTC :

Thank you again !!! @sethlu @develar @mcfedr 👍

jechazelle · 2016-06-01T16:14:14Z

@develar @sethlu

with the new version, I must declare :

"electron-builder": "4.1.0",

package.json

"build": {
    "productName": "MyApp",
    "app-bundle-id": "com.MyApp",
    "app-category-type": "public.app-category.productivity",
    "osx": {
      "title": "MyApp",
      "background": "build/background.png",
      "icon": "build/icon.icns",
      "icon-size": 128,
      "target": "mas",
      "identity": "Jeremie Chazelle",
      "contents": [
        {
          "x": 355,
          "y": 125,
          "type": "link",
          "path": "/Applications"
        },
        {
          "x": 155,
          "y": 125,
          "type": "file"
        }
      ]
    },
    "mas": {
      "entitlements": "./default_mas_entitlements",
      "entitlementsInherit": "./default_mas_inherit_entitlements"
    }
  }

It's correct ?

develar · 2016-06-01T16:19:01Z

@jechazelle Please wait several hours — 4.2 should be out soon (well, I am trying to release second day :(

develar · 2016-06-01T16:21:39Z

BTW — please consider to not specify entitlements explicitly — see https://github.com/electron-userland/electron-builder/wiki/Options#buildmas,

build/mas.inherit.entitlements will be used if exists
build/mas.entitlements will be used if exists

develar · 2016-06-01T16:22:47Z

And yes, in the new 4 version you don't need to specify identity in the mas — appropriate identity will be found automatically.

jechazelle · 2016-06-01T16:26:22Z

@develar Awesome Release !!

jechazelle · 2016-06-01T16:39:45Z

@develar electron-builder 4.2.0 will run with electron-prebuilt 1.0.2, because with 0.36.12 it's run, but my app freeze if I upgrade electron-prebuilt ?

sethlu · 2016-06-01T16:44:25Z

@develar Would you mind having a check on how the default entitlements here are implemented? I've renamed the entitlements file so they match the Apple docs better. I could update the links in wiki but anything that needs updating within this module may have to be updated as well.

develar · 2016-06-01T16:52:26Z

@sethlu Yep, thanks, we must change according to your conventions. https://github.com/electron-userland/electron-builder/blob/master/src/osxPackager.ts#L147 It is not error currently, because we set options only and only if there is explicit user setting, i.e. we don't repeat default file names. But we should follow your convention. I will do it — since in any case 4 is a major release.

sethlu · 2016-06-01T16:54:46Z

@develar Thanks for following. I did this because editing the .entitlements with Xcode has some interesting and unexpected behaviors...
Wiki here already updated: https://github.com/electron-userland/electron-builder/wiki/Options

sethlu · 2016-06-09T12:21:14Z

@develar Have you updated any docs with entitlements from .entitlements to .plist yet? I'm reaching some inconsistencies from Apple docs on the entitlements file extensions. However, they are property list files anyway.

develar · 2016-06-09T12:25:40Z

@sethlu Docs and implementation are fixed, thanks.

develar mentioned this issue May 30, 2016

Build with target: mas, app does not respond on launch #443

Closed

develar closed this as completed May 30, 2016

jechazelle mentioned this issue Jun 9, 2016

AngularJS request GET, ERR_NAME_NOT_RESOLVED electron-userland/electron-prebuilt#141

Closed

Invalid Signature - The nested app bundle Electron Framework #436

Invalid Signature - The nested app bundle Electron Framework #436

Comments

jechazelle commented May 24, 2016 • edited Loading

develar commented May 25, 2016

develar commented May 25, 2016

develar commented May 25, 2016

develar commented May 25, 2016

sethlu commented May 25, 2016

develar commented May 25, 2016

sethlu commented May 25, 2016

sethlu commented May 25, 2016

sethlu commented May 25, 2016

jechazelle commented May 25, 2016 • edited Loading

sethlu commented May 25, 2016

jechazelle commented May 25, 2016 • edited Loading

sethlu commented May 25, 2016

jechazelle commented May 25, 2016

jechazelle commented May 25, 2016 • edited Loading

sethlu commented May 26, 2016 • edited Loading

mcfedr commented May 26, 2016

develar commented May 26, 2016 • edited Loading

mcfedr commented May 26, 2016

sethlu commented May 26, 2016 • edited Loading

jechazelle commented May 26, 2016 • edited Loading

jechazelle commented May 26, 2016 • edited Loading

sethlu commented May 27, 2016 • edited Loading

sethlu commented May 27, 2016 • edited Loading

mcfedr commented May 27, 2016

sethlu commented May 27, 2016

jechazelle commented May 27, 2016 • edited Loading

sethlu commented May 27, 2016

develar commented May 27, 2016 • edited Loading

sethlu commented May 27, 2016

jechazelle commented May 28, 2016 • edited Loading

jechazelle commented May 29, 2016 • edited Loading

sethlu commented May 29, 2016 • edited Loading

sethlu commented May 29, 2016

jechazelle commented May 29, 2016 • edited Loading

sethlu commented May 29, 2016 • edited Loading

jechazelle commented May 29, 2016 • edited Loading

sethlu commented May 29, 2016

jechazelle commented May 29, 2016 • edited Loading

sethlu commented May 29, 2016 • edited Loading

jechazelle commented May 29, 2016

jechazelle commented May 29, 2016 • edited Loading

sethlu commented May 29, 2016

develar commented May 30, 2016

sethlu commented May 30, 2016 • edited Loading

jechazelle commented May 30, 2016 • edited Loading

jechazelle commented Jun 1, 2016 • edited Loading

develar commented Jun 1, 2016

develar commented Jun 1, 2016

develar commented Jun 1, 2016

jechazelle commented Jun 1, 2016

jechazelle commented Jun 1, 2016 • edited Loading

sethlu commented Jun 1, 2016 • edited Loading

develar commented Jun 1, 2016 • edited Loading

sethlu commented Jun 1, 2016

sethlu commented Jun 9, 2016 • edited Loading

develar commented Jun 9, 2016

jechazelle commented May 24, 2016 •

edited

Loading

jechazelle commented May 25, 2016 •

edited

Loading

jechazelle commented May 25, 2016 •

edited

Loading

jechazelle commented May 25, 2016 •

edited

Loading

sethlu commented May 26, 2016 •

edited

Loading

develar commented May 26, 2016 •

edited

Loading

sethlu commented May 26, 2016 •

edited

Loading

jechazelle commented May 26, 2016 •

edited

Loading

jechazelle commented May 26, 2016 •

edited

Loading

sethlu commented May 27, 2016 •

edited

Loading

sethlu commented May 27, 2016 •

edited

Loading

jechazelle commented May 27, 2016 •

edited

Loading

develar commented May 27, 2016 •

edited

Loading

jechazelle commented May 28, 2016 •

edited

Loading

jechazelle commented May 29, 2016 •

edited

Loading

sethlu commented May 29, 2016 •

edited

Loading

jechazelle commented May 29, 2016 •

edited

Loading

sethlu commented May 29, 2016 •

edited

Loading

jechazelle commented May 29, 2016 •

edited

Loading

jechazelle commented May 29, 2016 •

edited

Loading

sethlu commented May 29, 2016 •

edited

Loading

jechazelle commented May 29, 2016 •

edited

Loading

sethlu commented May 30, 2016 •

edited

Loading

jechazelle commented May 30, 2016 •

edited

Loading

jechazelle commented Jun 1, 2016 •

edited

Loading

jechazelle commented Jun 1, 2016 •

edited

Loading

sethlu commented Jun 1, 2016 •

edited

Loading

develar commented Jun 1, 2016 •

edited

Loading

sethlu commented Jun 9, 2016 •

edited

Loading