ITMS-90255 error when uploading Mac app to Store

[OABsoftware]

Hello.

One of the things that I use Xamarin for is building apps for MacOS.
Today I tried to upload my first Mac app to the store, but that resulted in an error:

ERROR ITMS-90255: "The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app."

What can I do to resolve this?

Steps to Reproduce

1. Start Xamarin and create a new Cocoa project.
2. In Apple's Developer Portal, create an identifier for the app.
3. Go back to Xamarin and set the same identifier as the bundle identifier in the info.plist
4. Change the build of the app to the release build.
5. In the properties of the project, in the tab "Mac build" check the option "Create installer package".
6. In Apple's Developer Portal, create a developer provisioning profile and a distribution provisioning profile for the app.
7. Download and install both profiles.
8. In the properties of the project, in the tab "Mac signing" check the "Sign the application bundle" option, select your developer identity and select the developer provisioning profile that you just created in the portal.
9. In the properties of the project, in the tab "Mac signing" check the "Sign the installer package" option, and select the distribution provisioning profile that you just created in the portal.
10. Right-click the project and select the "Archive for publishing" option.
11. Right-click the created archive and select the "Sign and distribute" option.
12. Select the "App Store" option.
13. In the next screen the identities and profiles are shown correctly.
14. Start the Transporter app on your Mac (https://apps.apple.com/us/app/transporter/id1450874784?mt=12).
15. Add the PKG file, that resulted from the "sign and distribute" step, in the Transporter app.
16. Try to let the Transporter app deliver your app to the store.
17. Error ITMS-90255 is shown...

Expected Behavior

I would expect that the delivery of the package by the Transporter app goes flawlessly.

Actual Behavior

But instead it results in the ITMS-90255 error.

Environment

1. Visual Studio for Mac version 8.3.4
2. Xamarin.Mac version 6.4.0.2

[chamons]

We've seen issues of this nature in the past, and very commonly it was due to building the software as root user. Can you confirm that locally (or on a bot) you are signed in as a normal user.

If you can confirm that, please attach the logs you receive, your build log, and preferably the final package produced.

[OABsoftware]

There's one account on my Mac and I use that for building my apps.
This is an account with administrator permissions, but it's not the root account.

This is the log from building the release version of the app:

https://gist.github.com/chamons/1dbf1b211cf4d279aa6306f191b2d211

(I replaced a couple of ID's by %%%)

I unpacked the PKG file. It contains a file called Distribution and another one called nl.OABsoftware.RESX-Editor.pkg. The permissions on that latter file indeed are "drwx------".

[chamons]

I've edited your comment to post the log as a gist. Very long logs can make it difficult to read bug reports on github.

[chamons]

Can you please attach a project that can reproduce this and/or the pkg file in question. The long, while interesting, doesn't show how that file is being added as read only.

[chamons]

User has sent package privately to my e-mail.

[chamons]

Using SuspiciousPackage I was able to figure out what files have the issue:

They are all no access to non-root. I don't know why yet.

[chamons]

As I possible workaround (I don't want to submit your app for review), try changing the permissions on disk for those pngs.

That appears to have fixed the pkg issue. I'm going to try to reproduce this in a new project.

[chamons]

Steps to reproduce:

• New XM Project
• Add a file as a bundle resource (or see attached project)
• Set the file to not world readable
• Build installer

BundleImagePermTest.zip

[chamons]

It looks like Xcode add a world +r bit when copying files to the Resources folder, and we do not.

[chamons]

I've filed this specifically as #7395

@OABsoftware - Can you verify that setting those files as everyone read fixes your submission?

[OABsoftware]

First of all, thanks for finding this. It solved the problem!

First I executed a "chmod 644 *.png" on all images in the Resources directory to set the permissions.
But that did NOT do the trick; I still could not get Transporter to deliver the package to the store.

So then I did a "ls -al" and it appeared that some of the images had extended attributes as well.
So I then executed a "xattr -rc *.png" on the image files in the Resources directory to remove those extended attributes.
Then I rebuilt the package and now I can upload it to the store successfully.

Again, many thanks!

[chamons]

The xattr issues is tracked (I think) in #5202. We'll track the read bit issue in #7395 since it's a tad clearer there.

Glad you were able to get on the store! 🎉