3

I try to sign an app-bundle that includes the Java Runtime Environment 8 (JRE).

From command line I run this command:

codesign -s "Developer ID Application: My Company" /Development/MyApp.app

I get this output:

MyApp.app: code object is not signed at all
In subcomponent: /Development/MyApp.app/Contents/PlugIns/jre8/Contents/Home/jre/COPYRIGHT

The result is that the App-bundle doesn't get signed as expected.

How do I fix this?

  • Are you trying to sandbox the app or just sign it for Gatekeeper acceptance and non-app store distribution? – bmike Nov 12 '15 at 11:38
  • The latter. I will put the bundle(s) in a .dmg for distribution online. – Joachim Bratteli Nov 12 '15 at 11:40
1

code signing

The friendly manual on code signing says to sign the sub-component first, then try again with your app itself:

codesign says my code is unsigned when I try to sign it.

Make sure all nested code is already signed and its signature is valid. Xcode will take care of this for you if you let it handle your code signing tasks.

It goes on to say let Xcode handle all the signing, which may or may not be helpful since you are already choosing to sign things from the command line.

--deep

To sign all nested code in one go, add the --deep argument to codesign:

codesign --deep -s "Developer ID Application: My Company" /Development/MyApp.app

shell script

Another way of doing the same is to create a shell script that checks the signature state of the nested code, and signs if it is missing. This way you may get more control on what you are signing within the bundle.

Example:

A bash-script called sign-unsigned.sh that checks one entry in the bundle and signs it if it is not already signed could be done like this:

#!/bin/bash
if codesign --verify $1 ; then 
   exit; 
else
   codesign --sign "$2" $1;
fi

Put the sign-unsigned.sh in /Development and do this on the command line:

cd /Development/MyApp.app/
find . -exec ../sign-unsigned.sh {} "Developer ID Application: My Company" \;
codesign --sign "Developer ID Application: My Company" ../MyApp.app
  • Thanks @bmike I think this may work. Still, this way I have to make a script (or something similar) that signs all files in the bundle individually. If only codesign could do that for me when I specify a bundle-folder... – Joachim Bratteli Nov 12 '15 at 13:41
  • @JoachimBratteli yep - at least the error message lets you know what to sign. Xcode might be useful just to package your app if you find that crafting your own toolset for signing is more onerous than setting up build phases to just assemble the package you will then distribute. – bmike Nov 12 '15 at 14:45
  • Solved. Just added to this answer my shell script solution. I do not really know how to incorporate an if-statement into the find -exec block, so I made a shell script that find could call. Thanks again for pointing me in the right direction @bmike – Joachim Bratteli Nov 12 '15 at 20:31
  • Just found in another answer on superuser that it is not possible to type in the ; of the if-statement in a find, so the solution would be to call a shell: http://superuser.com/questions/341601/find-with-exec-how-to-perform-multistep-conditional-action-on-each-file – Joachim Bratteli Nov 12 '15 at 20:47
  • And then I found that all could be fixed by just adding the --deep argument to codesign. Next time I read man-pages more "deeply". I did learn a bit about shell scripting though. :-D – Joachim Bratteli Nov 12 '15 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .