2

I'm working on getting a Mac app signed. It won't be available in the app store. I've executed the codesign executable properly, I believe, but I still get the Gatekeeper warning. Simple question:

When I verify the signing, I get the following output:

$ codesign --verify --verbose /Applications/My\ App.app
Applications/My App.app/: valid on disk
Applications/My App.app/: satisfies its Designated Requirement

Nothing in there leads me to believe that there's a problem, but I guess I don't really know what I should see. Does this response indicate that the app is signed or something else?

Improve this question
2
  • Mine looks the same, but we don't sell it through the app store (but our signing does qualify to run downloads on computers that have strict checking on). Are you using an apple developer certificate to sign (we had problems trying this with a non-apple cert in the past)? But you'll probably have more success with this question on stackoverflow.com)
    – Grezgory
    May 30, 2013 at 20:39
  • Like you, my app won't be distributed through the app store (at least not yet). I'm not entirely sure about the Apple blessing of the cert. This was sent to us by the client. It was used before with an AIR app that had no similar issue if that's any indicator.
    – Rob Wilkerson
    May 30, 2013 at 22:40

3 Answers 3

Reset to default
1

Based on the comments I think I have a something close to an answer:

I think it will be the fact that it is Thawte. We have a Thawte cert for Windows, and we could successfully sign Mac software with it, but Apple/MacOS treated it as if it was self signed or signed with not enough authority.

For Mac-signing we signed up to the Mac developer program ($100/year) and got an Apple created cert. With that for example MacOS did let people start the signed app when it was downloaded from the internet.

Improve this answer
2
  • I believe you're going to be right. I have a meeting with the client to talk about their cert. I expect them to confirm that it's not an Apple recognized developer cert. Will follow up once I follow through with all of that.
    – Rob Wilkerson
    May 31, 2013 at 13:39
  • I had the same issue. To pass GateKeeper, you need more than signed code with a valid cert. It must specifically be signed with your Apple Developer ID certificate. Only Apple issues those, at this time, as far as I know. Some Apple docs are not clear on this.
    – SilentSteel
    Jun 16, 2014 at 16:46
0

You are correct - codesign --verify --verbose is the terminal manner to verify that an application bundle is properly signed. I also like to pass the app through a display:

codesign --display --verbose=4 /path/to/App.app/

By inspecting the details, I ensure the proper code signing certificate was selected.

You can also test things by changing your settings (or AirDropping the file to a Mac that hasn't run that app) to only run apps that are signed - and double clicking it in the Finder.

Improve this answer
1
  • Thanks, @bmike. That actually helps a lot. I don't know the exact format, but the cert looks about right. The authority sections (3 of them) include the common name I gave the client cert as well as Thawte with the right Identifier value. Any reason you can think of that Gatekeeper would still throw the warning? This is not an app store app (at least not yet).
    – Rob Wilkerson
    May 30, 2013 at 22:39
0

See: Checking apps for a "GateKeeper" Developer ID?

codesign -dvvv <path to app.app>

Should output something like:

Executable=/Volumes/Big Disk/F376/Projects/<My App>
Identifier=<My Bundle ID>
Format=bundle with Mach-O thin (x86_64)
CodeDirectory v=20100 size=3958 flags=0x0(none) hashes=189+5 location=embedded
Hash type=sha1 size=20
CDHash=761b0d1XXXXXXXXXX0dc8dd42e38eb445fb5341f
Signature size=8504
Authority=Developer ID Application: XXXXXX
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=May 7, 2013 3:07:59 PM
Info.plist entries=30
Sealed Resources rules=4 files=128
Internal requirements count=1 size=224

Just a heads up, at this time, signing with a 3rd party valid code signing certificate is not going to pass GateKeeper. It must be signed with an Apple Developer ID Certificate. See this post for more info: https://stackoverflow.com/questions/11833481/non-apple-issued-code-signing-certificate-can-it-work-with-mac-os-10-8-gatekeep/24248181#24248181

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .