The signature of the binary is invalid but codesign says otherwise

Question

Majonez69 OP

Created May ’19

Replies 6

Boosts 0

Views 7.9k

Participants 7

Hi

I'm trying to notarize my app. I've been signing mutiple binaries and libs and I'm left with two binaries related to JxBrowser (browsercore and browsercore-helper).

The notarization process returns an error on those two binaries saying "The signature of the binary is invalid.".

When I extract the binaries from the .dmg file and check them with:

codesign -vvv --deep --strict <binary_name>

The output is:

browsercore: valid on disk
browsercore: satisfies its Designated Requirement

What am I doing wrong and how can I pass them through the notarization process?

Best regards

Boost

Answer 1

john daniel OP

May ’19

What does spctl say?

The standard reference for these issues is: https://developer.apple.com/library/archive/technotes/tn2206/_index.html

1

Answer 2

DTS Engineer OP

Apple

May ’19

The most common cause of problems like this is that you have nested code in the wrong location. Nested code should be placed according to the rules outlined in the Nested Code section of Technote 2206 macOS Code Signing In Depth.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 3

Bruji OP

Jan ’20

If the app is signed correctly on your computer, make sure the zipping command you are using is not destroying the UTF8 encoding and the signature is then seen incorrectly on your submission to Apple.

When preapring the zip archive for notarizaion use ditto and "–sequesterRsrc" option.

/usr/bin/ditto -c -k –sequesterRsrc --keepParent "$APP_PATH" "$ZIP_PATH"

Regards,

Conor

3

Answer 4

JaroslaHolan OP

Sep ’20

Answer from Bruji solved my problem. Thank you.
But there is a small mistake in the command. There should be two dashes -- (minus symbols) in front of sequesterRsrc

Code Block /usr/bin/ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ZIP_PATH"

3

Answer 5

DTS Engineer OP

Apple

Sep ’20

There should be two dashes -- (minus symbols) in front of
sequesterRsrc

This is more evidence that you have nested code problems. Except under unusual circumstances, like shipping an Automator action, a code signature should end up in resource fork. If it does, it’s commonly because you are signing data as code, which is not a good look.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 6

Richard_Fairhurst OP

Dec ’20

Thank you, @Bruji. This solved my problem too.

0