Signing a Qt5 application

Please don't use "--deep" and "--force" to sign anything.

Are you embedding your framework inside your app? And signing it properly? What happens when you test it in a VM that isn't your development machine with Qt already installed?

As john daniel says, don’t use

--deep

--deep

Rather, I sign each item separately, from the inside out. See Signing a Mac Product For Distribution and, for a concrete example, Manual Code Signing Example.

Once you’ve got everything sorted, I recommend you test using the procedure described in Testing a Notarised Product.

Finally, there are links to lots of other resources in the App Sandbox, Developer ID, Notarisation pinned post.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

>>Please don't use "--deep" and "--force" to sign anything.

I did it also without but it didn't make a difference.

>>Are you embedding your framework inside your app?

I am signing the app directly after the build. Deployment is realized afterwards but I haven't done it because the app crashes after the signature already (it does not without).

>>And signing it properly?

Yes, see above - it is also verified.

>>What happens when you test it in a VM that isn't your development machine with Qt already installed?

See above - it crashes already on my own machine before deployment.

Best

Alex

I asked if you are embedding the framework inside the app. When you do that, it will use the embedded framework. If you haven't done that, it is going to use what it can find on your system, which apparently isn't signed.

Got it - this helped me to better unstand the signing procedure !

This is turn leads to the next question:

The deployment as a DMG-File is realized via the macdeployqt call.

Do I understand correctly that I have to sign the final reployed DMG file ?

Alternatively I could apply macdeployqt without creating a DMG file, then sign the result and then create a DMG of it.

What makes most sense ?

Thanks,

best

Alex

Also thanks a lot to you. I will investigate asap and get back.