Notarisation of Java Application with embedded JRE

Sure. Don't ever use "--deep". Virtually every post about notarization problems involves someone using "--deep" and/or "--force". I'm not joking here - virtually every single one.

So don't use that. Chances are, your bundle will then fail to sign properly. Perhaps that is why everyone was hacking it with "--deep". But the correct course of action is to contruct your bundle properly. Then you don't need "--deep" and your notarization will work.

In most cases, you are stuffing binaries in the Resources folder. Stand-alone binaries need to go in Contents/Helpers. Something more complex than that should go into Frameworks.

This is all assuming Apple's notarization servers are running that day. I'm still a little ticked about yesterday. Not even a "sorry 'bout that!" from Apple. Sorry. I digress.

Thanks for you answer!

I've changed the structure of the app but the result stays the same.

Checking with codesign says everything ok and the notarisation says the embedded JRE is not signed, although the hash values for all files are listed in the _CodeSignature.

Aare you still using "--deep"? Can you post your notarization log?

No, I have removed the --deep parameter but still get the same result. Notarisation complains about the Signature of the included JRE.

Command used to ckeck the DMGs signature: codesign -vvv --strict ***.dmg

***.dmg: valid on disk

***.dmg: satisfies its Designated Requirement

Part of the content of CodeResources file

<key>jre/Contents/Home/bin/java</key>

<dict>

<key>hash</key>

<data>

5BjtH+ZNNYHVRnm4n8ILT2Gp8R8=

</data>

<key>hash2</key>

<data>

NXhhFRQOUk58ttqAHMmkttxkc+4hvHjolDfS7ffxSyQ=

</data>

</dict>

Part of the notarisation log:

{

"severity": "error",

"code": null,

"path": "***.dmg/***.app/Contents/jre/Contents/Home/bin/java",

"message": "The binary is not signed.",

"docUrl": null,

"architecture": "x86_64"

},

{

"severity": "error",

"code": null,

"path": "***.dmg/***.app/Contents/jre/Contents/Home/bin/java",

"message": "The signature does not include a secure timestamp.",

"docUrl": null,

"architecture": "x86_64"

},

{

"severity": "error",

"code": null,

"path": "***.dmg/***.app/Contents/jre/Contents/Home/bin/java",

"message": "The executable does not have the hardened runtime enabled.",

"docUrl": null,

"architecture": "x86_64"

},

I don't know what to tell you that would be more informative than the messages that notarization has already provided.

I would suggest keeping things like a JRE in the "Frameworks" folder. I don't know if "Contents" is causing the problem, but "Frameworks" is better suited as a dumping ground of binaries that don't fit elsewhere.

Is there any documentation on just what should go in which folders of the app?