I'm signing an install4j installer for OSX, however OSX is rejecting it. The system log only reports that it was rejected, and spctl only reports that it was rejected, with no explanation. How can I determine why it was rejected?
1 Answer
I presume you're talking about Gatekeeper not allowing your app to run after it's downloaded? Gatekeeper's rules aren't based on a list of rules to reject an app, they're based on a list of possible rules to accept an app, and if your app doesn't match any or those rules. This makes it hard to log e.g. why your app was rejected beyond "it didn't match any of the allow rules". Now, if you know which "allow" rule you expected to apply to it, you can try to debug it based on that, but Gatekeeper itself doesn't know this and hence isn't much help.
I'm assuming you want your app to be allowed under the "identified developer" rule? If so, there are a couple of tests to look for obvious problems: first, run codesign -vv --deep-verify /path/to/yourapp.app
, and make sure it prints "valid on disk" and "satisfies its Designated Requirement" (and doesn't give any errors) -- if not, something's wrong with the signature or the contents of the app.
Second, run codesign -dvv /path/to/yourapp.app
, and make sure it the data it lists includes:
Authority=Developer ID Application: [Your name/company here]
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Sealed Resources version=2 rules=[something] files=[something]
If the Authority list is different from that, you used the wrong certificate to sign it. If the Sealed Resources version is 1 or not listed, you signed it with an old version of OS X, and recent versions will reject the signature format.
-
1When running
codesign --verify
, I recommend also using the--deep-verify
option, to make sure that any plug-ins, private frameworks, etc. are also properly signed.– JWWalkerCommented Mar 23, 2015 at 23:16 -
-
Can you clarify the bit about the Authority list? The docs apple.co/1BMv0Te say " if your company already has a third-party signing identity that you use to sign code on other systems, you can use it with the OS X codesign command". Such a cert wouldn't include "Apple Root CA". Or is this Authority list something else? Commented Mar 25, 2015 at 19:18
-
@user1009908 You can sign with any code-signing certificate, but Gatekeeper's default rules only allow apps signed with Apple Developer ID certs. The reason for this is that Apple wants to be able to revoke the cert of anyone caught signing malware, and they can only do this if they're the issuing authority. Commented Mar 25, 2015 at 22:52
-
Thank you, this really helped me out! I was trying to codesign on a 10.8 system, and although codesign had indicated success, Gatekeeper was still blocking it. The kicker was that
Sealed Resources
line – only after codesigning on a 10.9 system did it read asSealed Resources version=2
. Apple of course has little consideration for anyone not using the latest OS versions, and I did not find this caveat anywhere in their docs. Thanks for saving my sanity! Commented Apr 2, 2015 at 18:53