I'm completely puzzled by Apple signature system. It drives me nuts.
I have a Qt app (so not going through the XCode ecosystem) that I'm signing manually on macOS 10.12.
After signing, I run codesign --verify --deep --strict --verbose=2 PATHTOAPP as recommended here: https://developer.apple.com/library/content/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211
And I get:
valid on disk satisfies its Designated Requirement
Which is the expected, valid result.
When I do codesign -dv --verbose=4 PATHTOAPP I get:
Authority=Developer ID Application: MYAPPLEID Authority=Developer ID
Certification Authority Authority=Apple Root CA
Sealed Resources version=2
When I run it against the check-signature tool provided by Apple, I get a YES meaning it's correctly signed.
But when I run it against spctl -a -t exec -vv PATHTOAPP I get a:
rejected (embedded framework contains modified or invalid version)
And in the end, Gatekeeper rejects my app
Unfortunately the spctl utility doesn't give me a clue about what's wrong and where to look at. I don't get it, since codesign with the deepest and strictest flags says it's ok.
Any idea on how I can get more information ?
EDIT1: I ran spctl --assess --raw --verbose PATHTOAPP and I get this:
<key>assessment:authority</key>
<dict>
<key>assessment:authority:flags</key>
<integer>0</integer>
<key>assessment:authority:source</key>
<string>obsolete resource envelope</string>
<key>assessment:authority:weak</key>
<true/>
</dict>
<key>assessment:cserror</key>
<integer>-67009</integer>
<key>assessment:remote</key>
<true/>
<key>assessment:verdict</key>
<false/>
Now I don't know what to believe, is it "embedded framework contains modified or invalid version" or is it "obsolete resource envelope" (and why) ?
When I check error codes here: https://github.com/CamJN/Security/blob/77b26b3e434caec74403da43bcfb02532a25d7ff/libsecurity_codesigning/lib/CSCommon.h
I see:
errSecCSWeakResourceRules = -67013, /* resource envelope is obsolete */
errSecCSBadFrameworkVersion = -67009, /* embedded framework contains modified or invalid version */
EDIT2: It's really the contents of my Frameworks folder that is causing the problem. When I delete everything in-there before signing, it passes spctl validation.
The problem is, if I just let one single, pure Framework such as QtCore (from Qt 5.7.0) I immediatly gets the spctl error:
rejected (embedded framework contains modified or invalid version)
macdeployqt
, you can use the-codesign
argument and have it sign the bundle for you.