2

I'm completely puzzled by Apple signature system. It drives me nuts.

I have a Qt app (so not going through the XCode ecosystem) that I'm signing manually on macOS 10.12.

After signing, I run codesign --verify --deep --strict --verbose=2 PATHTOAPP as recommended here: https://developer.apple.com/library/content/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211

And I get:

valid on disk satisfies its Designated Requirement

Which is the expected, valid result.

When I do codesign -dv --verbose=4 PATHTOAPP I get:

Authority=Developer ID Application: MYAPPLEID Authority=Developer ID
Certification Authority Authority=Apple Root CA
Sealed Resources version=2

When I run it against the check-signature tool provided by Apple, I get a YES meaning it's correctly signed.

But when I run it against spctl -a -t exec -vv PATHTOAPP I get a:

rejected (embedded framework contains modified or invalid version)

And in the end, Gatekeeper rejects my app

Unfortunately the spctl utility doesn't give me a clue about what's wrong and where to look at. I don't get it, since codesign with the deepest and strictest flags says it's ok.

Any idea on how I can get more information ?

EDIT1: I ran spctl --assess --raw --verbose PATHTOAPP and I get this:

<key>assessment:authority</key>
<dict>
    <key>assessment:authority:flags</key>
    <integer>0</integer>
    <key>assessment:authority:source</key>
    <string>obsolete resource envelope</string>
    <key>assessment:authority:weak</key>
    <true/>
</dict>
<key>assessment:cserror</key>
<integer>-67009</integer>
<key>assessment:remote</key>
<true/>
<key>assessment:verdict</key>
<false/>

Now I don't know what to believe, is it "embedded framework contains modified or invalid version" or is it "obsolete resource envelope" (and why) ?

When I check error codes here: https://github.com/CamJN/Security/blob/77b26b3e434caec74403da43bcfb02532a25d7ff/libsecurity_codesigning/lib/CSCommon.h

I see:

errSecCSWeakResourceRules =         -67013, /* resource envelope is obsolete */
errSecCSBadFrameworkVersion =       -67009, /* embedded framework contains modified or invalid version */

EDIT2: It's really the contents of my Frameworks folder that is causing the problem. When I delete everything in-there before signing, it passes spctl validation.

The problem is, if I just let one single, pure Framework such as QtCore (from Qt 5.7.0) I immediatly gets the spctl error:

rejected (embedded framework contains modified or invalid version)

1
  • If you use macdeployqt, you can use the -codesign argument and have it sign the bundle for you. Commented Nov 15, 2016 at 9:23

1 Answer 1

2

Turns out the content of each framework missed the FRAMEWORK.framework/Versions/Current symlink

Required symlinks:

FRAMEWORK.framework/Resources
FRAMEWORK.framework/Versions/Current

Easy script to create thoses symlinks (while in the Frameworks folder):

find . -path '*.framework/Versions/[0-9]' -and -not -type l -print0 | while read -d $'\0' FRMPATH
    do
        ln -s ${FRMPATH/*framework\//}/Resources $FRMPATH/../../Resources
        ln -s ${FRMPATH/*Versions\//} $FRMPATH/../Current
    done

I also discovered a command that makes Gatekeeper accept self-signed certificate (useful when you don't have an Apple Developer ID but need to test against spctl):

spctl --add --requirement "certificate leaf[subject.CN] = \"MY CERTIFICATE\"" --label "MyCustomCertificate"

(where MY CERTIFICATE must be replaced with the name of your own, self-signed/self-generated certificate)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.