[mac] Invalid signature crash on runtime

[saghul]

• Version: 10.7.0

• Target: mac

Hi! I'm getting a runtime crash when starting my app after (apparently correctly) signing it for distribution outside of the store.

The signing process seems to work fine:

Packaging for darwin x64 using electron 1.4.12 to dist-electron/mac
Signing app (identity: Developer ID Application: AG Projects)

But when running the resulting app:

Exception Type:        EXC_CRASH (Code Signature Invalid)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

It seems to be correctly signed though:

codesign --verify --verbose /Applications/Sylk.app/
/Applications/Sylk.app/: valid on disk
/Applications/Sylk.app/: satisfies its Designated Requirement

spctl --assess --type execute --verbose --ignore-cache /Applications/Sylk.app
/Applications/Sylk.app: accepted
override=security disabled

All I did was to update all packages (I made no other changes to my system, that I remember) and browsed the tracker but looks like the problem should be gone :-S

Any hints would be appreciated. ❤️

[develar]

Works for me. Please set env DEBUG=electron-builder,electron-osx-sign

[develar]

And please try to update Xcode to latest version.

[saghul]

Hi @develar thanks for the prompt response! I'm running latest Xcode 8.2 (8C38) but the outcome is the same. Here is the output: https://gist.github.com/saghul/947d6dca836aeba3e2136e8e4dbb647b

Thanks!

[develar]

Cc @sethlu

Do you use custom entitlements?

[saghul]

Yes, I do: https://gist.github.com/saghul/71cd6e978ffc5d43bc4e17ce47dade19

[sethlu]

Hi @saghul! A quick fix to your current issue is to remove the entitlements regarding sandbox in your entitlements file (because it's not necessary for a darwin distribution outside the Mac App Store). However, if you would like to to keep the entitlements about enabling app sandbox, I would recommend placing a copy of your provisioning profile (for distribution outside the Mac App Store) under the current working directory where you call electron-osx-sign and have it embedded in the app bundle while signing.

[saghul]

That worked, thanks! So, if an app has a sandbox entitlement is the provisioning profile required then? If that is the case, maybe electron-builder could look for that and given an error perhaps? At any rate, thanks a lot! ❤️

[sethlu]

@saghul no worries. 😸 And yes, (with electron-osx-sign) if entitlements keys on app sandbox are included it is necessary to have provisioning profiles regarding recent changes of Electron earlier this summer.

[sethlu]

@saghul @develar regarding signing with provisioning profile, @elvis-epx and I are having a discussion at electron/osx-sign#102.

[saghul]

@sethlu Thanks for the explanation, much appreciated.