I signed my application,but auto-updater output 'did not pass validation'

[w88975]

same as this issue: #905

I use the Developer ID Application: Company (XXXXXXXXXX) to sign my app.

• like this:

codesign --verbose --force --sign "Developer ID Application: Company (XXXXXXXXXX)" /Users/kamisama/work/fireball/dev/dist/Fireball.app/Contents/MacOS/Fireball 

terminal output log:

$codesign --verbose --deep --force --sign "Developer ID Application: Nan Wang (SM763GNPZ6)" /Users/kamisama/work/fireball/dev/dist/Fireball.app 
/Users/kamisama/work/fireball/dev/dist/Fireball.app: replacing existing signature
/Users/kamisama/work/fireball/dev/dist/Fireball.app: signed bundle with Mach-O thin (x86_64) [com.fireball-x.fireball]

then I used autoUpdater.checkForUpdates(); to download the Fireball.zip.

but the console output this log:

I also found something interesting。

When I do checkForUpdates();,
the folder Users/kamisama/Library/Application%20Support/com.github.atom.ShipIt/update.Im2trlv/ will download file > Fireball.zip

When a software error, the Users/kamisama/Library/Application%20Support/com.github.atom.ShipIt/update.Im2trlv/ will be delete.

[zcbenz]

According to the error there is something wrong with your signature, I have pushed a change to print more detailed errors, once it gets released we will have better knowledge of it.

[zcbenz]

@w88975 Can you try if the latest release of atom-shell gives meaningful error?

[zcbenz]

I'm closing this until there is more information provided.

[rishson]

Hi @zcbenz, I am also experiencing this behaviour. I'm on Atom-shell 0.23.0, but don't seem to be getting any 'extra' debug info for the failure reason.

My build seems OK, with the signing passing and being verified:

dist/atom-shell/xxxxx.app: signed bundle with Mach-O thin (x86_64) [com.xxxxx.xxxxx]
dist/atom-shell/xxxxx.app/Contents/MacOS/xxxxx: replacing existing signature
dist/atom-shell/xxxxx.app/Contents/MacOS/xxxxx: signed bundle with Mach-O thin (x86_64) [com.xxxxx.xxxxx]
dist/atom-shell/xxxxx.app/Contents/MacOS/xxxxx: valid on disk
dist/atom-shell/xxxxx.app/Contents/MacOS/xxxxx: satisfies its Designated Requirement

When I run auto-update, the download works fine but then I get the following in autoupdater.on('error')

Code signature at URL file:///var/root/Library/Application%20Support/com.xxxxx.xxxxx.ShipIt/update.UdQiF6a/xxxxx.app/ did not pass validation

Should there be more error info after your fix?

If it makes any difference, I'm still in dev so the cert I am using is self signed and I don't yet package up my app into an asar - its just the exploded app dir copied into Resources.

[zcbenz]

@rishson That error message is all we can get from Squirrel, it is possible that your way of code signing is not correct, I think you can do code sign by following the links in #1396.

[Krishnaraj-shankar]

Error: Code signature at URL file:///Users/krishna-pt5814/Library/Caches/com.Krishnaraj.autoupdater.ShipIt/update.Homm8pL/Autoupdater%20app.app/ did not pass validation: code has no resources but signature indicates they must be present

getting this error while the autoupdater downloads the updated version