Mac App States "it is damaged" when trying to run

[keastrid]

I'm submitting a…

• bug report
• feature request
• other

Short description of the issue/suggestion:
App fails to open. Some googling implies that it is because it is modified after the signing process is done, though I don't know if that is the actual cause. I haven't tested signing the app packages with a dev key, nor have I determined if the fault lies in Actions' zipping of the app.

Steps to reproduce the issue/enhancement:

1. Download the app and try to open it

What is the expected behavior?
It would open normally.

What is the current behavior?
It doesn't open until you unquarantine it.

Please tell us about your environment:

• JavaPackager version:1.4.0-SNAPSHOT
• OS version:MacOS 10.15
• JDK version:15
• Build tool:
  • Maven
  • Gradle

Other information (e.g. related issues, suggestions how to fix, links for us to have context)
Example app: https://github.com/keastrid/astroimagej/actions/runs/339679738

[keastrid]

Turns out that Mac places it into quarantine and isn't explicit about that in its message. Not only signing but notarizing the app must be done for it to load without issue.

[fvarrui]

I have added a new property to specify the signing identity: macConfig.signingIdentity, but you must have an Apple Developer ID cert installed on your system to sign your app, and then notarize it. I'm not sure if last step can be automated. I must say that I'm not familiar with all this process.

[keastrid]

Managed to successfully sign and notarize it.
A couple things are missing by default in JavaPackager: passing an entitlements file to codesign. As for notarizing, it can be done with altool

[fvarrui]

Great! Could you give me an example, please?

[fvarrui]

I've seen that Gatekeeper can be disabled:

sudo spctl --master-disable

but for an end user this is not a good idea.

[keastrid]

xcrun altool --notarize-app --primary-bundle-id com.$APPROOT.dmg \ -p "@keychain:DEV_PASSWORD" -u "$DEV_ID" --file $APPROOT.dmg and once it finishes, xcrun stapler staple $APPROOT.dmg

[keastrid]

Notarizing can take several minutes, so having something to check in on it that it worked would be good.
Progress can be checked with xcrun altool -p \"@keychain:DEV_PASSWORD\" -u \"$DEV_ID\" --notarization-info RequestUUID

[fvarrui]

Thanks for the info!!!

I don't have an Apple Developer ID certificate and I suppose XCode has to be installed to do this ... I'm using Mac OS 10.12 on a virtual machine for testing and it don't let me install it from the App Store (only 10.15 or above), so I won't can test this functionality when implemented ... I'll have to implement it blindly 🤦‍♂️ What a mess!! 😅

[fvarrui]

I'm not sure if notarizing the app should be included in JavaPackager, but let's recap: if you have to do it with a BASH script ... do you think it looks like the next?

#!/bin/bash
# upload and notarize your app binary files with altool

DMG_PATH="/full/path/to/file.dmg"
APP_ID="com.full.path.to.file.dmg" # it has to start with "com."?
DEV_ID="My Apple Developer ID??"
DEV_PASSWORD="password|@keychain:secret|@env:secret"

# notarize the app
xcrun altool --notarize-app --primary-bundle-id $APP_ID -p "$DEV_PASSWORD" -u "$DEV_ID" --file $DMG_PATH

# attach notarization ticket to the app
xcrun stapler staple $DMG_PATH

# retrieves status
xcrun altool -p "$DEV_PASSWORD" -u "$DEV_ID" --notarization-info RequestUUID???

where does "RequestUUID" come from? Is it returned by the notarization command?

Last question: do you think that a generic entitlements file could be generated or it's better that it has to be provided by the developer? (or both possibilities can be contemplated)

Please, let me know if this is right.

Thanks so much!!!

[fvarrui]

I've just released v1.4.0 to Maven Central.

I've finally renamed macConfig.signingIdentifier as macConfig.developerId, and added macConfig.entitlements property to specify entitlements PList file, both optional and used when signing.

We'll discuss whether notarization should be part of JavaPackager or not.

Thanks a lot for your help!!!

[fvarrui]

I forgot it! PackageTask already has outputs.upToDateWhen { false } by default.

[keastrid]

Sorry for the delay.
RequestID is the output id from xcrun altool --notarize-app --primary-bundle-id com.$APPROOT.dmg \ -p "@keychain:DEV_PASSWORD" -u "$DEV_ID" --file $APPROOT.dmg

I think a generic entitlements file would be good. Speaking of entitlements, I get "can't set entitlements to null" when the file exists and gradle can find it. File enFile = file("${projectDir}/packageFiles/aij_entitlements.txt") if (enFile != null) { macConfig.entitlements = enFile }

As for notarizing, I am unsure as well.

Ah, if it sets upToDate already I can remove those.

[fvarrui]

RequestID is the output id from xcrun altool --notarize-app --primary-bundle-id com.$APPROOT.dmg \ -p "@keychain:DEV_PASSWORD" -u "$DEV_ID" --file $APPROOT.dmg

👍

I think a generic entitlements file would be good.

I'll take a look to see how It can be done.

Speaking of entitlements, I get "can't set entitlements to null" when the file exists and gradle can find it. File enFile = file("${projectDir}/packageFiles/aij_entitlements.txt") if (enFile != null) { macConfig.entitlements = enFile }

I'm not able to reproduce your issue. I've been testing with the next entitlements file and it's working fine:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>application-identifier</key>
    <string>io.github.fvarrui.helloworld.gradle</string>
</dict>
</plist>

Are you sure this is right?

File enFile = file("${projectDir}/packageFiles/aij_entitlements.txt")

I do it this way:

File enFile = project.file('packageFiles/aij_entitlements.txt')

As for notarizing, I am unsure as well.

I can try to add this functionality as something optional, which has to be enabled with a boolean property, but I need you to test it for me.

Ah, if it sets upToDate already I can remove those.

Yes!