Problem when notarize macOS application

[paulocoutinhox]

Hi,

When i try notarize my application on Apple i receive:

{
  "logFormatVersion": 1,
  "jobId": "2a011916-4a09-4077-b5dd-85aadb64d672",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "macos-x64.dmg",
  "uploadDate": "2021-06-22T03:57:52Z",
  "sha256": "b49f44a3ce73d443fde9ce6adce16220432e89ee628ec97abfd5b8803ad09a36",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "macos-x64.dmg/My App.app/Contents/MacOS/My App",
      "message": "The executable does not have the hardened runtime enabled.",
      "docUrl": null,
      "architecture": "x86_64"
    }
  ]
}

The executable is generating error message:

The executable does not have the hardened runtime enabled."

[paulocoutinhox]

I fixed it and now community have a sample about how to make a perfect application for windows, linux and macos with all configured.

• It work without flask
• It work with VUE 3 as GUI application (or any other since it is ready)
• It as deployment workflow
• It has a notarize script to check on apple for the executable

Problems:

• The only problem is find a way in windows to antivirus don't make false positive
• We need a way to "hide" GUI folder to be more "protected"

It is beautiful, see:
https://github.com/paulo-coutinho/pyinstaller-sample/releases/tag/1.0.0

[bwoodsend]

This is really nice. I notice the Linux binaries don't work but I'm sure that that's solvable. This is what I get if I try to run it:

> "/home/brenainn/Downloads/dist/My App/My App"
[pywebview] GTK cannot be loaded
Traceback (most recent call last):
  File "webview/guilib.py", line 16, in import_gtk
  File "PyInstaller/loader/pyimod03_importers.py", line 540, in exec_module
  File "webview/platforms/gtk.py", line 25, in <module>
ModuleNotFoundError: No module named 'gi'
[pywebview] QT cannot be loaded
Traceback (most recent call last):
  File "webview/guilib.py", line 29, in import_qt
  File "PyInstaller/loader/pyimod03_importers.py", line 540, in exec_module
  File "webview/platforms/qt.py", line 29, in <module>
ModuleNotFoundError: No module named 'PyQt5'
Traceback (most recent call last):
  File "main.py", line 47, in <module>
  File "webview/__init__.py", line 96, in start
  File "webview/guilib.py", line 93, in initialize
webview.util.WebViewException: You must have either QT or GTK with Python extensions installed in order to use pywebview.
[166018] Failed to execute script main

As of #5581 (which admittedly isn't released), PyInstaller has its own codesigning options so hopefully the need for these DIY macOS codesign recipes should go. I'm curious - which codesign certificate provider did you go for? Or more to the point, can you get away with using one of the less official but considerably cheaper providers like certum instead of the official Apple developer program?

Given that your noterize.py is completely self contained, I'd be tempted to put it in either its own repository or a gist with some basic documentation so that any project can simply run in a workflow (or anywhere really):

wget https://github.com/paulo-coutinho/pyinstaller-sample/raw/1.0.0/notarize.py
python notarize.py

[danyeaw]

We also have Notarizing working with Gaphor if someone wants to see an example GitHub Action to sign the .app and then sign the .dmg:
https://github.com/gaphor/gaphor/blob/master/.github/workflows/build.yml

[paulocoutinhox]

Hi @bwoodsend,

Maybe on Linux you need:

sudo apt install python-gi python-gi-cairo python3-gi python3-gi-cairo gir1.2-gtk-3.0 gir1.2-webkit2-4.0

I have my own certificates, since im Apple and Google Developer.

I make the scripts for codesign and notarize, and can be used for free without problems. I have problems with default codesign and deep sign.

[paulocoutinhox]

Hi @danyeaw,

It don't work for me, because devbotsxyz/xcode-notarize don't let select company and i have 3 in my account, because this i made my own script.

Thanks.