fix: codesign doesn't sign frameworks or sidecar, closes #7690 #7774

tr3ysmith · 2023-09-07T14:47:18Z

What kind of change does this PR introduce?

Codesigning on Mac requires Frameworks and embedded binaries to be signed from the inside out, this change removes the --deep command on the code signing and individually signs sidecar and frameworks, then the app package

Does this PR introduce a breaking change?

Yes, and the changes were approved in issue #___
[X ] No

Checklist

When resolving issues, they are referenced in the PR's title (e.g fix: remove a typo, closes #___, #___)
A change file is added if any packages will require a version bump due to this PR per the instructions in the readme.
I have added a convincing reason for adding this feature, if necessary

Other information

#7690

lucasfernog · 2023-09-15T13:09:49Z

@tr3ysmith I pushed some changes and it looks nice, but I can't get the framework signature to be approved by the Apple notarization. I'm using our updater integration test to validate it, if you want to run it too, simply configure your signing/notarization environment variables and run cargo test --test '*' -- --ignored in the root of the repository.

notarytool log $ID -key-id $keyId --key $keyPath --issuer $keyIssuer output:

{
  "logFormatVersion": 1,
  "jobId": "$ID",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "app-updater.zip",
  "uploadDate": "2023-09-15T13:06:58.269Z",
  "sha256": "...",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "app-updater.zip/app-updater.app/Contents/MacOS/app-updater",
      "message": "The signature of the binary is invalid.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735",
      "architecture": "arm64"
    }
  ]
}

codesign -vvv --deep --strict target/debug/bundle/macos/app-updater.app/Contents/MacOS/app-updater output:

--prepared:.../target/debug/bundle/macos/app-updater.app/Contents/Frameworks/test.framework
--validated:.../target/debug/bundle/macos/app-updater.app/Contents/Frameworks/test.framework
target/debug/bundle/macos/app-updater.app/Contents/MacOS/app-updater: embedded framework contains modified or invalid version
In subcomponent: .../target/debug/bundle/macos/app-updater.app/Contents/Frameworks/test.framework

tr3ysmith · 2023-09-15T13:21:28Z

@lucasfernog thats bizarre, running the test now and I'm getting all passes, but when I run codesign verification, I'm getting

app-updater: code has no resources but signature indicates they must be present

tr3ysmith · 2023-09-15T13:23:41Z

@lucasfernog this is my test output

$ cargo test --test '*' -- --ignored                                        
    Finished test [unoptimized + debuginfo] target(s) in 0.50s
     Running tests/update.rs (target/debug/deps/update-470349cf2ab872b3)

running 1 test
     Running [tauri_cli] Command `cargo  build --features custom-protocol`
   Compiling app-updater v0.1.0 (/Users/tr3ysmith/Code/tauri/core/tests/app-updater)
    Finished dev [unoptimized + debuginfo] target(s) in 3.13s
    Bundling [tauri_bundler::bundle::macos::app] app-updater.app (/Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app)
    Bundling [tauri_bundler::bundle::updater_bundle] /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz (/Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz)
    Finished [tauri_bundler::bundle] 1 bundle at:
        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app
        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz (updater)

    Finished [tauri_cli::build] 1 updater signature at:
        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz.sig

     Running [tauri_cli] Command `cargo  build --features custom-protocol`
   Compiling app-updater v0.1.0 (/Users/tr3ysmith/Code/tauri/core/tests/app-updater)
    Finished dev [unoptimized + debuginfo] target(s) in 1.52s
        Warn [tauri_cli::build] The updater is enabled but the bundle target list does not contain `updater`, so the updater artifacts won't be generated.
    Bundling [tauri_bundler::bundle::macos::app] app-updater.app (/Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app)
    Finished [tauri_bundler::bundle] 1 bundle at:
        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app
        ```

lucasfernog · 2023-09-15T13:28:19Z

@lucasfernog this is my test output


$ cargo test --test '*' -- --ignored                                        

    Finished test [unoptimized + debuginfo] target(s) in 0.50s

     Running tests/update.rs (target/debug/deps/update-470349cf2ab872b3)



running 1 test

     Running [tauri_cli] Command `cargo  build --features custom-protocol`

   Compiling app-updater v0.1.0 (/Users/tr3ysmith/Code/tauri/core/tests/app-updater)

    Finished dev [unoptimized + debuginfo] target(s) in 3.13s

    Bundling [tauri_bundler::bundle::macos::app] app-updater.app (/Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app)

    Bundling [tauri_bundler::bundle::updater_bundle] /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz (/Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz)

    Finished [tauri_bundler::bundle] 1 bundle at:

        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app

        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz (updater)



    Finished [tauri_cli::build] 1 updater signature at:

        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app.tar.gz.sig



     Running [tauri_cli] Command `cargo  build --features custom-protocol`

   Compiling app-updater v0.1.0 (/Users/tr3ysmith/Code/tauri/core/tests/app-updater)

    Finished dev [unoptimized + debuginfo] target(s) in 1.52s

        Warn [tauri_cli::build] The updater is enabled but the bundle target list does not contain `updater`, so the updater artifacts won't be generated.

    Bundling [tauri_bundler::bundle::macos::app] app-updater.app (/Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app)

    Finished [tauri_bundler::bundle] 1 bundle at:

        /Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app

        ```

There's no signing output here. The app id doesn't matter I think, if it does just change it to something else.

tr3ysmith · 2023-09-15T13:29:17Z

@lucasfernog my bad, I forgot to set environment variables so I could use my developer account to codesign/notarize, just added that, and now I'm seeing this:

/Users/tr3ysmith/Code/tauri/target/debug/bundle/macos/app-updater.app/Contents/Frameworks/test.framework: the main executable or Info.plist must be a regular file (no symlinks, etc.)

tr3ysmith · 2023-09-15T13:36:37Z

@lucasfernog I just ran the same codesign function directly on that test.framework and then also on another framework I have in another project, and its definitely a problem with that test.framework. I wonder if it got stripped somehow of its correct signature.

lucasfernog · 2023-09-15T13:47:30Z

I imagined it was a problem with that test framework, maybe the bundle format is wrong or something.

Btw running the "same command" isn't a good test here, we need to make sure the whole bundling process is working with codesign and notarize.

tr3ysmith · 2023-09-15T13:48:34Z

@lucasfernog I just created a fresh test framework and it seems to have worked, I'm going to push it up to this pull request now

…/tauri into framework-codesign-mac

tr3ysmith · 2023-09-15T13:53:50Z

@lucasfernog let me know if this fixes it for you

lucasfernog · 2023-09-15T13:55:38Z

I'll try it as soon as I get home, thank you!

lucasfernog · 2023-09-15T14:29:49Z

@tr3ysmith

Running [tauri_bundler::bundle::common] Command `codesign  --force -s IDENTITY -vvv target/debug/bundle/macos/app-updater.app/Contents/Frameworks/test.framework`
target/debug/bundle/macos/app-updater.app/Contents/Frameworks/test.framework: bundle format is ambiguous (could be app or framework)

Maybe symlinks are behaving a little weird when you push and I pull?

tr3ysmith · 2023-09-15T14:52:21Z

@lucasfernog if you try doing it on the framework inside the test folder, does it still do the same thing? ./core/tests/app-updater/frameworks

lucasfernog · 2023-09-15T14:52:54Z

Also would be nice if you could set up commit signing, it's a requirement on our repos 😻

tr3ysmith · 2023-09-15T14:54:54Z

Also would be nice if you could set up commit signing, it's a requirement on our repos 😻

Sorry! I had not realized that wasn't enabled on my end, fixed!

(tauri-apps#7774) Co-authored-by: Lucas Nogueira <lucas@tauri.app>

Co-authored-by: Lucas Nogueira <lucas@tauri.app> Co-authored-by: Lucas Fernandes Nogueira <lucas@tauri.studio> fix: codesign doesn't sign frameworks or sidecar, closes #7690 (#7774)

Port of tauri-apps/tauri#7774 Co-authored-by: Trey Smith <trey@fulcrum-acoustic.com> Co-authored-by: Lucas Nogueira <lucas@tauri.app>

* fix: code sign frameworks and binaries Port of tauri-apps/tauri#7774 Co-authored-by: Trey Smith <trey@fulcrum-acoustic.com> Co-authored-by: Lucas Nogueira <lucas@tauri.app> * fix: create target binary directory before copying * chore: update error doc * fix: apply suggestion Co-authored-by: Amr Bashir <amr@crabnebula.dev> --------- Co-authored-by: Trey Smith <trey@fulcrum-acoustic.com> Co-authored-by: Lucas Nogueira <lucas@tauri.app> Co-authored-by: Amr Bashir <amr@crabnebula.dev>

sign frameworks and sidecar

d806999

tr3ysmith requested a review from a team as a code owner September 7, 2023 14:47

tr3ysmith mentioned this pull request Sep 7, 2023

fix: MacOS Frameworks not signed, closes #7690 and #7710 #7691

Closed

13 tasks

Merge branch '1.x' into framework-codesign-mac

025f21d

afonsojramos approved these changes Sep 15, 2023

View reviewed changes

lucasfernog added 4 commits September 15, 2023 09:15

cleanup code, fix bin paths

ac5ac05

change file

3f49a7e

fix extension check

8e73f16

remove to_string call

e5ad80d

tr3ysmith added 3 commits September 15, 2023 09:51

new framework

1ddf2f5

Merge branch 'framework-codesign-mac' of https://github.com/tr3ysmith…

0af67f0

…/tauri into framework-codesign-mac

Merge branch '1.x' into framework-codesign-mac

b14df73

remove test symlink

a3c54c8

lucasfernog approved these changes Sep 15, 2023

View reviewed changes

lucasfernog merged commit dcdbe3e into tauri-apps:1.x Sep 15, 2023
23 checks passed

tr3ysmith added a commit to tr3ysmith/tauri that referenced this pull request Sep 15, 2023

fix: codesign doesn't sign frameworks or sidecar, closes tauri-apps#7690

19f3b9c

(tauri-apps#7774) Co-authored-by: Lucas Nogueira <lucas@tauri.app>

jason-crabnebula mentioned this pull request Oct 19, 2023

fix(codesign): code signing frameworks and binaries on macOS crabnebula-dev/cargo-packager#54

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: codesign doesn't sign frameworks or sidecar, closes #7690 #7774

fix: codesign doesn't sign frameworks or sidecar, closes #7690 #7774

tr3ysmith commented Sep 7, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

fix: codesign doesn't sign frameworks or sidecar, closes #7690 #7774

fix: codesign doesn't sign frameworks or sidecar, closes #7690 #7774

Conversation

tr3ysmith commented Sep 7, 2023

What kind of change does this PR introduce?

Does this PR introduce a breaking change?

Checklist

Other information

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023

lucasfernog commented Sep 15, 2023

tr3ysmith commented Sep 15, 2023