Mac OS X code signed app gets 'not from identified developer' error

[Martin Koob]

I had set up code signing with GLX Application framework for my Mac OS X app.  It was working but now people are saying they get a message that the app is not from an identified developer.

I had renewed my Apple Developer account and had not downloaded the updated certificates so I thought that was the issue so I downloaded those and installed them.

In the Configure GLX application palette I have the certificate name in the 'Sign with Certificate Named' field as I had before.

So I assume that GLX is automatically signing the application.

I checked an app built with GLX application packager with the command line '

sudo spctl -a -v /path/to/my/application.app

The result I get is 

/path/to/my/application.app

accepted

source=Developer ID

So it would seem from this end that my application is signed.

For development I am using OSX 10.8.5, LC 6.7.3. and have  XCode 4.6.1 installed.  I have installed the xCode Command line tools.

One of the users who have reported that the app is not from an identified developer is running Yosemite.

So here are my questions:

1. Does GLX Application Packager automatically sign the application using the certificate named in the Configure GLX Application or do I have to sign manually after building using the command line:

codesign -s "Developer ID Application: My Company" /Path/To/My/Application.app

2. Is there something I have to do in the Configure GLX Application Palette to refresh the certificate to use the newly downloaded and installed certificate?

3. Is it an issue with the version of Xcode I am using?   Do I need to update to a more recent version?  If I do will that cause issues for apps on OS X 10.8? 

Thanks

Martin Koob

[Martin Koob]

I have tried opening the App on Yosemite and running the command line

sudo spctl -a -v /path/to/my/application.app

The result I get is 

/path/to/my/application.app:  rejected

source=obsolete resource envelope

So I guess the issue is the older version of X Code I am using.

So If I update to Xcode 6.2 and sign the app will it still open in Mac OS X 10.8 and Mac OS X 10.9 with the newer resource envelope?

Martin

[Martin Koob]

I think I have found the answer so I will document here incase someone else runs into this.

Here is a post that explains the issue I am having.

http://stackoverflow.com/questions/25152451/are-mac-app-store-code-sign-resource-envelopes-always-version-1

According the the post above the issue is that I am signing using Mac OS X 10.8.5 so that creates a version 1 envelope which is not compatible with Mavericks or later.  I have to sign when running Mavericks or later which creates a version 2 envelope.  It says the version 2 envelopes are compatible with older versions of Mac OS X.

Martin Koob

On Wednesday, April 1, 2015 at 9:57:54 AM UTC-4, Martin Koob wrote:

[Martin Koob]

Not out of the woods yet…

I am trying to code sign on Yosemite.

I have downloaded Xcode 6.2 imported my account from 4.6.1 set up my account with the developer id but now get an error message

 code object is not signed at all

In subcomponent: /path/to/my/application.app/Contents/MacOS/components/application.dat

I tried building it again and got the same error indicating a different file.

 code object is not signed at all

In subcomponent: /path/to/my/application.app/Contents/MacOS/revsecurity.dylib

I think it is trying to sign the components in the app bundle but is not succeeding.

Is there something else I have to do to code sign with GLX on Yosemite?

thanks

Martin

[Trevor DeVore]

Martin,

Code signing has become trickier :-)

As you have already discovered, you have to code sign on newer versions of OS X. I'm attaching the latest application packager that I have. There is a checkbox added that is labeled "Use Resources/_MacOS folder. You should check this box if you are building with 6.7 or later as LiveCode moves all non-executable files into this ./Resources_MacOS folder so that Apple will be happy. Try packaging and signing using the attached stack and let me know if you have better luck.

-- 

Trevor DeVore

ScreenSteps

www.screensteps.com    -    www.clarify-it.com

--
You received this message because you are subscribed to the Google Groups "GLX Application Framework" group.
To unsubscribe from this group and stop receiving emails from it, send an email to glxapp+un...@googlegroups.com.
To post to this group, send email to glx...@googlegroups.com.
Visit this group at http://groups.google.com/group/glxapp.
For more options, visit https://groups.google.com/d/optout.

[Martin Koob]

Hi Trevor

Thanks for responding so quickly.

I tried using the updated packager but still get an error albeit a different one.

The project was saved by LC 6.7.3 on Mac OS X 10.8.5, I opened the application.dat file with GLX Application Packager - Version 1.1.1 build 4 in LC 6.7.3 and Mac OSX 10.10.1

I have included the info from the log field in GLX application packager and the output to the message box.  

(I replaced my application path with the '/path/to/my/application.app' path that you use in your docs.)

------------------------------

Build usiing GLX Application Packager - Version 1.1.1 build 4

in LC 6.7.3 and Mac OSX 10.10.1

GLX Application Packager stack LOG field

codesign --verbose --force -s "Developer ID Application: My Name" "/path/to/my/application.app/Contents/MacOS/components/externals/mergAV.bundle"

codesign --verbose --force -s "Developer ID Application: My Name  "/path/to/my/application.app/Contents/MacOS/components/externals/mergAWS.bundle"

codesign --verbose --force -s "Developer ID Application: My Name" "/path/to/my/application.app/Contents/MacOS/components/externals/mergJSON.bundle"

codesign --verbose --force -s "Developer ID Application: My Name  "/path/to/my/application.app/Contents/MacOS/components/externals/preferences.bundle"

codesign --verbose --force -s "Developer ID Application: My Name  "/path/to/my/application.app/Contents/MacOS/components/externals/revvideograbber.bundle"

LiveCode Message box output

builds/path/to/my/application.app/Contents/MacOS/components/externals/revvideograbber.bundle"

button id 1022 of card id 1002 of stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",mouseUp,5

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",PackageApplicationForDesktop,328

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",ReplaceVariablesAndRunScripts,2396

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",signAndStrip,2514

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",findBundlesAndStripExecutables,2616

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",findBundlesAndStripExecutables,2616

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",findBundlesAndStripExecutables,2610

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",signAndStrip,2520

stack "/Users/martinkoob/Documents/GLX updates/glxApplicationPackager.rev",_signFile,2551

Error dialog

the message in the error dialog was

Error occurred: code sign process failed

/path/to/my/application.app/Contents/MacOS/components/externals/revvideograbber.bundle:

unsealed contents present in the bundle root

----------------------------------------

Hope you can see something here.

Martin

[Trevor DeVore]

On Wed, Apr 1, 2015 at 2:19 PM, Martin Koob <in...@videolinkwell.com> wrote:

Error dialog

the message in the error dialog was

Error occurred: code sign process failed

/path/to/my/application.app/Contents/MacOS/components/externals/revvideograbber.bundle:

unsealed contents present in the bundle root

----------------------------------------

Hope you can see something here.

I don't think code sign likes the Manifest file in the revvideograbber.bundle package. Try getting rid of that and see if it works.

[Martin Koob]

Removing the manifest file did the trick.

I also had to remove it from the revxml.bundle to get it to complete the code signing process successfully.

Could there be any issues created by removing the manifest file from the revvideograbber.bundle and revxml.bundle file?

I did a quick test of the application signed on 10.10 Yosemite (opening it on 10.10 Yosemite and 10.8 Mountain Lion) and it opened as expected.   There were no issues with the video capture nor with opening and saving xml files so hopefully that means removing the manifest file did not create an issue.  I guess it is like an appendix. :-)

Martin

[Trevor DeVore]

Removing the manifest file won't cause any problems. I remember removing them from the externals I use in my apps and I haven't had any problems.

-- 

Trevor DeVore

ScreenSteps

www.screensteps.com    -    www.clarify-it.com

--

[Martin Koob]

OK thanks Trevor for your help with this.

Martin

[Trevor DeVore]

You're welcome Martin.

-- 

Trevor DeVore

ScreenSteps

www.screensteps.com    -    www.clarify-it.com

On Wed, Apr 1, 2015 at 2:54 PM, Martin Koob <in...@videolinkwell.com> wrote:

OK thanks Trevor for your help with this.

Martin

[Martin Koob]

Hi

I am having the same problem again with my app not being signed.

The error message on signing is 

Error occurred:  coding process failed:

"/Users/martinkoob/path/to/my/app/MacOS/VideoLinkwell.app/Contents/MacOS/components/externals/revbrowser.bundle":

unsealed contents present in bundle root.

The contents of the message box is the following.

codesign --verbose --force -s "Developer ID Application: Martin Koob" "/Users/martinkoob/path/to/my/app/MacOS/VideoLinkwell.app/Contents/MacOS/components/externals/revbrowser.bundle"

button id 1022 of card id 1002 of stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",mouseUp,5

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",PackageApplicationForDesktop,328

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",ReplaceVariablesAndRunScripts,2396

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",signAndStrip,2514

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",findBundlesAndStripExecutables,2616

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",findBundlesAndStripExecutables,2616

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",findBundlesAndStripExecutables,2610

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",signAndStrip,2520

stack "/Users/martinkoob/Documents/Developer/GLX updates/glxApplicationPackager.rev",_signFile,2551

I am using the newer glx application packager stack with Use Resources/_MacOS folder.  I tried the suggestions earlier in this thread like removing the manifest file.  I also tried to sign the executable revbrowser  revbrowser.bundle/Contents/MacOS/revbrowser in the terminal as I think I had to do that earlier for other bundles I added.  

Not of that has helped.   Any suggestions as to what the unsealed contents in the bundle are and how to seal them?

Thanks.

Martin

[Martin Koob]

OK seem to have worked it out.

I was building the installer replacing the one that I had built earlier that generated the error.

I removed the old build and started fresh and the new app built properly.

I am not sure if it was removing the manifest file or signing the revbrower unix executable that helped.   I suspect that it was the manifest.

Martin