CODEWITHSUNDEEP
macoscodesigncode-signing-certificatecode-signing-entitlements
laocius
laocius

Reputation: 842

notarize java app for distribution on mac app store

I have an app that has jvm built in. I tried to upload it to apple for notarization, but I was getting the binary is not signed errors

severity    "error"
code    null
path    "Myapp.dmg/Myapp.app/Contents/Resources/javafx-media-11-mac.jar/libfxplugins.dylib"
message "The binary is not signed."
docUrl  null
architecture    "x86_64"

I had already signed Myapp.app and also signed Myapp.dmg with --deep & --options runtime I also tried signing all files in my app folder with find Myapp.app -exec codesign -f -s $MYDEVELOPERID --deep --options runtime {} \;, but still didn't work.

Note that the file path I got from the error is inside the jar file. I already signed the jar file. Do I also need to unpack the jar file and sign every single file and repack it? It would be too trivial!

Upvotes: 1

Views: 1720

Answers (1)

tresf
tresf

Reputation: 7922

also signed Myapp.dmg with --deep & --options runtime

It would appear --deep isn't yet coded to traverse inside JAR files.

I already signed the jar file. Do I also need to unpack the jar file and sign every single file and repack it?

Yes. The bundled .dylib, .jnilib (and likely .so's) need to be individually signed. If they're provided by a 3rd party from within a JAR you will need to extract, sign and then re-bundle the JAR file.

In your case, the JavaFX is no longer bundled with the Java 11 Runtime, so it's the JavaFX JAR that you're bundling that you'll need to extract, sign and re-zip.

This process is spelled out (generically) here: https://stackoverflow.com/a/53528020/3196753. There's also a link to an ANT-specific code here but each build will need very specific code so it's only provided as a reference point of a working, notarized build.

For example, in the above ANT example, the PowerPC binaries needed to be stripped out by hand. Many projects still provide PowerPC binaries, but the notarization will fail if they're part of the distribution.

One would think the owness of signing these .dylib files should be on the provider of the JAR but I've found nothing about allowing mixed signers in projects in any of Apple's documentation.

Upvotes: 2

Related Questions