Getting "code object is not signed at all In architecture: x86_64" errors

Question

Created Nov ’19

Replies 1

Boosts 0

Views 5.6k

Participants 2

We're trying to submit our desktop app for gallery making "jAlbum" to the AppStore. However, after submitting our app, we eventually receive an email reply with errors messages we don't understand how to work around. Apple has directed us here for support:

Dear Developer,

We identified one or more issues with a recent delivery for your app, "jAlbum" 19.1 (19.1). Please correct the following issues, then upload again.

ITMS-90238: Invalid Signature - The executable at path jAlbum.app/Contents/Java/lib/libjcocoa.dylib has following signing error(s): code object is not signed at all In architecture: x86_64 . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.htmland Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html for more information.

ITMS-90238: Invalid Signature - The executable at path jAlbum.app/Contents/runtime/Contents/Home/lib/libawt.dylib has following signing error(s): code object is not signed at all In architecture: x86_64 . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.htmland Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html for more information.

ITMS-90238: Invalid Signature - The executable at path jAlbum.app/Contents/runtime/Contents/Home/lib/libawt_lwawt.dylib has following signing error(s): code object is not signed at all In architecture: x86_64 . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.htmland Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html for more information.

...

That list goes on with the same errors for around 40 items. As this is a Java based app we don't develop within XCode. We instead rely on Apple's command line tools to package and sign the code. We have downloaded the certificates (developer, application and installer certs) from the Developer Center. Here's how we sign and package our app. What are we doing wrong?

codesign -a x86_64 --entitlements Entitlements.plist -s "3rd Party Mac Developer Application: Jalbum AB" -f jAlbum.app/Contents/runtime/Contents/Home/lib/jspawnhelper

codesign --deep -a x86_64 -s "3rd Party Mac Developer Application: Jalbum AB" -f jAlbum.app/Contents/runtime/

codesign -a x86_64 -s "3rd Party Mac Developer Application: Jalbum AB" -f jAlbum.app/Contents/MacOS/libapplauncher.dylib

codesign -a x86_64 --entitlements Entitlements.plist -s "3rd Party Mac Developer Application: Jalbum AB" -f jAlbum.app

echo "Creating pkg"

productbuild --sign "3rd Party Mac Developer Installer: Jalbum AB (TQ748SBU4V)" --component jAlbum.app /Applications jAlbum.pkg

Boost

Answer 1

DTS Engineer OP

Apple

Nov ’19

The problem here is that you’re signing with

--deep

but you’re not following the nested code rules described in the Nested Code section of Technote 2206 macOS Code Signing In Depth. Thus, chunks of your app are not being signed and, unsurprisingly, the Mac App Store requires that all your code be signed.

As to how to fix this, my recommendation is that you escalate this via the support resources for the third-party tools you’re using. My experience is that most of them have concrete advice on how to package their tools for submission to the Mac App Store.

Failing that, you have two basic strategies available to you:

Sign your code manually, from the inside out.
Restructure your code so that code is nested it valid code nesting sites. If necessary, you can use symlinks to preserve the hierarchy required by your third-party tools.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0