Notarization started failing "Embedded entitlements are invalid"

Question

Created Oct ’20

Replies 2

Boosts 0

Participants 2

Notarization on our application has started failing due to Embedded entitlements are invalid: syntax error near line 1 suddenly last week, even though we've been using the same scripts for a while now.

This is a Java App so has the following entitlements added during codesigining to allow the JVM to run:

Code Block <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
</dict>
</plist>

I've tried the recommendation to run the following which returned OK, showing the formatting on the entitlements is likely not the issue.

Code Block plutil -lint <Project_Name.entitlements>

Has anything changed with the notarization checks with regards to entitlement checks recently? Are some of these entitlements no longer allowed?

Notarization info from our most recent run:

jobId: c3cf9af6-c458-4307-b28c-5fa86df35b04
uploadDate: 2020-10-19T08:22:35Z

Boost

Answer 1

DTS Engineer OP

Apple

Oct ’20

Accepted Answer

This problem is usually the result of a formatting error within your entitlements. This won’t necessarily be picked up by plutil because the file is a valid property list it’s just the entitlement system is pickier. Try using plutil to convert the entitlements file as described in the Ensure Properly Formatted Entitlements section of Resolving Common Notarization Issues.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

1

Answer 2

jsimmondsIDBS OP

Oct ’20

@eskimo Thanks for the response

I had actually tried that already, but looks like the problem was when I would download it on my Windows machine to commit to the Git repo from our Mac build machine the files line endings would end up as CRLF. Forcing it to LF via the .gitattributes file has resolved this now

Code Block *.entitlements text eol=lf

0