Notarization issue: "b'ditto: Unknown compression type\\n'"

Question

Created Apr ’21

Replies 5

Boosts 0

Participants 2

We recently began including a password protected zip file in the Resources directory of our app, which is causing a notarization issue.

About the zip file -

developer@machine % file *.dat
ABC.dat: Zip archive data, at least v5.1 to extract

developer@machine % unzip ABC.dat
Archive: ABC.dat
skipping: files.zip need PK compat. v5.1 (can do v4.5)

Results from Catalina 10.15.7.

If we switch compression to PK compat v4.5 or below, will notarization still fail because the zip file is password protected? Or is changing the compression version enough to fix this issue?

I'm looking for general information about including zip files in applications distributed as a flat packages and the implications for notarization, but have not found anything yet.

Thanks!

Boost

Answer 1

DTS Engineer OP

Apple

Apr ’21

Does this cause a notarisation failure? Or is it just reported as a warning?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

gpp41 OP

Apr ’21

On closer inspection, it is only a warning, but our CI setup is expecting 'issues = null' in the notarization report, so we stopped there and did not attempt to continue wth the staple operation. Not sure how to proceed - try to continue past the warning or notarize the zip file separately (it rarely changes, so we could archive a notarized version). I've done more reading since my first post, it doesn't seem likely that a password protected zip file could be notarized successfully. However, if it's only a warning...

0

Answer 3

DTS Engineer OP

Apple

Apr ’21

It depends what’s in this encrypted zip archive. The standard reason for doing that it that you want the notary service to not see some code. For example, if your app includes an SDK that includes a Mach-O image, there’s no point having the notary service see that because you expect the user of that SDK to notarise that Mach-O image as part of their final product.

So, what are you doing with encrypted zip archives?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

gpp41 OP

Apr ’21

The zip file contains company-proprietary data that is necessary for the application to run. There are two files, each about 2Mb.

I will do some experimenting with the package that was generated with the warning to see if it is useable.

0

Answer 5

DTS Engineer OP

Apple

Apr ’21

The zip file contains company-proprietary data that is necessary for
the application to run.

If it’s just data then you can safely ignore this warning. The notary service only needs to ‘see’ your code.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0