I'm trying to sign a .app package coming from Py2app. Unfortunately I keep running into the same two issues:
The binary is not signed with a valid Developer ID certificate.
and
The signature does not include a secure timestamp.
I tried everything, from recreating the signatures, with different arguments, different keys and certificates, but it keeps complaining with these two errors on a long list of files.
For reference I added the python script I use for signing the files.
I have a few resources to share with you:
- Placing content in a bundle explains how bundles should be structured.
- Creating distribution-signed code for macOS and Packaging Mac software for distribution explain how to manually sign code.
- Embedding nonstandard code structures in a bundle offers advice on how to deal with non-Apple code structures, like the ones used by Python.
You have a couple of choices here:
- You can strictly follow the rules in Placing content in a bundle, which is a bunch of extra work right now but will likely work better in the long term.
- You can bend those rules by simply signing your code as it’s currently structured.
Based on the script you included, it looks like you’re attempting the second approach. It’s likely you’ll be able to make that work, but that script will need significant enhancement. For example, Creating distribution-signed code for macOS explains that you need to sign code from the inside out from a dependency perspective, and your script is doing it from a file system hierarchy perspective.
Can you share a copy of your app here? I’m talking about the .app bundle prior to you running your script over it. I’d like to get a better handle on what py2app is doing these days.
If not, that’s cool. At some point I’ll find the time to play around with py2app myself.
If so, you’ll need to upload it to a file sharing service and post a link. Post that link in the clear, per tip 14 of Quinn’s Top Ten DevForums Tips.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"