osx-sign: App does not launch after sign - macOS 10.14.5 (Code Signature Invalid)

While you are trying with the asar unpack things… I think it may be nice to summarize the discussion above:

• For distribution inside the Mac App Store
  • App sandbox required
  • No need for notarization (probably just don’t bother doing this) – the app review process will check for the suspicious code, so there’s no need to check that manually again
• For distribution outside the Mac App Store
  • App sandbox not required (probably just don’t bother doing this)
  • Notarization required (therefore hardened runtime as a requirement) – this checks for suspicious code (link to Apple documentation)
    • Since we’re in hardened runtime, there are exception entitlements we need to add for Electron, otherwise the app will break upon launch (note: no need to include the app sandbox entitlement entries if you’re not making thee app sandboxed)
    • I haven’t confirmed this yet… but since we’re doing a custom codesigning workflow, we will need to include --timestamp when using codesign (electron-osx-sign --timestamp in the latest release should do this too)

This worked for me, which I used now temorarily instead of electron-osx-sign, all of these files should be placed in root of project.

Replace AppName, CompanyName (xxx) and /dist_electron/mas/$APP.app with your own.

sign-mas.sh

#!/bin/bash

CURRENT_PATH="$( cd "$(dirname "$0")" ; pwd -P )"

# Name of your app.
APP="AppName"
COMPANY_DEVELOPER_ID="CompanyName (xxx)"
# The path of your app to sign.
APP_PATH="$CURRENT_PATH/dist_electron/mas/$APP.app"
# The path to the location you want to put the signed package.
RESULT_PATH="$CURRENT_PATH/dist_electron/mas/$APP-Publish-Ready.pkg"

# The name of certificates you requested.
APP_KEY="3rd Party Mac Developer Application: $COMPANY_DEVELOPER_ID"
INSTALLER_KEY="3rd Party Mac Developer Installer: $COMPANY_DEVELOPER_ID"
# The path of your plist files.
CHILD_PLIST="$CURRENT_PATH/entitlements.mas.inherit.plist"
PARENT_PLIST="$CURRENT_PATH/entitlements.mas.plist"
LOGINHELPER_PLIST="$CURRENT_PATH/entitlements.mas.loginhelper.plist"

FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libnode.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/Contents/MacOS/$APP Login Helper"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"

productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

entitlements.mas.loginhelper.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
  </dict>
</plist>

entitlements.mas.inherit.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

entitlements.mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>XXX.com.appname.AppName</string>
    </array>
    <key>com.apple.security.network.client</key>
    <true/>
  </dict>
</plist>

Then run sh sign-mas.shto create a valid file for publishment.

@johannesjo yeah I can sign and notarize the build without com.apple.security.app-sandbox. Works fine for distribution outside MAS.

This issue is specifically for MAS. It won’t be allowed to be uploaded to the AppStore without that entitlement. I am using electron-builder

I resolved this issue by adding an allow-unsigned-executable-memory entitlement, as described in: https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/

<dict>
  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
  <true/>
</dict>

As we still can’t get this to work, here is an update for Electron 7.0.1 tweaked version (Which is required for MAS builds at the moment - ref. https://github.com/electron/electron/issues/20027#issuecomment-551913031) for the current workaround we are using.

Replace AppName, CompanyName (xxx) and /dist_electron/mas/$APP.app with your own.

sign-mas.sh

#!/bin/bash

CURRENT_PATH="$( cd "$(dirname "$0")" ; pwd -P )"

# Name of your app.
APP="AppName"
COMPANY_DEVELOPER_ID="CompanyName (xxx)"
# The path of your app to sign.
APP_PATH="$CURRENT_PATH/dist_electron/mas/$APP.app"
# The path to the location you want to put the signed package.
RESULT_PATH="$CURRENT_PATH/dist_electron/mas/$APP-Publish-Ready.pkg"

# The name of certificates you requested.
APP_KEY="3rd Party Mac Developer Application: $COMPANY_DEVELOPER_ID"
INSTALLER_KEY="3rd Party Mac Developer Installer: $COMPANY_DEVELOPER_ID"
# The path of your plist files.
CHILD_PLIST="$CURRENT_PATH/entitlements.mas.inherit.plist"
PARENT_PLIST="$CURRENT_PATH/entitlements.mas.plist"
LOGINHELPER_PLIST="$CURRENT_PATH/entitlements.mas.loginhelper.plist"

FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libGLESv2.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libEGL.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libswiftshader_libGLESv2.dylib"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/Contents/MacOS/$APP Helper (GPU)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/Contents/MacOS/$APP Helper (Plugin)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/Contents/MacOS/$APP Helper (Renderer)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/Contents/MacOS/$APP Login Helper"
codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"

productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

entitlements.mas.loginhelper.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
  </dict>
</plist>

entitlements.mas.inherit.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

entitlements.mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>XXX.com.appname.AppName</string>
    </array>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.application-identifier</key>
    <string>XXX.com.appname.AppName</string>
  </dict>
</plist>

Then run sh sign-mas.shto create a valid file for publishment.

@JohnTendik Same issue here - with hardenedRuntime: true, mas-dev is still crashing. It is being signed with the correct certificate as well, which is different than the mas certificate. Without hardenedRuntime, it opens fine.

@james-criscuolo Currently electron-osx-sign uses the plist package to parse & build plist files. If the user specified entitlement files are binary encoded, I guess then it won’t be parsed properly for electron-osx-sign & some of the automations for entitlements files could be affected?

@steffanhalv Unfortunately it did not work for me. I now figured out how to sign and publish with this guide from 2020. The crucial information is that it only seems to work with Electron 5.0.13 and 6.1.7 .

@michaelmika Check that all executable binaries inside your mas build is included to be signed and is correct relative to the script file. If the script is in root of your project, the mas build should be exactly ./dist_electron/mas/APPNAME.app

CD into ./dist_electron/mas/APPNAME.app/... and look for extra binaries. When all binaries are added and signed, no errors should occur in the terminal and the app should run.

We did just got our app approved for the app store two days ago following this steps.

Ex. We had the same problem until we added this lines in the script:

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/Contents/MacOS/$APP Helper (GPU)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (GPU).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/Contents/MacOS/$APP Helper (Plugin)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Plugin).app/"

codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/Contents/MacOS/$APP Helper (Renderer)"
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper (Renderer).app/"

Also check that entitlements are correct

Im happy to report we have solved our build problems. All three builds are working as expected now. Our issue was a little bit different than some of you in this thread so I’m including our fix. It was thanks to the investigation of another user that we were able to move past this problem 😃

I’ve included my build configs there if anyone is interested in seeing how we were able to fix our problem.

https://github.com/electron-userland/electron-builder/issues/4040#issuecomment-547134627

Thanks everyone for all your help!

I had issues with immediate crashes when I had hardened runtime entitlements, with hardened runtime false. I believe the only necessary change (for the app store) is the asar unpack stuff, so I recommend going back to your last work build, and just adding asarUnpack option with your native modules.

Same issue here! Applying the com.apple.security.app-sandbox entitlement is causing immediate crash.

My comment was in regards to your question about electron-builder. Independent of that, I’ve switched my MAS build over to electron-packager and still cannot get it to work. I can make a DMG build work with electron-builder, and anticipate the same with electron-packager. It appears that adding app-sandbox leads to the issues, which is required for a MAS build.

A lot of solutions have been posted above, but it appears they are all for DMG builds, and nobody has had a MAS build work yet (please let us know if you’ve got it working).

Sure.

entitlements.mac.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
  </dict>
</plist>

entitlements.mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true />
    <key>com.apple.application-identifier</key>
  	<string>1234ABCDEF.com.mycompany.MyApp</string>
    <key>com.apple.team-identifier</key>
  	<string>1234ABCDEF</string>
    <key>com.apple.developer.team-identifier</key>
  	<string>1234ABCDEF</string>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>1234ABCDEF.com.mycompany.MyApp</string>
    </array>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
  </dict>
</plist>