osx-sign: Error: code object is not signed at all

Hey @sethlu and @malept. I’ve been working on getting an Electron app into the MAS for a few days. 😅 – lots of googling and I keep seeing your names pop up on old threads. Thanks for helping people figure this stuff out!

I’ve got all my signing certs set up:

screen shot 2018-04-16 at 2 51 26 pm

I’m using this electron-packager incantation to generate a .pkg file and publishing the build to iTunes Connect using Application Loader:

# package for MAS
electron-packager . \
  --platform=mas \
  --arch=x64 \
  --out=dist \
  --prune=true \
  --app-bundle-id=com.sikelianos.zeke.illuminati \
  --app-version="$npm_package_version" \
  --build-version="$npm_package_version_build" \
  --icon=build/icon.icns \
  --osx-sign

# copy provision profile
cp embedded.provisionprofile dist/Illuminati-mas-x64/Illuminati.app/Contents/

# flatten
electron-osx-flat dist/Illuminati-mas-x64/Illuminati.app \
  --pkg dist/illuminati.pkg

The Application Loader step succeeds, but I got an email back:

Invalid Signature - The executable at path Illuminati.app/Contents/Resources/app/node_modules/fsevents/build/Release/.node has following signing error(s): code object is not signed at all In architecture: x86_64 . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html and Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html for more information.

Any pointers on what I might be missing?

Ideas:

Should I be using codesign somewhere too, or is electron-osx-sign all I need?
Do I need an Info.plistfile with some custom stuff in it? The app doesn’t have any special requirements that I know of.

About this issue

Original URL
State: closed
Created 6 years ago
Comments: 15 (9 by maintainers)

Most upvoted comments

Hi @zeke! 😺

I think the issue comes from the native node addons (from the fsevents dependency). Since electron-osx-sign bypasses scanning files that begin with a dot . (typically the hidden files, e.g. .gitignore), it happens to skip code signing this binary file located at Illuminati.app/Contents/Resources/app/node_modules/fsevents/build/Release/.node. While files with names like something.node will be automatically signed.

🏅 I guess it may be good for electron-osx-sign to expect .node as a binary?

A revised workflow for now may be the following:

# package for MAS
electron-packager . \
  --platform=mas \
  --arch=x64 \
  --out=dist \
  --prune=true \
  --app-bundle-id=com.sikelianos.zeke.illuminati \
  --app-version="$npm_package_version" \
  --build-version="$npm_package_version_build" \
  --icon=build/icon.icns \

# copy provision profile (best to do this before code signing)
# you don't really have to manually do this as electron-osx-sign will scan the working directory for a matching provisioning profile and copy it there
cp embedded.provisionprofile dist/Illuminati-mas-x64/Illuminati.app/Contents/

# codesign (explicitly put the binary from fsevents, electron-packager avoids passing additional binaries)
electron-osx-sign dist/Illuminati-mas-x64/Illuminati.app \
  dist/Illuminati-mas-x64/Illuminati.app/Contents/Resources/app/node_modules/fsevents/build/Release/.node

# flatten
electron-osx-flat dist/Illuminati-mas-x64/Illuminati.app \
  --pkg dist/illuminati.pkg

Lemme know if it helps 😄

sethlu on Apr 16, 2018

Hi @sethlu we fixed this issue and successfully launched on app store thanks for your reply.

SanthoshPixmonks on Jun 10, 2020

Hey Seth thanks for following up! I’m not able to test this fix right now, and probably won’t get back to this any time soon. Feel free to close this issue.

zeke on Jun 10, 2020

I ended up working around it by removing the dependency on fsevents which was coming from elemon a file watcher that I should have put in devDependencies anyway, as those get pruned from the build. 👍

zeke on Apr 17, 2018

Oh, and in response to your ideas: (Forgot to address them in an earlier post)

Should I be using codesign somewhere too, or is electron-osx-sign all I need?

Yep, electron-osx-sign calls codesign itself so we don’t have to tweak all those parameters.

Do I need an Info.plist file with some custom stuff in it? The app doesn’t have any special requirements that I know of.

electron-osx-sign will at times modify the Info.plist file if it doesn’t contain enough information, ElectronTeamID for example. Providing an env variable DEBUG=electron-osx-sign* should have it displaying all those changes and what files are actually signed.

sethlu on Apr 16, 2018