electron-builder: Invalid Signature - The nested app bundle Electron Framework

Hi,

I try to sign my app with electron builder, with my package.json :

{
  "scripts": {
    "start": "electron ./app --enable-logging",
    "dev": "NODE_ENV='development' npm run start",
    "dist": "npm run dist:osx",
    "dist:osx": "build --platform darwin"
  },
  "devDependencies": {
    "gulp": "~3.9.0",
    "gulp-concat": "~2.6.0",
    "gulp-rename": "~1.2.0",
    "gulp-uglify": "~1.5.0",
    "gulp-sass": "~2.3.1",
    "gulp-sourcemaps": "~1.6.0",
    "gulp-cssnano": "~2.1.0",
    "electron-builder": "3.23.0",
    "electron-prebuilt": "1.1.0"
  },
  "build": {
    "productName": "MyApp",
    "app-bundle-id": "com.myapp",
    "app-category-type": "public.app-category.productivity",
    "osx": {
      "title": "MyApp",
      "background": "build/background.png",
      "icon": "build/icon.icns",
      "icon-size": 128,
      "target": "mas",
      "identity": "Developer ID Application: Jeremie Chazelle (XXXXXXXXX)",
      "contents": [
        {
          "x": 355,
          "y": 125,
          "type": "link",
          "path": "/Applications"
        },
        {
          "x": 155,
          "y": 125,
          "type": "file"
        }
      ]
    },
    "mas": {
      "identity": "Jeremie Chazelle"
    }
  }
}

I done this tutoriel https://github.com/nwjs/nw.js/wiki/MAS%3A-Requesting-certificates to make the certificates

I launch the build and sign with sudo npm run-script dist

pc3:my-app jeremiechazelle$ sudo npm run-script dist
> @ dist /Users/jeremiechazelle/Sites/my-app
> npm run dist:osx
> @ dist:osx /Users/jeremiechazelle/Sites/my-app
> build --platform darwin
Rebuilding app dependencies for arch x64 to /Users/jeremiechazelle/Sites/my-app/app
Packaging app for platform mas x64 using electron v1.1.0
Signing app (identity: Developer ID Application: Jeremie Chazelle (XXXXXXXXXX))
pc3:my-app jeremiechazelle$

With Application Loader, I upload my app. The upload it’s done

But, after 30 secondes, I have an email from Apple

Dear developer,

We have discovered one or more issues with your recent delivery for "MyApp". To process your delivery, the following issues must be corrected:

Invalid Signature - ...

Once these issues have been corrected, you can then redeliver the corrected binary.

Regards,

The App Store team

I don’t understand what I’m missing…

About this issue

Original URL
State: closed
Created 8 years ago
Comments: 77 (47 by maintainers)

Most upvoted comments

@jechazelle If wish to add options, you may use the following for signing and packing. Note the two dashes -- before stating each param.

electron-osx-sign "./dist/osx/Releases Pro.app" --identity="3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXXX)" --entitlements="./default_mas_entitlements" --entitlements-inherit="./default_mas_inherit_entitlements"
electron-osx-flat "./dist/osx/Releases Pro.app" --identity="3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXXX)"

Additionally, export DEBUG=electron-osx-sign* before signing should give extra debug logs.

sethlu on May 29, 2016

@sethlu @develar @mcfedr Thanks a lot for you help!! 👍

I would like to generate my build only to MAS (iTC)

'please don't specify identity in the package.json, it is recommended to use only env.'

I read your comments, So, I don’t declare identity in my package.json, only with env var

package.json

"osx": {
      [... skipped]
      "target": "mas",
      [... skipped]
    }

and I set env var

CSC_INSTALLER_NAME=3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXX)
CSC_NAME=3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXX)

it’s correct ?

jechazelle on May 27, 2016

@sethlu @mcfedr Thanks a lot for your help!

develar on May 27, 2016

@sethlu Docs and implementation are fixed, thanks.

develar on Jun 9, 2016

@jechazelle Please wait several hours — 4.2 should be out soon (well, I am trying to release second day 😦

develar on Jun 1, 2016

@jechazelle From the doc here https://github.com/electron-userland/electron-builder/wiki/Options#buildmas I think you may add the following in your package.json:

   "mas": {
      "identity": "3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXX)",
      "entitlements": "path-to-my-entitlements"
    }

sethlu on May 29, 2016

@sethlu Thanks a lot for you help!!

Wow !! I tried with this version :

    "electron-builder": "3.27.0",
    "electron-prebuilt": "0.35.6",

I resume :

{
  "scripts": {
    "start": "electron ./app --enable-logging",
    "dev": "NODE_ENV='development' npm run start",
    "dist": "npm run dist:osx",
    "dist:osx": "build --platform darwin"
  },
  "devDependencies": {
    "electron-builder": "3.27.0",
    "electron-prebuilt": "0.35.6",
   ...
  },
  "build": {
    "productName": "MyApp",
    "app-bundle-id": "com.myapp",
    "app-category-type": "public.app-category.productivity",
    "osx": {
      "title": "MyApp",
      "background": "build/background.png",
      "icon": "build/icon.icns",
      "icon-size": 128,
      "target": "mas",
      "identity": "3rd Party Mac Developer Application: Jeremie Chazelle (XXXXXXXXX)",
      "contents": [
        {
          "x": 355,
          "y": 125,
          "type": "link",
          "path": "/Applications"
        },
        {
          "x": 155,
          "y": 125,
          "type": "file"
        }
      ]
    },
    "mas": {
      "identity": "3rd Party Mac Developer Installer: Jeremie Chazelle (XXXXXXXXX)"
    }
  }
}

My App doesn’t freeze and I can submit my app on iTC !!

Now, I wait if Apple can open my app

jechazelle on May 28, 2016

@jechazelle Yup, I think it should be correct now. 👍

sethlu on May 27, 2016

@jechazelle I think @develar may know more on the set up of this module. However, generally when building apps for distribution inside the MAS, 3rd Party Mac Developer Application and 3rd Party Mac Developer Installer should be the correct ones to be used. When for distribution outside the MAS, Developer ID Application and Developer ID Installer should be used (as far as I understand).

sethlu on May 27, 2016

I am fairly sure that if Application Loader takes your pkg then its correctly signed

mcfedr on May 26, 2016

@jechazelle thanks for confirming. Sorry but I’m out of clues right now. Would you do the following test of designated requirements on your local machine?

codesign --verify --verbose path/to/my.app

sethlu on May 25, 2016

@sethlu No, we use your excellent module (but fork — my PR was accepted, thanks).

develar on May 25, 2016