createDistributable signing failing on macOs with Could not find certificate

[ahimberg]

Describe the bug Created a new compose desktop app on my mac. Followed the instructions for signing and notarization here: https://github.com/JetBrains/compose-multiplatform/blob/master/tutorials/Signing_and_notarization_on_macOS/README.md

always getting an error that it can't find a certificate

Affected platforms Select one of the platforms below:

• Desktop - macOs

Versions

• Kotlin version*: 1.9.22
• Compose Multiplatform version*: 1.5.12
• OS version(s)* (required for Desktop and iOS issues): macOs 14.3
• OS architecture (x86 or arm64): arm64
• JDK (for desktop issues): Temurin 19.0.2

To Reproduce Created a new compose desktop project in intellij idea ce followed the tutorial to setup for signing and notarization (for a mac desktop app, trying to run on another machine it won't run I guess because it needs some kind of signing) edited the build.gradle.kts file adding into the nativeDistributions { macOs { section

                bundleID = "...mybundleId..."

                signing {
                    sign.set(true)
                    identity.set("Andy Himberger")
                    keychain.set("/Users/ahimberg/Library/Keychains/login.keychain-db")
                }

                notarization {
                    val providers = project.providers
                    appleID.set("...myappleid...")
                    password.set("...myapppassword...")
                    teamID.set("...myteamId...")
                }

Expected behavior Successfully signs and notarizes, better indicator of why its failing

Additional context I first tried using existing signing certificates already on my machine working with xcode development, but created a new one following the steps too.

I get this error trying to run the createDistributable task:

Execution failed for task ':createDistributable'.
> Could not find certificate for 'Andy Himberger' in keychain [/Users/ahimberg/Library/Keychains/login.keychain-db]

With debug logs enabled I see it ran this command but no other output on why it failed:

Starting process 'command '/usr/bin/security''. Working directory: /Users/ahimberg/myApp Command: /usr/bin/security find-certificate -a -c Developer ID Application: Andy Himberger /Users/ahimberg/Library/Keychains/login.keychain-db

If i run that command myself it is showing 4 certificates, the one I created using the tutorial is this one: "alis"="Mac Developer: Andy Himberger (GK8V53S8Z3)" but these are also in my keychain being returned not sure if its confused by them: "alis"="Developer ID Certification Authority" "alis"="Apple Worldwide Developer Relations Certification Authority" "alis"="Apple Worldwide Developer Relations Certification Authority"

[dima-avdeev-jb]

Thanks for Issue

[ahimberg]

A couple observations looking at how this command is run:

1. the fullDeveloperID string always has this Developer ID Application: prefix, which isn't the prefix I see on the certificates created by apple, its 'Mac Developer: ' for me.

           val developerIdPrefix = "Developer ID Application: "
           val thirdPartyMacDeveloperPrefix = "3rd Party Mac Developer Application: "

2. in MacSignerImpl, this call creates the command to run, the arg after -c, is not quoted, which results in the tool returning all certificates that contain the word 'Developer' when the string is 'Developer ID Application: Andy Himberger'

           runTool(
               MacUtils.security,
               args = listOfNotNull(
                   "find-certificate",
                   "-a",
                   "-c",
                   settings.fullDeveloperID,
                   settings.keychain?.absolutePath
               ),

I created a new keychain with only one certificate in it, that gets createDistributable to succeed on my machine.

Attempting to notarize now and that is failing that something was invalid in the request, from the notarize logs the request to apple fails because there are all these dylib files in the package with an error message of - "The binary is not signed with a valid Developer ID certificate.".

with all of this signing/notarize all I'm trying to do is be able to run the app I created on another machine, no intention to publish to the app store.

[okushnikov]

Please check the following ticket on YouTrack for follow-ups to this issue. GitHub issues will be closed in the coming weeks.