MacOS codesigning does not enable hardened runtime options

jamesmunns commented 2 weeks ago

Hey there, I'm working my way through figuring out how to get a signed + notarized app built by cargo-dist. I've followed the instructions in #1372, which do produced a signed application, however when I attempted to notarize my executable, I get the following error:

  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "poststation-v0_0_11.zip/poststation",
      "message": "The executable does not have the hardened runtime enabled.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087724",
      "architecture": "arm64"
    }
  ]

The signing step for macos:

https://github.com/axodotdev/cargo-dist/blob/f53dd6d1db1623a11d0f7feb6e12635b734fd33c/cargo-dist/src/sign/macos.rs#L186-L199

Doesn't set the following flags: [--force] --options runtime.

The apple docs mention the --options runtime argument:

https://developer.apple.com/documentation/security/resolving-common-notarization-issues#Enable-the-hardened-runtime

I'm unsure if --force is required here, but I've seen it mentioned in a couple places:

At the moment, I haven't enabled the creation of a pkg or dmg, so i'm just building a bare application that I put in a zip for notarization.

I'll keep trying to do this locally, and see if I can find the right combination required to get signing and notarized. Happy to test out anything here re: macos signing!

jamesmunns commented 2 weeks ago

Additionally, to get things to work, I seem to have also needed to add:

--timestamp --entitlements ./entitlements.plist. Right now I don't need any entitlements, so my contents are:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
</dict>
</plist>

mistydemeo commented 2 weeks ago

I'll take a look into it thank you!

axodotdev / cargo-dist

MacOS codesigning does not enable hardened runtime options #1534