Open k9ert opened 1 year ago
I have some intermediate result. Several issues got mixed here:
specter://...
) to the entitlements. So removing it fixed the issue on the old intel based machine. This makes sense to me even without finding a documentation describing it.So at least we can release again. We'll pick up the URL-Handler later and also the crash on M2.
Starting the signed binary like this:
So the executable will get killed immediately and you'll see something like this in the logs:
It seems that we need a provisioning profile. However, Apple is not mentioning that at it's documentation. There, only signing and notarizing is mentioned.
validating signatures
Is the signature of that binary even valid? A prerequisite for notarizing is that you sign your software with your developer key.
The signature can be checked like this:
``` ➜ specter-desktop git:(kn/mac_signing) ✗ pkgutil --check-signature ./pyinstaller/electron/dist/mac-arm64/Specter.app Package "Specter": Status: signed by a certificate trusted by macOS Certificate Chain: 1. Developer ID Application: Kim Neunert (FWV59JHV83) Expires: 2026-09-11 11:59:39 +0000 SHA256 Fingerprint: 06 C7 63 8C 92 5B DD 60 79 8C B1 B0 30 8D B7 98 2C 99 8E F3 33 87 A0 BD 03 1B 35 C5 3D 53 3C 3D ------------------------------------------------------------------------ 2. Developer ID Certification Authority Expires: 2027-02-01 22:12:15 +0000 SHA256 Fingerprint: 7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03 F2 9C 88 CF B0 B1 BA 63 58 7F ------------------------------------------------------------------------ 3. Apple Root CA Expires: 2035-02-09 21:40:36 +0000 SHA256 Fingerprint: B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C 68 C5 BE 91 B5 A1 10 01 F0 24 ➜ specter-desktop git:(kn/mac_signing) ✗ ```Validating notarisation status
Is the software properly notarised?
yes, i think so:
``` ➜ specter-desktop git:(kn/mac_signing) ✗ spctl --assess --verbose --type execute ./pyinstaller/electron/dist/mac-arm64/Specter.app ./pyinstaller/electron/dist/mac-arm64/Specter.app: accepted source=Notarized Developer ID ➜ specter-desktop git:(kn/mac_signing) ✗ ```additional context and further references:
Did it ever worked?
Yes, it did. The original notarisation-process was built on "altool". However, for some reason, binaries which got signed with that process started to crash.
The answer from apple was not very precise.
unfold
Thank you for contacting Apple Developer Technical Support (DTS). Based on your request, we believe that your question is answered by the Apple Developer Forums discussion linked here: Resolving Trusted Execution Problems https://developer.apple.com/forums/thread/706442 If after reviewing this information you have further questions or persistent issues, and do not wish to follow up on the Developer Forums, please reply to this email and we will re-open this support inquiry, re-debiting a Technical Support Incident (TSI) if appropriate to do so.After some digging, i decided to migrate from altool to notarytool and the result is the errormessage at the top of this ticket.
Understanding Provisiong Profiles
Just for the reference, some information about provisioning profiles. here are different profiles explained. For our use-case, it seems that the AdHoc profile might be the way to go.
ChatGPT spits out those references:
Relevant information nuggets: