Warn about team identifier when code signing without provisioning profile and with individual development certificate

[sethlu]

Addresses partly #88

[elvis-epx]

Amen. Needed to pass the provisioning profile parameter for both development (testing) and upload versions, it was not clear from the documentation that they were necessary, and the errors that Application Loader emits are not very clear.

[sethlu]

@elvis-epx thanks for letting us know the difficulties you had with code signing your products! We are still working on providing a better documentation/tutorial for code signing. Apparently the provisioning profiles are necessary for signing (due to the entitlements with application group etc) and we are not yet addressing this in the documentation. However, we will keep the updates posted once that is released! 😸 And do let us know if there be other issues signing with electron-osx-sign.

[elvis-epx]

I was planning to write an article about it, but it is probably more productive to collaborate directly on existing documents. WIll find the way to do it next week.

[sethlu]

@elvis-epx So far we have some existing documents on the Wiki page (https://github.com/electron-userland/electron-osx-sign/wiki) that @jasonhinkle helped put up earlier this year. However, as provisioning profile is not something we really use with signing before application group (ElectronTeamID) was introduced in Electron this summer, the docs haven't been updated to cover --provisioning-profile or the current workflow of embedding provisioning profile in the app bundle.

Out of curiosity, what's your current method to codesign your app bundle?

---

#112 should partly address this issue before release 0.4.2

[elvis-epx]

The following script condenses what has worked for me: https://github.com/elvis-epx/Biorhythmics/blob/master/electron/pkg (the enclosing folder is an open-source Electron app that I put together for a related article).

I was able to test the sandboxed version with development sign (and solve the sandbox-related problems) and also submitted the production-signed pkg to App Store. Let's see if it is approved.

[sethlu]

Hi @elvis-epx, I have posted a codesigning guide (draft) here (https://mintkit.net/electron-userland/electron-osx-sign/guide/) and will open a repo soon once I have the text/code reviewed for better performance. It is essentially a code generator and a walkthrough to set up your code signing environment varying by preference.

cc: @malept @develar

---

Project repo: https://github.com/sethlu/electron-osx-sign-guide

[elvis-epx]

Did my homework as well not to lose the details in the L1 cache in the brain. https://epxx.co/artigos/electronsign.html. As soon as you open the repo I will compare and fulfill your text with more details that might be good to add. BTW my app was finally accepted by App Store, so the script is "proven" to work :P

[sethlu]

Happy new year @elvis-epx! Sorry for my replying this late... I have just read your tutorial and it is a good walkthrough for beginners to codesign their app bundles. Thanks so much for your effort in putting that up! Would you mind my citing some of your words in that shared interactive guide I published last week? I'm thinking about adding a few expandable textboxes to explain some technical terms like "provisioning profile" better.

[elvis-epx]

Sure! My time will be limited (for work, at least :) in the next 7 days but in time will do.

[elvis-epx]

(And feel free to use whatever you want from my text.)