search

sindresorhus / create-dmg

Create a good-looking DMG for your macOS app in seconds
MIT License
4.72k stars 196 forks source link

Completely Signed and Notarized App doesn't work anymore when loaded from DMG #58

Closed bjesuiter closed 4 years ago

bjesuiter commented 4 years ago

I created an app build and signed, notarized and stapled it completely. See the Step Build, Sign & Notarize App in my github workflow.

This produces the 'dist' artefact, which is simply my complete dist folder uploaded as github actions artifact. You can:

The Problem

When Installing the same app from the DMG created with create-dmg, the app does appear to be valid by spctl, but it can't be run.

(You can download the dmg from the same github actions run directly here: https://github.com/bjesuiter/macos-file-summoner/suites/819538575/artifacts/9026759)

❯ spctl -a -vvvv /Applications/File\ Summoner.app             
/Applications/File Summoner.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Benjamin Jesuiter (BB38WRH6VJ)

When running, it produces the following error message: (Which reads: 'The app File Summoner.app can't be opened' in german)

Bildschirmfoto 2020-06-20 um 01 41 25

Could you please look into what is going on here?

sindresorhus commented 4 years ago

(You can download the dmg from the same github actions run directly here: bjesuiter/macos-file-summoner/suites/819538575/artifacts/9026759)

That one opens successfully for me:

Screenshot 2020-06-20 at 15 08 11
sindresorhus commented 4 years ago

If the DMG works before notarization, but not after, I don't think it's an issue with create-dmg.

bjesuiter commented 4 years ago

Thanks again for looking into my issue!

I think, there is a small misunderstanding. I can open the dmg just fine. But when I copy the app package from the dmg to the application folder, the app package can't be launched anymore.

My confusion is, that the same app package in the 'dist' artifact from one github actions job earlier can be opened without a problem on my Mac after unzipping.

The dmg you tested is already notarized, I have to add the unnotarized version to the artifacts for testing whether there is a difference between the notarized and the unnotarized dmg variant.

bjesuiter commented 4 years ago

I found the issue:

I built, signed and notarized my mac app in one github actions job, stored it as an artifact in github, opened a new job for creating the dmg, downloaded the stored app into the new job and built the dmg.

The problem was, that the binary in the downloaded artifact was missing the -x execute flag because of the download from github artifacts. So my mac app has been signed and notarized correctly, but the binary could not be executed on filesystem level.

Thanks again for looking into it! Here's the link to the latest release, if you're interested: https://github.com/bjesuiter/macos-file-summoner/releases/latest I'll look into submitting this to some awesome lists, because i think it solves a big problem in macos :)