3.3.2 Linux Headless exports invalid Mac app

[sp301415]

Godot version

3.3.2.stable Linux Headless

System information

macOS Big Sur 11.5 with M1 Chip

Issue description

I am using godot-ci for my project, but it exports invalid mac app. Seems like a godot issue. Godot 3.2.3 doesn't have this issue, only versions higher than 3.3 has it.

xattr -dr com.apple.quarantine /path/to/Application.app solves the problem, but it requires a Mac.

Possibly related to #527.

Steps to reproduce

1. Create an empty project.
2. Create a Mac export.
3. Export the app using CLI.
4. Run app in macOS.

Minimal reproduction project

No response

[bruvzg]

To be valid, macOS must be either completely unsigned or full signed (having a paid Apple Developer account is not strictly required, an ad-hoc signature is sufficient for the app to be valid).

Godot 3.2.3 doesn't have this issue, only versions higher than 3.3 has it.

3.2.3 had no M1 support, but 3.3 have. M1 binaries can't run unsigned at all, and always include linker generated signature, this result in a partially signed app on export (signed executable and unsigned resources).

When exporting from mac, the app is always signed, but there are no tools that can sign a macOS app on Linux.

So the choice is: no M1 support at all or broken signature when exporting from non Mac machine.

xattr -dr com.apple.quarantine /path/to/Application.app solves the problem, but it requires a Mac.

Also note, that this solves it only for the mac it's running on, it won't work if it's moved to another mac. Instead, you should sign it manually using codesign from the Xcode, or instruct every user to run xattr after downloading the app.

[Calinou]

So the choice is: no M1 support at all or broken signature when exporting from non Mac machine.

We should print a warning message using WARN_PRINT() and display a dialog in the editor after exporting to macOS from a non-macOS editor.

[bruvzg]

We should print a warning message using WARN_PRINT() and display a dialog in the editor after exporting to macOS from a non-macOS editor.

Currently, exporter error messages do not possess any useful information at all. It should be fully reworked to show detailed export status: list of what's gone wrong, possible caveats (like unsigned app), and links to relevant documentation.

[sp301415]

3.2.3 had no M1 support, but 3.3 have. M1 binaries can't run unsigned at all, and always include linker generated signature, this result in a partially signed app on export (signed executable and unsigned resources).

Thanks, makes sense. Never thought M1 support would cause such trouble :( It would be great if it was documented somewhere.

[Calinou]

Thanks, makes sense. Never thought M1 support would cause such trouble :( It would be great if it was documented somewhere.

For anyone stumbling upon issues due to unsigned applications in the future (Godot or otherwise), remember that you can self-sign any application bundle: https://github.com/wynioux/macOS-GateKeeper-Helper