App Notarize cannot be done because "Hardened Runtime" is disabled in Autoupdate.app #1389

sp3esu · 2019-04-16T13:01:02Z

In macOS 10.14.5 Apple will introduce Application Notarization - all apps will have to be notarized by Apple.

We've been trying to notarize our application (we are using latest Sparkle version) but while trying to send binary to the notary service we're getting an error:

2019-04-16 09:41:03 +0000 Distribution items ineligible: Error Domain=IDEDistributionMethodDeveloperIDErrorDomain Code=1 "Hardened Runtime is not enabled." UserInfo={NSLocalizedDescription=Hardened Runtime is not enabled., NSLocalizedRecoverySuggestion="Autoupdate.app" and "fileop" must be rebuilt with support for the Hardened Runtime. Enable the Hardened Runtime capability in the project editor, then test your app, rebuild your archive, and upload again.}

I've been trying to enable it on my custom build but without success. If it will start working for me I'll create PR with the fix. Before that, any help with this issue would be very helpful.

kornelski · 2019-04-16T16:50:06Z

This has been reported before: #1266

MrMage · 2019-04-30T12:37:07Z

FYI, these are the commands I have added to my Podfile to automatically sign the auto-updater with the hardened runtime whenever I run pod install:

post_install do |installer|
	# Sign the Sparkle helper binaries to pass App Notarization.
	system("codesign --force -o runtime -s 'Developer ID Application' Pods/Sparkle/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate")
	system("codesign --force -o runtime -s 'Developer ID Application' Pods/Sparkle/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop")
end

You should be able to extract the codesign commands for your local build.

sp3esu · 2019-05-09T12:37:40Z

Too much customization. I want to be able to use the classic copy step in build phases and sign on copy option. All of the solutions that are described currently looks like a workaround.

Moreover, it should be mentioned in the troubleshooting section in a readme file.

michelf · 2019-05-09T13:11:59Z

The problem is the hardened runtime flags are added as part of the signing process. Xcode can sign as part of the copy build phase, but it won't add the hardened runtime flags.

Perhaps Autoupdate.app could come signed with a dummy self-signed identity, and then the flags would (maybe?) be preserved when Xcode resigns it with the developer's certificate in the copy phase. That's just an hypothesis though.

R0uter · 2019-05-26T15:25:11Z

For those developers who does not use pod, add a 'run script' on Xcode 'Build Phases' tab, contents:

codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate
codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop

Then, drag this script up to top of your phases, (below 'Target Dependecies' maybe).

praveen27Kmr · 2019-05-29T10:05:34Z

Hi ,

I am trying Notarize application With Xcode ,but unable to do with sparkle 1.18.1 version , I have Already Added Code in My "Script Phase"

"
LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"

By default, use the configured code signing identity for the project/target

IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then

If a code signing identity is not specified, use ad hoc signing

IDENTITY="-"
fi
codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A"

"

But I am Getting the Error

its happened After Successfully Uploaded for notarization And When Get back the response after processing is Display a Message "Distribution failed"

Log is there:-

"logFormatVersion": 1,
"jobId": "482f8cbc-5447-4e81-afce-22a",
"status": "Invalid",
"statusSummary": "Archive contains critical validation errors",
"statusCode": 4000,
"archiveFilename": "MYAPPNAME.zip",
"uploadDate": "2019-05-29T07:51:21Z",
"sha256": "ad76875608d6f1e9775d4e017bf684081a69fdb76ec",
"ticketContents": null,
"issues": [
{
"severity": "error",
"code": null,
"path": "MYAPPNAME.zip/MYAPPNAME.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate",
"message": "The contents of the bundle at MYAPPNAME.zip/MYAPPNAME.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate could not be extracted.",
"docUrl": null,
"architecture": null
}
]

I have also checked Sparkle in content of Application is Also Signed , What can I do that I can able to Do Noterize My Application with current sparkle

praveen27Kmr · 2019-06-03T10:36:16Z

@kornelski Plz Reply If you have any solution, anybody any idea to resolve my error

DivineDominion · 2019-06-22T10:13:32Z

@praveen27Kmr I think your question is a better candidate for StackOverflow than the Sparkle dev team.

kornelski · 2019-06-29T13:55:06Z

Please try the latest prerelease https://github.com/sparkle-project/Sparkle/releases

praveen27Kmr · 2019-07-01T04:34:09Z

@kornelski , thanks for your answer ,
My issue resolve after couple of days on last week , It was issue from Apple side also, now they resolved the issue, they was delayed to me because of WWDC
for my Issue :-
"
*/Autoupdate could not be extracted.",
"

the issue is not showing more now from apple side.
When is used to code sign as

codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"

For Now when I see your reply then

@kornelski i try the prerelease version, but I am facing the same , I am trying to build without the flag '-o runtime ' i am using "Framework" from pre-release Assets

URL Framework: -

https://github.com/sparkle-project/Sparkle/releases/download/1.22.0rc1/Sparkle-1.22.0rc1.tar.bz2

Error:-

https://user-images.githubusercontent.com/21966068/60410779-77baeb00-9be7-11e9-927d-0b577ed03813.png

now I want just ask you to that I required to use ' -o runtime ' flag or I can use use framework without this flag

kornelski · 2019-07-02T23:19:41Z

Yes, you still have to do code signing, and I presume that requires -o runtime.

DivineDominion · 2019-07-03T06:00:45Z

@praveen27Kmr If it helps, here's my Run Script Phase (after embedding the framework!) from my apps.

For the XPC branch

Adjust path as necessary:

# 👇 Shorthand for the script; adjust to where you checked-out Sparkle into is 👇
alias dosign="${PROJECT_DIR}/Extern/Sparkle/bin/codesign_embedded_executable"

# Code Signing identity
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
    # If a code signing identity is not specified, use ad hoc signing
    IDENTITY="-"
fi

# Shorthand for the Sparkle.framework
SPARKLE_PATH=${BUILT_PRODUCTS_DIR}/${FRAMEWORKS_FOLDER_PATH}/Sparkle.framework

dosign "$IDENTITY" "${BUILT_PRODUCTS_DIR}/${XPCSERVICES_FOLDER_PATH}"/*.xpc
dosign "$IDENTITY" "${SPARKLE_PATH}/Versions/A/Resources/Autoupdate"
dosign "$IDENTITY" "${SPARKLE_PATH}/Versions/A/Resources/Updater.app/"
dosign "$IDENTITY" "${SPARKLE_PATH}"

For regular release/master branch

Will work on embedded frameworks inside the .app bundle, so no need to adjust anything:

LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"

# By default, use the configured code signing identity for the project/target
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
  # If a code signing identity is not specified, use ad hoc signing
  IDENTITY="-"
fi
codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A"

praveen27Kmr · 2019-07-03T06:22:25Z

@kornelski @DivineDominion Thanks

vastopa · 2019-09-24T16:01:16Z

The diff from the latest release 1.22.0 to the prerelease 1.22.0rc1 mentioned above shows that ENABLED_HARDENED_RUNTIME was only set in version 1.22.0 and not the 1.22.0rc1.

So for anyone still experiencing this issue on the prerelease version that does not want to resign the framework in a Run Script phase, just update to 1.22.0

gregcotten · 2019-10-07T23:39:07Z

The diff from the latest release 1.22.0 to the prerelease 1.22.0rc1 mentioned above shows that ENABLED_HARDENED_RUNTIME was only set in version 1.22.0 and not the 1.22.0rc1.

So for anyone still experiencing this issue on the prerelease version that does not want to resign the framework in a Run Script phase, just update to 1.22.0

Is it now safe to say Hardened Runtime is now supported in 1.22.0 without having to do any manual code signing?

vastopa · 2019-10-08T01:01:12Z

@gregcotten yes

dschmidt · 2020-02-11T22:24:55Z

codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/Autoupdate
codesign --force -o runtime -s 'Developer ID Application' {your_project_dir}/Sparkle.framework/Resources/Autoupdate.app/Contents/MacOS/fileop

FTR I had been --deep signing the AutoUpdate.app before - but after I upgraded to macOS 10.15 I needed to sign executables individually. No idea why exactly or whether it was just some coincidence, just posting because it could be useful to someone else as well.

Sunil-P · 2020-02-13T09:32:39Z

Facing issue with notarising Sparkle embedded framework.
I get error for sparkle binary
The signature of the binary is invalid.

These four binaries

/MyApp.app/Contents/MacOS/MyApp
/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle
/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle
/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Sparkle

Im fairly certain all the above issues are occurring because of embedded Sparkle framework.

This is present in my runscript phase
/usr/bin/codesign --force -o runtime -s "Developer ID ApplicationXXXX" Libraries/Sparkle/Sparkle.framework/Versions/A/Sparkle
/usr/bin/codesign --force -o runtime -s "Developer ID ApplicationXXXX" Libraries/Sparkle/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop
/usr/bin/codesign --force -o runtime -s "Developer ID ApplicationXXXX" Libraries/Sparkle/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate

codesign -vvv --deep --strict /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle
/Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Sparkle: a sealed resource is missing or invalid
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/Sparkle.strings
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/SUAutomaticUpdateAlert.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/SUUpdateAlert.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj/SUUpdatePermissionPrompt.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/Sparkle.strings
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/SUAutomaticUpdateAlert.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/SUUpdatePermissionPrompt.nib
file added: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj/SUUpdateAlert.nib
file missing: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/fr_CA.lproj
file missing: /Applications/MyApp.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Resources/pt.lproj

Kindly assist me, its been bugging me since a week :D

kornelski closed this as completed Jun 29, 2019

micahstubbs mentioned this issue Jul 20, 2019

enable hardened runtime for dependencies micahstubbs/open-dozer#4

Open

4 tasks

micahstubbs mentioned this issue Aug 10, 2019

upgrade dependencies to enable hardened runtime for easier install? Mortennn/Dozer#71

Closed

4 tasks

xor-gate mentioned this issue Jun 3, 2020

Issue with new v1.6.1-1 prerelease syncthing/syncthing-macos#111

Closed

lostminds mentioned this issue Jul 21, 2020

Codesigning "fileop" failed #1628

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

App Notarize cannot be done because "Hardened Runtime" is disabled in Autoupdate.app #1389

App Notarize cannot be done because "Hardened Runtime" is disabled in Autoupdate.app #1389

sp3esu commented Apr 16, 2019

kornelski commented Apr 16, 2019

MrMage commented Apr 30, 2019

sp3esu commented May 9, 2019

michelf commented May 9, 2019

R0uter commented May 26, 2019

praveen27Kmr commented May 29, 2019

praveen27Kmr commented Jun 3, 2019 •

edited

Loading

DivineDominion commented Jun 22, 2019

kornelski commented Jun 29, 2019

praveen27Kmr commented Jul 1, 2019 •

edited

Loading

kornelski commented Jul 2, 2019

DivineDominion commented Jul 3, 2019 •

edited

Loading

praveen27Kmr commented Jul 3, 2019

vastopa commented Sep 24, 2019 •

edited

Loading

gregcotten commented Oct 7, 2019

vastopa commented Oct 8, 2019

dschmidt commented Feb 11, 2020

Sunil-P commented Feb 13, 2020 •

edited

Loading

App Notarize cannot be done because "Hardened Runtime" is disabled in Autoupdate.app #1389

App Notarize cannot be done because "Hardened Runtime" is disabled in Autoupdate.app #1389

Comments

sp3esu commented Apr 16, 2019

kornelski commented Apr 16, 2019

MrMage commented Apr 30, 2019

sp3esu commented May 9, 2019

michelf commented May 9, 2019

R0uter commented May 26, 2019

praveen27Kmr commented May 29, 2019

praveen27Kmr commented Jun 3, 2019 • edited Loading

DivineDominion commented Jun 22, 2019

kornelski commented Jun 29, 2019

praveen27Kmr commented Jul 1, 2019 • edited Loading

kornelski commented Jul 2, 2019

DivineDominion commented Jul 3, 2019 • edited Loading

For the XPC branch

For regular release/master branch

praveen27Kmr commented Jul 3, 2019

vastopa commented Sep 24, 2019 • edited Loading

gregcotten commented Oct 7, 2019

vastopa commented Oct 8, 2019

dschmidt commented Feb 11, 2020

Sunil-P commented Feb 13, 2020 • edited Loading

praveen27Kmr commented Jun 3, 2019 •

edited

Loading

praveen27Kmr commented Jul 1, 2019 •

edited

Loading

DivineDominion commented Jul 3, 2019 •

edited

Loading

vastopa commented Sep 24, 2019 •

edited

Loading

Sunil-P commented Feb 13, 2020 •

edited

Loading