Safari extension distributed in a … | Apple Developer Forums

Developer Forums

Hi folks,

We're building a Safari web extension and experiencing an issue to see it among extensions in Safari after installing the container app to /Applications and launching it.

The app and extension is notarized and signed with Developer ID

After an extensive investigation, we found the following log records in the Console app (the extension ID is redacted):

Computing the code signing dictionary failed for extension with identifier com.youcompany.safariext

Blocking extension with identifier: com.youcompany.safariext

To debug the issue, we've created a HelloWorld-like extension generated by Xcode 12.2 beta 4 (http s://sharedartifacts.s3.eu-central-1.amazonaws.com/safariext.app.zip contains a signed app bundle)

It also is under the same code signing issue.

According to https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/resolving_common_notarization_issues, we've run a few checks to verify:

code signature

Code Block ➜  Desktop codesign -vvv --deep --strict ./safariext.app          
...
--prepared:/Users/nikolay/Desktop/safariext.app/Contents/PlugIns/safariext Extension.appex
...
--validated:/Users/nikolay/Desktop/safariext.app/Contents/PlugIns/safariext Extension.appex
...
./safariext.app: valid on disk
./safariext.app: satisfies its Designated Requirement

signing certificate

Code Block ➜  Desktop spctl -vvv --assess --type exec ./safariext.app     
./safariext.app: accepted
source=Notarized Developer ID
origin=Developer ID

secure timestamp

Code Block ...
Timestamp=25 Nov 2020 at 22:23:54
...

We seemed to have all checks good, the extension can be installed only if Safari is allowed to run unsigned extensions.

Could anyone assist to debug/resolve this issue?

Thanks

3.1k

Posted by

nikolaykh

Reply

Accepted Reply

I am also interested in this.
Would like to distribute an extension to testers.
MacOS has no TestFlight equivalent.

Posted by

Niq

Replies

I am also interested in this.
Would like to distribute an extension to testers.
MacOS has no TestFlight equivalent.

Posted by

Niq

Niq's post was accidentally marked as a solution.

@Niq

I think you experience a different issues rather than we do. You may want to produce development builds which perfectly work for us.

The case for us is to distribute our extension which is signed with Developer ID and notarized by Apple, but Safari doesn't still recognize as properly signed while it is.

Posted by

nikolaykh

I'm having this exact issue. I've signed and notarized my extension successfully, but then when I check my Safari extensions, I cannot see my extension until I select to allow unsigned extensions. I'm not sure what's going on, do you think it's the version of Mac/safari/xcode?

Posted by

andrew-readefine

Same here... Works fine in development mode but after signing and notarizing it just won't show up in Safari no matter what I try.

I have the very same log messages in Console (kudos on finding them btw!).

Posted by

lemonmojo

Guys, any progress?

I have the same problem. Someone says that the safari extension can only be distributed through the Mac app store. Can anyone confirm this claim?

Posted by

HongyunZhang

For anyone is here, I'm sure it has to be an extension published by the mac app store to be considered a "signed" extension by safari browser

Posted by

HongyunZhang

I am having the exact same issue where my Safari extension will not show up if I have archived my app with the Safari extension and tried to distribute it using my Developer ID and have it notarized. Is it true as @HongyunZhang says that it will only work if distributed through the App Store?

Posted by

drew.koch

Hi there, We are experience the exact same issue.

@nikolaykh , Have you found a solution or workaround to this?

Thank you.

Posted by

lng

Hi all,

same issue here.
I have signed the safari extension with dev certificate and notarized properly.
the extension does not run until I allow "allow unsigned extensions".

this is crucial, and really blocking us.
any workaround guys?

Posted by

itayhac

We have the exact same issue with our Safari Web Extension (NSExtensionPointIdentifier = com.apple.Safari.web-extension), but not with our Safari App Extension (NSExtensionPointIdentifier = com.apple.Safari.extension). They are both signed and notarized properly and part of the same install package, yet Safari won't load the Web Extension unless we Allow Unsigned Extensions. As an experiment I've simply changed the Web Extension's Info.plist NSExtensionPointIdentifier value to com.apple.Safari.extension after which Safari loads the extension fine.

As others have reported, I find the following errors in the log:

Code Block ... Computing the code signing dictionary failed for extension with identifier ...
... Blocking extension with identifier: ...

Has anyone discovered a workaround for this?

Thanks

Posted by

dtheobald

I filed a ticket with DTS, and they basically told me that "The behavior and resulting limitations you describe are by design. Safari Web Extensions must be distributed via the AppStore."

I remarked that this behavior is different for Safari App Extensions (old style) that do load and work when the container-app is notarized. I was told this about Safari WebExtensions: "It is not a bug as they were never intended to work outside of the AppStore"

All I could do was to file an Enhancement request.

Personally I still see this inconsistency as a bug.

Posted by

thieso2

Distribution to end-users for Safari Web Extensions is limited to the Mac App Store. You can test Safari Web Extensions distributed with a notarized app by using the Allow Unsigned Extensions option from the Develop Menu.

Posted by

beyera

Now I don't get the concept of notalization. 🙄

—
normal

Hey, Any news regarding this one? I would like to distribute my web extension directly to employees in my organization using MDM without having each user manually enable 'allow unsigned extension' for it to work. Any way to make it work?

Posted by

guyholl

+1, though Testflight supports MacOS now, it would be better if we can just sign and install Safari webext locally. Safari WebExt is not a typical MacOS app, it is closely coupled with browser. It seems none of the popular test automation framework has the privilege to config the Mac privacy settings and "allow unsigned extension" in Safari developers settings

Compared with for Chromium, Firefox, the test automation is straightforward, this limitation brings a lot of difficulties to the e2e testing.

Posted by

lu.xu

+1 Safari needs an equivalent to Chrome's https://chromewebstore.google.com/org, where a user can find extensions internal to their organzation

—
mr-fixit-nyt