Notarization causing 3rd party executables to not run correctly

I have created a .Net MAUI application that I have written for Windows and MacCatalyst. In my entitlements.plist I have com.apple.security.app-sandbox = no.

	<PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Debug|net7.0-maccatalyst|AnyCPU'">
		<MtouchLink>SdkOnly</MtouchLink>		
		<EnableCodeSigning>True</EnableCodeSigning>
		<EnablePackageSigning>true</EnablePackageSigning>
		<CreatePackage>true</CreatePackage>
		<CodesignKey>Developer ID Application: xxxxxxxxxx</CodesignKey>
		<CodesignProvision>xxxxxxxx</CodesignProvision>
<CodesignEntitlements>Platforms\MacCatalyst\Entitlements.plist</CodesignEntitlements>
		<PackageSigningKey>Developer ID Installer: xxxxxxxxx</PackageSigningKey>
		<UseHardenedRuntime>true</UseHardenedRuntime>
		<RuntimeIdentifier>maccatalyst-arm64</RuntimeIdentifier>
		<MtouchInterpreter>-all</MtouchInterpreter>
	</PropertyGroup>

I have a 3rd party executable that I manually codesigned: codesign --force --verify --verbose --sign xxxxxx 3rdpartyApp --timestamp --deep --options runtime

Then I build the application in Visual Studio Mac. Everything is codesigned, etc. After building I am able to successfully notarize the pkg and then staple the the notarization to it.

When I take that pkg and install it in a test environment, everything installs fine, no warning. I am able to start my application and do what I need to do But when it tries to run that 3rd party executable, it just fails. At first I checked exec permissions. I chmod it to +x. within the .app container and also all the way at the beginning, and rebuilt the application, resigned, re-notarized, etc. I am working to get some logging out to see why it failed, but having an issue with that at the moment.

In the meantime I have taken the non-notarized pkg, forced the install in the test environment and the 3rd party executable runs successfully.

So it seems the notarization process is causing this child process to fail?

Up vote post of MattWiner Down vote post of MattWiner
549 views
Posted by
MattWiner
Reply
Add a Comment

Replies

I found this article, this seems like it could be the issue: App Translocation Notes: https://developer.apple.com/forums/thread/724969

I tried setting: com.apple.security.cs.disable-library-validation to false but when I launch my app I get:

Termination Reason:
Namespace DYLD, Code 1 Library missing
Library not loaded: @rpath/libSkiaSharp.framework/Versions/A/libSkiaSharp
Referenced from: <1F848673-7F9-3635-8A5-376DDAAE6A> /Applications/MyApp.app/Contents/MacOS/MyApp
Reason: (security policy does not allow @ path expansion) (terminated at launch; ignore backtrace)
Posted by
MattWiner
Up vote reply of MattWiner Down vote reply of MattWiner
Add a Comment

In my entitlements.plist I have com.apple.security.app-sandbox = no.

…

I tried setting: com.apple.security.cs.disable-library-validation to false

These entitlements default to false and I strongly recommend you not set them to their default value. If you don’t want that feature then omit the entitlement entirely. We actually call this out on the Hardened Runtime docs.

I have a 3rd party executable that I manually codesigned: codesign … --deep …

Don’t sign using --deep. See --deep Considered Harmful for an explanation as to why this is a bad idea.

As to why things are failing, it’s hard to say without more info. My understanding is that you a have a container app and within that you’ve embedded a helper tool. Is that right?

Is the container app sandboxed?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment