App is damaged and can't be opened, despite being codesigned

I have a cluster of posts, starting at Resolving Trusted Execution Problems, that explain how to debug issues like this. I’m not 100% certain but it sounds like you’re trying to run a command-line tool by double clicking it in the Finder. If so, you’re likely hitting the issue discussed in the Tool Blocked by Gatekeeper section of Resolving Gatekeeper Problems. It’s easy to check that: In a situation where you’re having the Gatekeeper problem, try running the tool from within Terminal.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thanks for the reply eskimo. The posts that you wrote actually got me started on this effort.

I am indeed running it through the Terminal, not Finder. Wouldn't Gatekeeper block the application regardless of where it's being launched from?

When I check the signature using your suggested method, codesign -v -vvv --strict --deep /Applications/codesignTest.app I get the following output. It's not clear to me what is wrong but I'll keep looking.

cisl-ridgeland:~ pearse$ codesign -v -vvv --strict --deep /Applications/codesignTest.app
/Applications/codesignTest.app/: code has no resources but signature indicates they must be present

I am indeed running it through the Terminal, not Finder. Wouldn't Gatekeeper block the application regardless of where it's being launched from?

Well, it should, but it doesn’t, which is why we consider it a bug (r. 58097824)-:

code has no resources but signature indicates they must be present

Consider this sequence:

% cp "/usr/bin/true" "MyTrue"
% codesign -s - -f "MyTrue"  
MyTrue: replacing existing signature
% codesign -d -v "MyTrue" 
…
Format=Mach-O universal (x86_64 arm64e)
…

I make a copy of the true command and re-sign it. When I dump the signature, codesign shows the Format property as a plain Mach-O.

Now let’s put this in an app wrapper and re-sign:

% mkdir -p "MyTrue.app/Contents/MacOS"
% mv "MyTrue" "MyTrue.app/Contents/MacOS/"
% codesign -s - -f "MyTrue.app"
MyTrue.app: replacing existing signature
% codesign -d -v "MyTrue.app"
…
Format=bundle with Mach-O universal (x86_64 arm64e)
…

Here codesign has detected the app wrapper and signed the code as a bundle. Note how the Format property is bundle with Mach-O.

You get this error when you cross the streams:

% trash *  
% cp "/usr/bin/true" "MyTrue"
% codesign -s - -f "MyTrue"  
MyTrue: replacing existing signature
% mkdir -p "MyTrue.app/Contents/MacOS"
% mv "MyTrue" "MyTrue.app/Contents/MacOS/"
% codesign -v "MyTrue.app"
MyTrue.app: code has no resources but signature indicates they must be present
% codesign -v "MyTrue.app/Contents/MacOS/MyTrue" 
MyTrue.app/Contents/MacOS/MyTrue: code has no resources but signature indicates they must be present

codesign detects that the executable is in an app wrapper and expects it to be signed as a bundle. However, it’s still signed as a plain Mach-O and thus the cryptic error message.

There are two ways to fix this, depending on your goals:

• If you plan to ship an app that the user can double click in the Finder, construct your app wrapper correctly and then sign that. This is one of the reasons why [Creating Distribution-Signed Code for Mac][refCDSCfM] says “When signing bundled code … use the path to the bundle for PPP, not the path to the bundle’s main code.” It helps to avoid traps like this.

• If you plan to ship a tool that a user runs from Terminal, put it in a directory structure that doesn’t look like a bundle.

That last point is tricky because there are no documented rules for how codesign detects whether something is a bundle [1]. My general guideline is to put the tool in a directory whose name doesn’t match the tool name. The classic Unix-y bin works for this, but if you don’t want to go down that path you can use something macOS-y, like Command-Line Tools.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Remember Apple’s non-macOS platforms use a ‘shallow’ bundle structure, so codesign might interpret MyTrue/MyTrue as a bundle!