EXC_BAD_ACCESS (Code Signature Invalid) MAS-DEV #4074

steffanhalv · 2019-07-21T20:39:41Z

Version:
21.1.1

Target:
mas & mas-dev

Problem:
Building for mas-dev gives EXC_BAD_ACCESS (Code Signature Invalid) and I also get the same results when submitting it for review.

4 min video:
https://drive.google.com/file/d/1WbclNwMxcxgrohI9SS0SpmFVa2IHpCtN/view?usp=sharing

Details:
Using MacOS Mojave 10.14.5 with newly created certs, provisionprofiles and a clean installation of https://github.com/electron/electron-quick-start, gives signature error after sign. This happens with all of my electron projects, even if I go back in git where it worked before with earlier versions of electron-builder / electron / electron-osx-sign.

More details here, trying to sign app manually with electron-osx-sign with same error:
electron/osx-sign#200

Notice that the apple developer portal just changed their gui, I don't know if they also made some other changes.

I also tried with hardenedRuntime set to true & gatekeeperAssess set to false.

steffanhalv · 2019-07-21T22:12:47Z

If I use this guideline, I get the app signed with correct entitlements and can run it:

https://github.com/electron/electron/blob/master/docs/tutorial/mac-app-store-submission-guide.md

Now I am just waiting for yet another review, hopefully it passes this time :-)

mayqiyue · 2019-07-22T11:11:17Z

+1

mytran · 2019-07-22T20:28:54Z

This is happening for me on 21.1.2. No issues on 21.0.3 and older.

semireg · 2019-07-22T21:49:49Z

I've had sandboxed mas-dev builds running perfectly for months. Now I'm trying to get a mas-dev build with hardenedRuntime working for days ... all errors, no luck.

Here's an interesting output from this script:

"package-mas-hr": "npm run build && electron-builder --mac mas mas-dev",

Configured as:

"mac": {
      "category": "public.app-category.productivity",
      "target": [
        "mas",
        "mas-dev",
        "zip",
        "dmg"
      ],
      "hardenedRuntime": true,
      "entitlements": "build/entitlements-lll.plist",
      "gatekeeperAssess": false
    },
    "afterSign": "build/notarize.js",
    "mas": {
      "provisioningProfile": "build/embeddedyesmas.provisionprofile",
      "entitlements": "build/entitlements-sandbox.plist"
    },

notarize.js

require('dotenv').config();
const { notarize } = require('electron-notarize');

exports.default = async function notarizing(context) {
  const { electronPlatformName, appOutDir } = context;
  // console.log(`context: ${JSON.stringify(context.targets, null, 3)}`);
  if (electronPlatformName !== 'darwin') {
    return;
  }

  const appName = context.packager.appInfo.productFilename;
  const password = `@keychain:myapp`;

  const appPath = `${appOutDir}/${appName}.app`;
  console.log(`beginning notarization for ${appPath}`);

  return notarize({
    appBundleId: 'com.semireg.LabelLIVE',
    appPath,
    appleId: '[email protected]',
    appleIdPassword: password,
    ascProvider: 'TEAMID'
  }).then(finished => {
    console.log(`finished notarization for ${appPath}`);
    return finished;
  });
};

Output during build:

  • electron-builder  version=21.1.2 os=18.6.0
  • loaded configuration  file=package.json ("build" field)
  • writing effective config  file=release/builder-effective-config.yaml
  • skipped dependencies rebuild  reason=npmRebuild is set to false
  • packaging       platform=darwin arch=x64 electron=4.2.8 appOutDir=release/mac
  • packaging       platform=mas arch=x64 electron=4.2.8 appOutDir=release/mas
  • signing         file=release/mas/Label LIVE.app identityName=Developer ID Application: Semireg Industries, LLC (ABC123) identityHash=ZEF123 provisioningProfile=none
  • signing         file=release/mac/Label LIVE.app identityName=Developer ID Application: Semireg Industries, LLC (ABC123) identityHash=ZEF123 provisioningProfile=none
  • signing         file=release/mas/Label LIVE.app identityName=3rd Party Mac Developer Application: Semireg Industries, LLC (ABC123) identityHash=LMNO provisioningProfile=build/embeddedyesmas.provisionprofile
beginning notarization for /Users/..../release/mac/Label LIVE.app
  • packaging       platform=mas arch=x64 electron=4.2.8 appOutDir=release/mas-dev
  • signing         file=release/mas-dev/Label LIVE.app identityName=Developer ID Application: Semireg Industries, LLC (ABC123) identityHash=ZEF123 provisioningProfile=none
  • signing         file=release/mas-dev/Label LIVE.app identityName=Mac Developer: Caylan Larson (ZZZZZZ) identityHash=XXXXXX provisioningProfile=build/embeddedyesmas.provisionprofile
finished notarization for /Users/..../release/mac/Label LIVE.app
✨  Done in 484.31s.

@develar, Any idea why this is trying to notarize the mac/Label LIVE.app? Shouldn't it be notarizing the mas/ and mas-dev/ files?

semireg · 2019-07-23T01:49:26Z

And of course, if I read the documentation it clearly states, "You can only notarize apps that you sign with a Developer ID certificate. If you use any other certificate—like a Mac App Distribution certificate, or a self-signed certificate—notarization fails with the following message:" - https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution/resolving_common_notarization_issues

There's this, though, that says we should be able to run MAS apps with a hardened runtime. https://forums.developer.apple.com/thread/111145?q=Notarize%20MAS%20*

Now... I need to figure out why a user reports that my Electron app throws an error on Catalina that looks very much like it's running in quarantine with a hardened runtime. This is what led me down this rabbit hole...

kspearrin · 2019-08-02T12:54:39Z

@semireg According to the output, I noticed that it seems to be signing mas apps twice:

 • signing         file=release/mas-dev/Label LIVE.app identityName=Developer ID Application: Semireg Industries, LLC (ABC123) identityHash=ZEF123 provisioningProfile=none
  • signing         file=release/mas-dev/Label LIVE.app identityName=Mac Developer: Caylan Larson (ZZZZZZ) identityHash=XXXXXX provisioningProfile=build/embeddedyesmas.provisionprofile

Shouldn't it only sign it once? Seems like Mac Developer: Caylan Larson is probably not the right one to sign a production app with?

I am having the same issue and noticed the same problem with mine. Still trying to figure this out.

UPDATE: Nevermind, that seems like it might be correct since this is a mas-dev build, which is signing with your dev identity.

quanglam2807 · 2019-08-13T16:46:46Z

I have the same issue with hardenRuntime: false. Downgrading to [email protected] fixes it.

poiru · 2019-08-24T01:14:46Z

Possibly related: #4179

stale · 2019-10-23T02:20:21Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

mayqiyue · 2019-10-23T04:23:03Z

stale[bot] <[email protected]>于2019年10月23日周三10:20写道：

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#4074?email_source=notifications&email_token=ABQZYVY67DRRVSMTX3C4QTTQP6YGZA5CNFSM4IFTMSE2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEB7ZYEA#issuecomment-545233936>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQZYV7G7TPDBQNJUXGUWP3QP6YGZANCNFSM4IFTMSEQ> .

nope

johannesjo · 2019-10-23T06:54:43Z

The stale bot is a jerk...

quanglam2807 · 2019-10-23T06:56:50Z

Well at least, the bot removed the label. We should be thankful.

quanglam2807 · 2019-12-20T03:50:35Z

After investigation, the bug is caused by this commit c8c37f2. hardenedRuntime is set to true by default. If you distribute your app on Mac App Store, set hardenedRuntime to false fixes the problem for me.

Still, if you distribute hardenedRuntime both on MAS and outside MAS, then you'll need to wait for a PR since you cannot disable hardenedRuntime for MAS alone. I'll make a PR soon.

johannesjo · 2020-06-18T23:41:05Z

@quanglam2807 Setting hardenedRuntime to false does not fix the error for me (using 22.7.0). Could you maybe share your config and the versions used of electron and electron builder?

quanglam2807 · 2020-06-22T10:57:36Z

@johannesjo This bug has been fixed in the latest version already so your change won’t help. It must be something else. Can you post the error?

johannesjo · 2020-06-22T11:10:55Z

@quanglam2807 It's the same error as above (though I am not sure atm if it did come in the 0x0, 0x1 or 0x2 flavor). I will recheck and post some more details as soon as I get access to my mac, which might unfortunately take a couple of days...

There are also some suggestions made here, which I will try then too. The error happens both for mas and mas dev.

johannesjo · 2020-06-22T21:41:53Z

So this is the exact error message:

Exception Type:        EXC_CRASH (Code Signature Invalid)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    Namespace CODESIGNING, Code 0x1

johannesjo · 2020-06-22T23:23:19Z

@quanglam2807 So this is a little bit embarrassing, but it turns out I was not running mas-dev, but rather the regular mas build and that's what seems to have caused the error. Very sorry for the inconvenience. In my defense: After switching config properties around for hours I tend to get a little dizzy

Thank you very much for your help!

semireg · 2020-06-22T23:24:44Z

@johannesjo, it's a terribly complicated system... Good luck!

StephanHoyer · 2021-10-11T13:42:42Z

Missing entitlements was the reason for me. I fixed this by adding those via cli args:

--entitlements=entitlements.plist --entitlements-inherit=entitlements.plist

the file looks like this

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.debugger</key>
    <true/>
  </dict>
</plist>

anl176 mentioned this issue Aug 8, 2019

Builder fails somewhat randomely #4098

Closed

This was referenced Aug 13, 2019

Fix Mac App Store build crashes at launch webcatalog/translatium-legacy#55

Merged

21.x Mac App Store: Provisioning profile ignored, platform 'mas' !== 'darwin' #4152

Closed

stale bot added the backlog label Oct 23, 2019

stale bot removed the backlog label Oct 23, 2019

This was referenced Dec 20, 2019

fix(mas): set hardenedRuntime to false by default for mas and mas-dev #4548

Merged

Fix MAS build shows blank white screen webcatalog/translatium-legacy#115

Merged

develar closed this as completed in #4548 Jan 16, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

EXC_BAD_ACCESS (Code Signature Invalid) MAS-DEV #4074

EXC_BAD_ACCESS (Code Signature Invalid) MAS-DEV #4074

steffanhalv commented Jul 21, 2019 •

edited

Loading

steffanhalv commented Jul 21, 2019 •

edited

Loading

mayqiyue commented Jul 22, 2019

mytran commented Jul 22, 2019

semireg commented Jul 22, 2019 •

edited

Loading

semireg commented Jul 23, 2019

kspearrin commented Aug 2, 2019 •

edited

Loading

quanglam2807 commented Aug 13, 2019

poiru commented Aug 24, 2019

stale bot commented Oct 23, 2019

mayqiyue commented Oct 23, 2019 via email

johannesjo commented Oct 23, 2019

quanglam2807 commented Oct 23, 2019

quanglam2807 commented Dec 20, 2019 •

edited

Loading

johannesjo commented Jun 18, 2020 •

edited

Loading

quanglam2807 commented Jun 22, 2020

johannesjo commented Jun 22, 2020

johannesjo commented Jun 22, 2020

johannesjo commented Jun 22, 2020 •

edited

Loading

semireg commented Jun 22, 2020

StephanHoyer commented Oct 11, 2021 •

edited

Loading

EXC_BAD_ACCESS (Code Signature Invalid) MAS-DEV #4074

EXC_BAD_ACCESS (Code Signature Invalid) MAS-DEV #4074

Comments

steffanhalv commented Jul 21, 2019 • edited Loading

steffanhalv commented Jul 21, 2019 • edited Loading

mayqiyue commented Jul 22, 2019

mytran commented Jul 22, 2019

semireg commented Jul 22, 2019 • edited Loading

semireg commented Jul 23, 2019

kspearrin commented Aug 2, 2019 • edited Loading

quanglam2807 commented Aug 13, 2019

poiru commented Aug 24, 2019

stale bot commented Oct 23, 2019

mayqiyue commented Oct 23, 2019 via email

johannesjo commented Oct 23, 2019

quanglam2807 commented Oct 23, 2019

quanglam2807 commented Dec 20, 2019 • edited Loading

johannesjo commented Jun 18, 2020 • edited Loading

quanglam2807 commented Jun 22, 2020

johannesjo commented Jun 22, 2020

johannesjo commented Jun 22, 2020

johannesjo commented Jun 22, 2020 • edited Loading

semireg commented Jun 22, 2020

StephanHoyer commented Oct 11, 2021 • edited Loading

steffanhalv commented Jul 21, 2019 •

edited

Loading

steffanhalv commented Jul 21, 2019 •

edited

Loading

semireg commented Jul 22, 2019 •

edited

Loading

kspearrin commented Aug 2, 2019 •

edited

Loading

quanglam2807 commented Dec 20, 2019 •

edited

Loading

johannesjo commented Jun 18, 2020 •

edited

Loading

johannesjo commented Jun 22, 2020 •

edited

Loading

StephanHoyer commented Oct 11, 2021 •

edited

Loading