JavaFx dmg bundle signed with COMODO certificate

Question

I created a JavaFx application and I create multiplatform native bundles. Actually I created Windows and Mac OsX bundles successfully. Now I want sign my bundles to avoid annoying alert during the installation. I purchased a Comodo cert and in Windows I'm able to sign my exe file correctly.

On Mac, instead, I've problems. I followed this tutorial https://docs.oracle.com/javafx/2/deployment/self-contained-packaging.htm#BCGDBIBB, and I imported in my Keychain the Comodo certificate.

I created a post image script:

echo "Signing application bundle"
#Move to the folder containing application bundle
cd ../images/dmg.image
#do sign
codesign -s "CN_OF_COMODO_CERTIFICATE" *.app
echo "Done with signing"

but during compilation I've these messages:

do-deploy:

 [copy] Copying 47 files to /Users/Utente/Documents/workspaceServer

/app/javafx/target/dist/libs

Using base JDK at: /Library/Java/JavaVirtualMachines/jdk1.8.0_60.jdk

Using base JDK at: /Library/Java/JavaVirtualMachines/jdk1.8.0_60.jdk

  Using custom package resource [Bundle config file]  (loaded from package/macosx/Info.plist)

  Using custom package resource [icon]  (loaded from package/macosx/appDesk.icns)

Creating app bundle: /Users/Utente/Documents/workspaceServer/app/javafx/target/deploy/bundles/appDesk.app

Did not find a key matching 'Developer ID Application: '

  Config files are saved to /var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler309272187389884092/macosx. Use them to customize package.

Building DMG package for appDesk

  Using custom package resource [Bundle config file]  (loaded from package/macosx/Info.plist)

  Using custom package resource [icon]  (loaded from package/macosx/appDesk.icns)

Did not find a key matching 'Developer ID Application: '

  Config files are saved to /var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8772000028741891358/macosx. Use them to customize package.

  Using default package resource [dmg background]  (add package/macosx/appDesk-background.png to the class path to customize)

  Using default package resource [volume icon]  (add package/macosx/appDesk-volume.icns to the class path to customize)

  Using custom package resource [script to run after application image is populated]  (loaded from package/macosx/appDesk-post-image.sh)

  Using default package resource [License setup]  (add package/macosx/appDesk-license.plist to the class path to customize)

  Using default package resource [DMG setup script]  (add package/macosx/appDesk-dmg-setup.scpt to the class path to customize)

Running shell script on application image [/var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8772000028741891358/macosx/appDesk-post-image.sh]

Signing application bundle

*.app

: No such file or directory

Done with signing

hdiutil: unflatten: unflattening "appDesk-3.0.3.dmg"...

copying resource 'STR#' (5000)...

copying resource 'STR#' (5001)...

copying resource 'STR#' (5002)...

copying resource 'STR#' (5003)...

copying resource 'STR#' (5004)...

copying resource 'STR#' (5005)...

copying resource 'STR#' (5006)...

copying resource 'STR#' (5007)...

copying resource 'STR#' (5008)...

copying resource 'STR#' (5009)...

copying resource 'STR#' (5010)...

copying resource 'STR#' (5011)...

copying resource 'STR#' (5012)...

copying resource 'STR#' (5013)...

copying resource 'STR#' (5014)...

copying resource 'STR#' (5015)...

copying resource 'STR#' (5016)...

copying resource 'plst' (0)...

copying resource 'TEXT' (5000)...

copying resource 'LPic' (5000)...

copying resource 'styl' (5000)...

copying resource 'TMPL' (128)...

hdiutil: flatten: flattening "appDesk-3.0.3.dmg"...

Result DMG installer for appDesk: /Users/Utente/Documents/workspaceServer/app/javafx/target/deploy/bundles/appDesk-3.0.3.dmg

  Config files are saved to /var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8772000028741891358/macosx. Use them to customize package.

Building PKG package for appDesk

  Using custom package resource [Bundle config file]  (loaded from package/macosx/Info.plist)

  Using custom package resource [icon]  (loaded from package/macosx/appDesk.icns)

Did not find a key matching 'Developer ID Application: '

  Config files are saved to /var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8003647333686847937/macosx. Use them to customize package.

  Using default package resource [pkg background image]  (add package/macosx/appDesk-background.png to the class path to customize)

  Using custom package resource [script to run after application image is populated]  (loaded from package/macosx/appDesk-post-image.sh)

Running shell script on application image [/var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8003647333686847937/macosx/appDesk-post-image.sh]

Signing application bundle

{}

*.app

: No such file or directory

Done with signing

pkgbuild: Adding component at /var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8003647333686847937/images/image-5462634906848679457/appDesk.app

pkgbuild: Wrote package to /var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8003647333686847937/packages/appDesk-app.pkg

Did not find a key matching 'Developer ID Installer: '

productbuild: Wrote product to /Users/Utente/Documents/workspaceServer/app/javafx/target/deploy/bundles/appDesk-3.0.3.pkg

  Config files are saved to /var/folders/q6/vmt_h0tx3rgdbt_4h2_2f3780000gn/T/fxbundler8003647333686847937/macosx. Use them to customize package.

Did not find a key matching '3rd Party Mac Developer Application: '

Bundler Mac App Store Ready Bundler skipped because of a configuration problem: No Mac App Store App Signing Key  

Advice to fix: Install your app signing keys into your Mac Keychain using XCode.

BUILD SUCCESSFUL
Total time: 3 minutes 59 seconds

Any idea how to solve this problem and automatically sign the dmg during the build?

===== EDITED ========= This is my Info.plist file as required:

<?xml version="1.0" ?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
 <dict>
  <key>LSMinimumSystemVersion</key>
  <string>10.7.4</string>
  <key>CFBundleDevelopmentRegion</key>
  <string>English</string>
  <key>CFBundleAllowMixedLocalizations</key>
  <true/>
  <key>CFBundleExecutable</key>
  <string>appDesk</string>
  <key>CFBundleIconFile</key>
  <string>appDesk.icns</string>
  <key>CFBundleIdentifier</key>
  <string>fxApplication</string>
  <key>CFBundleInfoDictionaryVersion</key>
  <string>6.0</string>
  <key>CFBundleName</key>
  <string>appDesk</string>
  <key>CFBundlePackageType</key>
  <string>APPL</string>
  <key>CFBundleShortVersionString</key>
  <string>3.0.4</string>
  <key>CFBundleSignature</key>
  <string>????</string>
  <!-- See http://developer.apple.com/library/mac/#releasenotes/General/SubmittingToMacAppStore/_index.html
       for list of AppStore categories -->
  <key>LSApplicationCategoryType</key>
  <string>Unknown</string>
  <key>CFBundleVersion</key>
  <string>3.0.4</string>
  <key>NSHumanReadableCopyright</key>
  <string>Copyright</string>
  <key>NSHighResolutionCapable</key>
  <string>true</string>
 </dict>
</plist>

Thanks

The tutorial you've referenced is for JavaFX 2.x. Did you follow this [guide](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html#//apple_ref/doc/uid/TP40005929-CH1-SW1) to get your Apple Developer Certificate (not the same as your Comodo Certificate)? — aw-think, Sep 11 '15 at 06:30
I wanted use the Comodo certificate because I don't want pay 2 different certificates if possible. — drenda, Sep 11 '15 at 10:00
Yes it's possible to use your bought certificate. But the "Developer ID Application:" is not your valid certificate, you have to name it like the certificate path in your comodo is called. — aw-think, Sep 11 '15 at 10:18
Would be interesting know where to put the Developer id Application in javafx application. Thanks — drenda, Sep 11 '15 at 13:55
You need to read the manual part [SIGNING IDENTITIES](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/codesign.1.html#//apple_ref/doc/man/1/codesign) of `codesign` tool. — aw-think, Sep 11 '15 at 14:04
I edited the question; infact I yet use the common name of the certificate in my post image script. Unfortunately, how you can see, the alert "Did not find a key matching 'Developer ID Application: " appears BEFORE my post image script is run! Seems javafx script use an empty id....ideas? — drenda, Sep 12 '15 at 10:05
Can you please post the content of the `Info.plist` file? The content should fit to your certificate. And you should explicitly name your application in running the codesign tool, because it doesn't find your app file. — aw-think, Sep 14 '15 at 08:35
You should write the specific used java-version, as some of the older ones are containing bugs. What version of the JDK are you using? — FibreFoX, Dec 17 '15 at 14:13
I'm using JDK 8u74. I also enrolled Apple developer program. But maybe is needed to sign both the installer and the application. — drenda, Mar 14 '16 at 08:53

score -1 · Answer 1 · answered Dec 24 '16 at 08:55

It is not very complicated if you have the right tool. Just download amipackage ( https://amidb.com/amipackage ) and run:

 cd /Applications/amipackage.app/Contents/scripts
 chmod a+x ./amipackage.sh
 ./amipackage.sh --config=/Users/jsmith/cooljavaapp.properties

It generates dmg, xcarchives etc...

Disclaimer : I'm involved with amipackage

JavaFx dmg bundle signed with COMODO certificate

1 Answers1