Notarize process for macos application not working

Question

I have developed an application for MacOS. I am including notarization process as part of its distribution. I have followed all the steps and I have run:

xcrun altool --notarize-app --primary-bundle-id "${APP_BUNDLE_ID}" --username "${APPLE_DEV_ID}" --password "${DEV_APP_SPECIFIC_PASSWORD}" --file "${DMG_PATH}"

Then I check notarization progress using:

xcrun altool --notarization-info "${notarize_uuid}"  -u "${APPLE_DEV_ID}" -p "${DEV_APP_SPECIFIC_PASSWORD}

Output of it is:

RequestUUID: =<Request>  
      Date: 2019-05-26 09:40:34 +0000  
    Status: success  
    LogFileURL: <Log file>  
    Status Code: 0  
    Status Message: Package Approved =~ success ]]

Then I launch staple command:

xcrun stapler staple -v <dmg file>

It also ends with success:

The staple and validate action worked!

However when I extract the .app file and run:

spctl --assess --verbose ./macos/MyApp.app  
./macos/MyApp.app/: accepted

According to the docs I have read it should say something like: “source=Notarized Developer ID”, right?

I am running this on MacOS Mojave 10.14.5

What am I missing??

Could someone help me?

Thanks in advance

score 0 · Answer 1 · answered May 27 '19 at 17:58

0

In case someone faces the same problem I will post the solution to this:

First of all you must staple .app file not the dmg. This means you must extract the binary and staple it

Also in order to check if application has been notarized, in

`System Preferences - Security and Privacy`

Option Allow apps downloaded from: must have Apple Store and identifier developers option checked

Hope this helps

answered May 27 '19 at 17:58

RuLoViC

825
7
23

I staple the dmg file and it always works fine and I get "source=Notarized Developer ID" – laocius May 31 '19 at 00:52
@laocius Are you getting message "Apple checked it for malicious software and none was detected " on launching app ? – Parag Bafna Jul 12 '19 at 05:40
@ParagBafna No, I am on Mojave 10.14.5, btw. – laocius Jul 12 '19 at 07:47
@laocius I followed all steps from [Customizing the Notarization Workflow](https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution/customizing_the_notarization_workflow#3087720). spctl command is showing "Notarized Developer ID" but I don't see new message from gatekeeper. I verified it on 10.15 – Parag Bafna Jul 12 '19 at 07:50
1

@ParagBafna So, you are on Catalina. That would explain it. I think Apple made notarization mandatory in Catalina. – laocius Jul 15 '19 at 00:20

score 0 · Answer 2 · answered Jun 18 '19 at 08:30

0

Both the app and the dmg may be notarized and stapled, seperately, one after the other. Try doing that and the error should go away.

answered Jun 18 '19 at 08:30

Richard Barber

5,257
2
15
26

This is not true, only the DMG needs to be notarized. – m7913d Dec 04 '19 at 09:18

score 0 · Answer 3 · answered Dec 04 '19 at 09:17

Short answer

It could be due to an RPATH referencing a path outside the App bundle. Removing this RPATH would resolve the issue.

Inspecting log files

You can find extra information about the rejection (after trying to launch the blocked app) in the Console.app. Note that you should open the Console.app, before trying to open your blocked app, otherwise not all messages may be logged. You should look for process XprotectService in the logs of your device (i.e. choose your device in the left side bar of the Console.app). If the RPATH is indeed the problem, you should find a record like this:

XprotectService: [com.apple.xprotect:xprotect] File /path/to/your/executable/or/library failed on rPathCmd /rpath/causing/the/problem (rpath resolved to: (path not found), bundleURL: /path/to/your/bundle.app)

Inspecting these log files may give you a key to solve other issues too.

Note that I received the following information from an Apple engineer:

Gatekeeper does not inform users via UI about the specifics of the error, though it is in the logs for developers to look at. The notarization process is purely about a detecting malicious software and does not replicate Gatekeeper enforcement. You still need to get software notarized and test with Gatekeeper.

We are looking to provide better tooling for developers in the future to pre-flight some of these common errors.

Contact Apple

If you are not able to solve your issue with the above information, you may want to contact Apple itself using the Feedback Assistant. They do not respond very quickly (~1-2 weeks), but the answers are rather to the point.

Notarize process for macos application not working

3 Answers3