notarization rejects my app with: The signature of the binary is invalid

Question

I'm trying to codesign/notarize an existing app on macOS 10.15 / XCode 12.4.

This is my workflow:

as my app is Qt-based, I'm using this Recipe OSX Code-Signing Qt to fix the app-bundle;
sign with codesign -vvv --force --options runtime --deep --sign "Developer ID Application: ..." --entitlements myApp.entitlements myApp.app
package the .app with zip -rqy
upload it to notarization with xcrun altool --notarize-app ...

This is the notarization log:

{
  "logFormatVersion": 1,
  "jobId": "b864c16d-d8dc-464e-aa4f-c2eea5ff6ac4",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "myApp-signed.zip",
  "uploadDate": "2022-07-18T12:25:04Z",
  "sha256": "c324a9ba88dbbaf0e5c325b48c2c22744886d68d450835b0724c7c70258784c2",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "myApp-signed.zip/myApp.app/Contents/MacOS/myApp",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    }
  ]
}

but if I look at the signature of that file which is still in the status as when it was uploaded to notarization:

$ codesign -dvv myApp.app/Contents/MacOS/myApp
Executable=/path/to/myApp.app/Contents/MacOS/myApp
Identifier=com.myapp
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20500 size=1580 flags=0x10000(runtime) hashes=40+5 location=embedded
Signature size=8977
Authority=Developer ID Application: My Name (ID)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=18 Jul 2022 at 15:09:09
Info.plist entries=10
TeamIdentifier=6RVQYWZ74B
Runtime Version=11.1.0
Sealed Resources version=2 rules=13 files=4529
Internal requirements count=1 size=192

(additionally, after codesign/altool the app won't start anymore, but this is a different issue)

What is the problem with the main executable of my app?

Interesting, we do not use that recipe and our app works fine. — László Papp, Jul 18 '22 at 17:39
@ChidiWilliams yes `--deep` doesn't work well. Additional binaries inside the bundle needed to be signed individually, but then that would break the signature, and the app bundle needs to be re-signed. — fferri, Oct 17 '22 at 10:12

Nils Hendriksen · Answer 1 · 2022-10-20T11:38:10.083

0

Another thing that might cause "The signature of the binary is invalid": I had an Info.plist file that had Windows line endings. When I changed to unix line endings, the notarization succeeded. Took me a while to figure out what was wrong...

edited Oct 20 '22 at 11:38

answered Oct 20 '22 at 11:36

Nils Hendriksen

1
2

score 0 · Answer 2 · answered Nov 29 '22 at 09:06

0

My problem was that I signed .app with Installer signature. I needed to use App signature

answered Nov 29 '22 at 09:06

tonisives

1,962
1
18
17

notarization rejects my app with: The signature of the binary is invalid

2 Answers2