electroncodesignelectron-builderelectron-packagerosx-gatekeeper

Why electron-osx-sign fails to produce a signed app recognised by Gatekeeper?

I'm trying to sign the stock electron app. Below is the script that I'm using. The issue is that gatekeeper complains that the app ("Electron") can’t be opened because the identity of the developer cannot be confirmed. Why is that? 

#!/bin/bash
set -e
identity="76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC"
rm -rf dist
mkdir -p dist/electron
wget -q -O dist/electron/electron.zip "https://github.com/electron/electron/releases/download/v3.0.3/electron-v3.0.3-darwin-x64.zip"
cd dist/electron
unzip -qq electron.zip

export DEBUG=electron-osx-sign*
electron-osx-sign Electron.app --gatekeeper-assess --identity="$identity" --identity-validation --platform=darwin --type=distribution --version=3.0.3

It appears to be signed "successfully" but after I archive/zip and upload and then download it it's no longer accepted by Gatekeeper (“Electron” can’t be opened because the identity of the developer cannot be confirmed.")

   electron-osx-sign:warn No `entitlements` passed in arguments:
 * Provide `entitlements` to specify entitlements file for codesign. +0ms
  [32;1melectron-osx-sign [0melectron-osx-sign@0.4.11 [32m+0ms[0m
  [32;1melectron-osx-sign [0m`identity` passed in arguments. [32m+8ms[0m
  [32;1melectron-osx-sign [0mExecuting... security find-identity -v [32m+1ms[0m
  [32;1melectron-osx-sign [0mIdentity: 
 > Name: Developer ID Application: XXX S.R.L (<masked>) 
 > Hash: 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC [32m+101ms[0m
  [32;1melectron-osx-sign [0mFound 1 identity. [32m+2ms[0m
  [32;1melectron-osx-sign [0mPre-sign operation enabled for provisioning profile: 
 * Disable by setting `pre-embed-previsioning-profile` to `false`. [32m+1ms[0m
  [32;1melectron-osx-sign [0mPre-sign operation enabled for entitlements automation with versions >= `1.1.1`: 
 * Disable by setting `pre-auto-entitlements` to `false`. [32m+0ms[0m
  [32;1melectron-osx-sign [0mNo `provisioning-profile` passed in arguments, will find in current working directory and in user library... [32m+1ms[0m
  [32;1melectron-osx-sign [0mNo provisioning profile found, will not embed profile in app contents. [32m+2ms[0m
  [32;1melectron-osx-sign [0mSigning application... 
 > Application: Electron.app 
 > Platform: darwin 
 > Entitlements: undefined 
 > Child entitlements: undefined 
 > Additional binaries: [] 
 > Identity: { name: 'Developer ID Application: XXX S.R.L (<masked>)',
  hash: '76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC' } [32m+0ms[0m
  [32;1melectron-osx-sign [0mWalking... Electron.app/Contents [32m+4ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework [32m+29ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib [32m+2s[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib [32m+312ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler [32m+474ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Framework.framework [32m+275ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Framework.framework [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Helper EH.app/Contents/MacOS/Electron Helper EH [32m+1s[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Helper EH.app/Contents/MacOS/Electron Helper EH [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Helper EH.app [32m+272ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Helper EH.app [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Helper NP.app/Contents/MacOS/Electron Helper NP [32m+284ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Helper NP.app/Contents/MacOS/Electron Helper NP [32m+1ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Helper NP.app [32m+277ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Helper NP.app [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Helper.app/Contents/MacOS/Electron Helper [32m+290ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Helper.app/Contents/MacOS/Electron Helper [32m+1ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Electron Helper.app [32m+275ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Electron Helper.app [32m+1ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle [32m+278ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Mantle.framework [32m+278ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Mantle.framework [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa [32m+280ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/ReactiveCocoa.framework [32m+287ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/ReactiveCocoa.framework [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt [32m+295ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel [32m+284ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/Frameworks/Squirrel.framework [32m+286ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/Frameworks/Squirrel.framework [32m+0ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app/Contents/MacOS/Electron [32m+285ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app/Contents/MacOS/Electron [32m+1ms[0m
  [32;1melectron-osx-sign [0mSigning... Electron.app [32m+297ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --sign 76BC42C9D40AFBAE569D5B041940B97C4BEB0DFC --force Electron.app [32m+0ms[0m
  [32;1melectron-osx-sign [0mVerifying... [32m+404ms[0m
  [32;1melectron-osx-sign [0mVerifying application bundle with codesign... [32m+1ms[0m
  [32;1melectron-osx-sign [0mExecuting... codesign --verify --deep --strict --verbose=2 Electron.app [32m+0ms[0m
  [32;1melectron-osx-sign [0mVerifying Gatekeeper acceptance for darwin platform... [32m+659ms[0m
  [32;1melectron-osx-sign [0mExecuting... spctl --assess --type execute --verbose --ignore-cache --no-cache Electron.app [32m+0ms[0m
  [32;1melectron-osx-sign [0mVerified. [32m+1s[0m
  [32;1melectron-osx-sign [0mApplication signed. [32m+0ms[0m
  [32;1melectron-osx-sign [0mApplication signed: Electron.app [32m+0ms[0m
Application signed: Electron.app
Solution

  • It seems that the issue was due the use of "zip" utility. This does not preserve the extra file attributes generated by codesign. I'm using ditto and the signature is successfully validated after download.