xcodemacosxcode10macos-mojavesparkle

Xcode 10 notarization issue with Sparkle about Hardened Runtime for Autoupdate.app and fileop

As Apple introduced new notarization process for apps distributing outside of Mac App Store, I am getting this error when I try to submit my application for notarization, which has Sparkle framework installed via CocoaPods.

Hardened Runtime Error

The error was first encountered for all bundles included in my app (helper app and other frameworks), however they all went away except these two mentioned bundles of Sparkle, after I enable Hardened Runtime with exceptions shown below through Project editor.

Enabled Hardened Runtime

I am not well informed about the guidelines of this new notarization, as it just went out and I have already seen WWDC 2018 presentation about it and could not find any other documentation.

Any ideas how to enable hardened runtime for Sparkle's Autoupdate.app and fileop? Or is it just impossible for Sparkle like enabling sandbox, as the auto update procedure requires access to other apps?

Solution

  • The current release of Sparkle, 1.22.0rc1, has the "Hardened Runtime" build option enabled, but Apple's service still rejects it if you just include it with your app. There is also no hardened runtime option for fileop available when compiling.

    But you can use it anyway, no need to rebuild it. Just add a Run Script to your Build Phases like this:

    Build Phases

    Here is the script (from the GitHub discussion):

    LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"

# By default, use the configured code signing identity for the project/target
IDENTITY="${CODE_SIGN_IDENTITY}"
if [ "$IDENTITY" == "" ]
then
# If a code signing identity is not specified, use ad hoc signing
IDENTITY="-"
fi
codesign --verbose --force --deep -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A/Resources/AutoUpdate.app"
codesign --verbose --force -o runtime --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/A"