Problems signing LispWorks heap (lwheap) for submission to Apple Store

I think this may be something new on Apple's end:

The main app bundle KnowledgeGraphNavigator at path KnowledgeGraphNavigator.app has following signing error(s): code object is not signed at all In subcomponent: /Volumes/data01/app_data/app-processing/mz_11325329480666776957dir/mz_16313398428303528586dir/com.knowledgegraphnavigator.kgn.pkg/Payload/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap .

I use --deep on codesign, and I have tried explicitly signing the heap and then signing the app.

I use the :split option on creating my application, and I don't recall having this problem before. Any references to relavent LispWorks specific documentation, relevant blogs, etc. would be appreciated.

info on my app: http://www.knowledgegraphnavigator.com/

Mark Watson, consultant and author of 20+ books: https://markwatson.com

It is better to travel well than to arrive.. - Buddha

Re: Problems signing LispWorks heap (lwheap) for submission to Apple Store

Hi Mark

We released an update of our app in Mac App Store last week without any problems.

Maybe you can get some hints by looking in "Contents/_CodeSignature/CodeResources" or running "codesign -vvvv” on your app.

FWIW This is how we code sign for Mac App Store:

codesign -f --deep --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our app>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 1st helper app inside Contents/Helpers>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 2nd helper app inside Contents/Helpers>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 3rd helper app inside Contents/Helpers>
productbuild --sign "<our 3rd Party Mac Developer Installer certificate>" --component <our app> /Applications <output pkg>

Regards,

Sven

19 maj 2020 kl. 20:25 skrev Mark Watson <markw@markwatson.com>:

I think this may be something new on Apple's end:

The main app bundle KnowledgeGraphNavigator at path KnowledgeGraphNavigator.app has following signing error(s): code object is not signed at all In subcomponent: /Volumes/data01/app_data/app-processing/mz_11325329480666776957dir/mz_16313398428303528586dir/com.knowledgegraphnavigator.kgn.pkg/Payload/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap .

I use --deep on codesign, and I have tried explicitly signing the heap and then signing the app.

I use the :split option on creating my application, and I don't recall having this problem before. Any references to relavent LispWorks specific documentation, relevant blogs, etc. would be appreciated.

info on my app: http://www.knowledgegraphnavigator.com/

Mark Watson, consultant and author of 20+ books: https://markwatson.com

It is better to travel well than to arrive. - Buddha

Re: Problems signing LispWorks heap (lwheap) for submission to Apple Store

Thanks Sven.

The signing seems to work without warnings, but my signed app crashes, while the unsigned app runs fine.

The Mac Console app provides:

/Users/markw/KnowledgeGraphNavigator/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap: Possible race detected. Rejecting.

[executable<KnowledgeGraphNavigator(501)>:1582] Death sentinel fired!

One thing that looks odd is that while the Lisp heap file KnowledgeGraphNavigator.app/Contents/MacOS/ KnowledgeGraphNavigator.lwheap gets signed, the actual application KnowledgeGraphNavigator.app/Contents/MacOS/ KnowledgeGraphNavigator does not:

$ codesign -vvvv KnowledgeGraphNavigator.app

--prepared:/Users/markw/KnowledgeGraphNavigator/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap

--validated:/Users/markw/KnowledgeGraphNavigator/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap

KnowledgeGraphNavigator.app: valid on disk

KnowledgeGraphNavigator.app: satisfies its Designated Requirement

It seems like "codesign --force and -deep ..." should have picked up the small application executable file.

On Wed, May 20, 2020, at 12:50 AM, Sven Emtell wrote:

Hi Mark
We released an update of our app in Mac App Store last week without any problems.
Maybe you can get some hints by looking in "Contents/_CodeSignature/CodeResources" or running "codesign -vvvv” on your app.

FWIW This is how we code sign for Mac App Store:
codesign -f --deep --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our app>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 1st helper app inside Contents/Helpers>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 2nd helper app inside Contents/Helpers>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 3rd helper app inside Contents/Helpers>
productbuild --sign "<our 3rd Party Mac Developer Installer certificate>" --component <our app> /Applications <output pkg>

Regards,
Sven

19 maj 2020 kl. 20:25 skrev Mark Watson <markw@markwatson.com>:

I think this may be something new on Apple's end:

The main app bundle KnowledgeGraphNavigator at path KnowledgeGraphNavigator.app has following signing error(s): code object is not signed at all In subcomponent: /Volumes/data01/app_data/app-processing/mz_11325329480666776957dir/mz_16313398428303528586dir/com.knowledgegraphnavigator.kgn.pkg/Payload/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap .

I use --deep on codesign, and I have tried explicitly signing the heap and then signing the app.

I use the :split option on creating my application, and I don't recall having this problem before. Any references to relavent LispWorks specific documentation, relevant blogs, etc. would be appreciated.

info on my app: http://www.knowledgegraphnavigator.com/

Mark Watson, consultant and author of 20+ books: https://markwatson.com

It is better to travel well than to arrive. - Buddha

Mark Watson, consultant and author of 20+ books: https://markwatson.com

It is better to travel well than to arrive. - Buddha

Re: Problems signing LispWorks heap (lwheap) for submission to Apple Store

Seeing the "Death sentinel fired!” in your console excerpt reminded me that we had a similar problem last fall and that Martin Simmons at LispWorks issued a patch to us called "save-image-split-frameworks” which solved the problem. You could contact Martin to see if you also need the patch.

I have seen that "codesign —deep” does not always sign all binaries in sub directories, but the reason that we sign our helper apps separately is because their entitlements are different from the main apps. Their entitlements are set to inherit the main apps entitlements. Unfortunately I didn’t do this distinction in the codesign listing below but used "<our app entitlements>” everywhere.

/Sven

20 maj 2020 kl. 16:29 skrev Mark Watson <markw@markwatson.com>:

Thanks Sven.

The signing seems to work without warnings, but my signed app crashes, while the unsigned app runs fine.

The Mac Console app provides:

/Users/markw/KnowledgeGraphNavigator/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap: Possible race detected. Rejecting.
[executable<KnowledgeGraphNavigator(501)>:1582] Death sentinel fired!

One thing that looks odd is that while the Lisp heap file KnowledgeGraphNavigator.app/Contents/MacOS/ KnowledgeGraphNavigator.lwheap gets signed, the actual application KnowledgeGraphNavigator.app/Contents/MacOS/ KnowledgeGraphNavigator does not:

$ codesign -vvvv KnowledgeGraphNavigator.app
--prepared:/Users/markw/KnowledgeGraphNavigator/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap
--validated:/Users/markw/KnowledgeGraphNavigator/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap
KnowledgeGraphNavigator.app: valid on disk
KnowledgeGraphNavigator.app: satisfies its Designated Requirement

It seems like "codesign --force and -deep ..." should have picked up the small application executable file.

On Wed, May 20, 2020, at 12:50 AM, Sven Emtell wrote:
Hi Mark
We released an update of our app in Mac App Store last week without any problems.
Maybe you can get some hints by looking in "Contents/_CodeSignature/CodeResources" or running "codesign -vvvv” on your app.

FWIW This is how we code sign for Mac App Store:
codesign -f --deep --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our app>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 1st helper app inside Contents/Helpers>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 2nd helper app inside Contents/Helpers>
codesign -f --sign "<our 3rd Party Mac Developer Application certificate>" -v --entitlements <our app entitlements> --options runtime <our 3rd helper app inside Contents/Helpers>
productbuild --sign "<our 3rd Party Mac Developer Installer certificate>" --component <our app> /Applications <output pkg>

Regards,
Sven

19 maj 2020 kl. 20:25 skrev Mark Watson <markw@markwatson.com>:

I think this may be something new on Apple's end:

The main app bundle KnowledgeGraphNavigator at path KnowledgeGraphNavigator.app has following signing error(s): code object is not signed at all In subcomponent: /Volumes/data01/app_data/app-processing/mz_11325329480666776957dir/mz_16313398428303528586dir/com.knowledgegraphnavigator.kgn.pkg/Payload/KnowledgeGraphNavigator.app/Contents/MacOS/KnowledgeGraphNavigator.lwheap .

I use --deep on codesign, and I have tried explicitly signing the heap and then signing the app.

I use the :split option on creating my application, and I don't recall having this problem before. Any references to relavent LispWorks specific documentation, relevant blogs, etc. would be appreciated.

info on my app: http://www.knowledgegraphnavigator.com/

Mark Watson, consultant and author of 20+ books: https://markwatson.com

It is better to travel well than to arrive. - Buddha

Mark Watson, consultant and author of 20+ books: https://markwatson.com

It is better to travel well than to arrive. - Buddha