macOS packager produces invalid signature

[hichemfantar]

Pre-flight checklist

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project uses.
• I have searched the issue tracker for a bug that matches the one I want to file, without success.

Electron Forge version

7.5.0

Electron version

v33.2.0

Operating system

Version 14.3.1

Last known working Electron Forge version

No response

Expected behavior

signature verification should pass otherwise the app will fail to work properly (e.g. it will not ask for permissions when required)

if the signature is broken then permission popups like the one below will not show up to the user when necessary

Actual behavior

signature fails verification which causes errors when trying to ask for permissions during runtime

Steps to reproduce

1. clone https://github.com/hichemfantar/my-new-electron-app which is based the on the vite typescript template
2. npm run package
3. cd into packaged app out/make/zip/darwin/arm64
4. verify signature codesign --verify --deep --strict --verbose=2 ./my-new-electron-app.app
5. error ./my-new-electron-app.app: invalid Info.plist (plist or signature have been modified) In architecture: arm64

it seems like the cause is some generated keys are incorrect in out/make/zip/darwin/arm64/my-new-electron-app.app/Contents/_CodeSignature/CodeResources

for example: one of the keys is <key>Frameworks/Electron Helper (GPU).app</key>
but it should be: <key>Frameworks/my-new-electron-app Helper (GPU).app</key>

current solution is to manually sign (which produces the correct keys in CodeResources:

1. re-sign with codesign --force --deep --sign - ./my-new-electron-app.app
2. output ./my-new-electron-app.app: replacing existing signature
3. verify again codesign --verify --deep --strict --verbose=2 ./my-new-electron-app.app
4. output: ./my-new-electron-app.app: valid on disk \n ./my-new-electron-app.app: satisfies its Designated Requirement

Additional information

related to #3754

[MarshallOfSound]

Please don't re-raise issues, threads and discussions can continue on old issues...

[hichemfantar]

my bad i thought you wanted me to create a new issue, should i move back to the original issue?

[MarshallOfSound]

I just took a look at this repro and my original comment in the old issue is still correct. Your app isn't codesigned because you aren't codesigning it properly 🤷

There are two types of "code signature" on macOS (warning, over simplification):

• Adhoc signatures, these are signatures generated by build tools and are only "valid" on your local machine, the app has no identity but can run in certain cases
• Real signatures, these signatures are generated by codesign using a real Developer ID certificate and are valid on any mac worldwide, your app has a persistant identity and can always run

Because you haven't configured packagerConfig.osxSign your app is not being signed at all, the reason you're seeing an "invalid" signature is because the FusesPlugin under the hood uses @electron/fuses which generates a temporary adhoc signature when you flip fuses. The packaging process then immediately invalidates this adhoc signature however which is the error you're seeing, if you remove the FusesPlugin from your Forge Config (which you shouldn't do but can do for testing) you'll see your resulting app isn't signed at all as expected.

TLDR: Get a real macOS code signing certificate and configure it correctly in packagerConfig.osxSign

[hichemfantar]

Thanks for the explanation!