Code signing fails with a simple rejected during packaging:
Packaging ApplicationWARNING: Code sign failed; please retry manually. Error: Command failed: spctl --assess --type execute --verbose --ignore-cache --no-cache /var/folders/kw/fp514mmd4djdrld7q8_ttp4r0000gr/T/electron-packager/darwin-x64/myapp-darwin-x64/myapp.app
/var/folders/kw/fp514mmd4djdrld7q8_ttp4r0000gr/T/electron-packager/darwin-x64/myapp-darwin-x64/myapp.app: rejected
After notarization, the app crashes with this error:
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid))
Exception Codes: UNKNOWN_0x32 at 0x0000001e0000a5c0
Exception Codes: 0x0000000000000032, 0x0000001e0000a5c0
Exception Note: EXC_CORPSE_NOTIFY
Termination Reason: Namespace CODESIGNING, Code 2
These are my packaging options in electron.config.js:
osxSign: {
identity:
'Developer ID Application: ### (###)',
},
osxNotarize: {
appleId: '###',
appleIdPassword: '###',
teamId: '###',
ascProvider: '###',
},
The certificate is listed in Xcode, Keychain Access and in security find-identity -p codesigning -v without warnings and with the related private key attached. I specified it in my config after experiencing the same behavior with the default configuration.
Any ideas what else to try, or what causes the rejection?
The problem was that New provisioning profiles / certificates require notarization to pass spctl checks. So gatekeeperAssess needs to be set to false for spctl. My version of #electron/osx-sign was outdated and did not take that into account. I had to update #electron-forge/* to >=6.0.4
This error message is displaying:
An unknown server-side error occurred while processing the command. Original error: Error executing adbExec. Original error: 'Command 'F:\\gautam\\android\\platform-tools\\adb.exe -P 5037 -s 192.168.0.115\:5555 shell settings delete global hidden_api_policy_pre_p_apps' exited with code 255'; Stderr: 'Security exception: Permission denial: writing to settings requires:android.permission.WRITE_SECURE_SETTINGS
java.lang.SecurityException: Permission denial: writing to settings requires:android.permission.WRITE_SECURE_SETTINGS
at com.android.providers.settings.SettingsProvider.enforceWritePermission(SettingsProvider.java:1815)
at com.android.providers.settings.SettingsProvider.mutateGlobalSetting(SettingsProvider.java:1023)
at com.android.providers.settings.SettingsProvider.deleteGlobalSetting(SettingsProvider.java:1006)
at com.android.providers.settings.SettingsProvider.delete(SettingsProvider.java:592)
at android.content.ContentProvider$Transport.delete(ContentProvider.java:343)
at com.android.providers.settings.SettingsService$MyShellCommand.deleteForUser(SettingsService.java:406)
at com.android.providers.settings.SettingsService$MyShellCommand.onCommand(SettingsService.java:289)
at android.os.ShellCommand.exec(ShellCommand.java:103)
at com.android.providers.settings.SettingsService.onShellCommand(SettingsService.java:51)
at android.os.Binder.shellCommand(Binder.java:634)
at android.os.Binder.onTransact(Binder.java:532)
at android.os.Binder.execTransact(Binder.java:735)'; Code: '255'`enter code here
An error tells you: Stderr: 'Security exception: Permission denial: writing to settings requires:android.permission.WRITE_SECURE_SETTINGS
Try following steps:
In your phone developer options (Security settings), enable USB Debugging or (or and) Disable permission monitoring. All of these settings are in your dev options.
I'm really scratching my head on this one, and have spent around 1.5 days on trying to resolve the problem
the problem I think has to do with permissions that somehow got reset -
I suspect it happened after I got boot camp assistant to partition for windows dual boot
Environment:
Writing selenium test cases in typescript, using Alsatian and Zalenium frameworks over ts-node - the following command being used to initialise the test runner
yarn run ts-node Tests/runner.ts --tap
yarn environment is running through brew
package.json:
{
"dependencies": {
"#types/dotenv": "^4.0.2",
"#types/selenium-webdriver": "^3.0.8",
"alsatian": "^2.2.1",
"axios": "^0.17.1",
"dotenv": "^5.0.0",
"moment": "^2.20.1",
"selenium-webdriver": "^4.0.0-alpha.1",
"tap-spec": "^4.1.1",
"ts-node": "^4.1.0",
"tslib": "1.8.1",
"typescript": "^2.6.2"
}
}
runner.ts:
import tapSpec = require('tap-spec');
import { TestSet, TestRunner } from "alsatian";
import { config as dotenv } from 'dotenv';
(async () =>
{
// Load up any pseudo environment variables
dotenv({ path: __dirname + '/../.env' });
// Setup the alsatian test runner
let testRunner = new TestRunner();
let tapStream = testRunner.outputStream;
let testSet = TestSet.create();
testSet.addTestsFromFiles('/**/*/*.spec.ts');
// This will output a human readable report to the console.
tapStream.pipe(tapSpec()).pipe(process.stdout);
// Runs the tests
await testRunner.run(testSet);
})()
.catch(e =>
{
console.error(e);
process.exit(1);
});
Problem:
I suspect the problems started after I installed dual boot windows using bootcamp assistant
I worked in windows for 3-4 days on another project and when I came back, started getting permission problems
initially they were along the lines of { Error: EACCES: permission denied, scandir '/Library/Application Support/xxxx'
which I resolved using chmod as stated below - now I'm stuck - read points 7 and 8, I don't know whats causing the problem - but I suspect it's yarn permissions
I had - also updated to typescript 2.7.1 earlier because I'm using the option "strictPropertyInitialization": false, in tsconfig - initially I thought that had cause some problem, but reverting to 2.6.2 hasn't resolved it
removed and rebuilt node_modules
ran first aid from disk utility on partition
reset permissions : https://support.apple.com/en-us/HT203538
re-installed yarn
re-installed brew
granted each complained folder sudo chmod -R 777 '/Library/Application Support', now complaining about no access to '/System/Library/User Template' , cannot use chmod here because I get the error, operation not allowed
yarn run ts-node Tests/runner.ts --tap gives:
warning package.json: No license field
$ /Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/.bin/ts-node Tests/runner.ts --tap
{ Error: EACCES: permission denied, scandir '/System/Library/User Template'
at Object.fs.readdirSync (fs.js:924:18)
at GlobSync._readdir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:288:41)
at GlobSync._readdirInGlobStar (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:267:20)
at GlobSync._readdir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:276:17)
at GlobSync._processReaddir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:137:22)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:132:10)0
at GlobSync._processReaddir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:207:10)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:132:10)
at GlobSync._processGlobStar (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:380:10)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:130:10)
errno: -13,
code: 'EACCES',
syscall: 'scandir',
path: '/System/Library/User Template' }
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
sudo yarn run ts-node Tests/runner.ts --tap gives:
{ Error: EBADF: bad file descriptor, scandir '/dev/fd/13'
at Object.fs.readdirSync (fs.js:924:18)
at GlobSync._readdir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:288:41)
at GlobSync._readdirInGlobStar (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:267:20)
at GlobSync._readdir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:276:17)
at GlobSync._processReaddir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:137:22)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:132:10)
at GlobSync._processReaddir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:207:10)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:132:10)
at GlobSync._processGlobStar (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:380:10)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:130:10)
errno: -9,
code: 'EBADF',
syscall: 'scandir',
path: '/dev/fd/13' }
error Command failed with exit code 1.
UPDATE 1 - 19 FEB 2017:
I've placed a test.ts file - which does nothing but print to console , if I call that from yarn ts-node, that works fine
yarn run ts-node Tests/test.ts
output:
yarn run v1.3.2
warning package.json: No license field
$ /Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/.bin/ts-node Tests/test.ts
this is a test
✨ Done in 0.61s.
test.ts:
(async () =>
{
console.log("this is a test");
})()
.catch(e =>
{
console.error(e);
process.exit(1);
});
I have also attempted, what the comment has suggested by #ILI - I fixed the permissions using First Aid in disk utility on the mac partition , since brew no longer supports sudo, I uninstalled yarn from brew, and added it to global packages using
sudo yarn install yarn -g
but still have the same EACCESS error - Error: EACCES: permission denied, scandir '/Library/Application Support/OpenVPN/profile'
Also tried running yarn --verbose, didn't get much detail from there
yarn run --verbose ts-node Tests/runner.ts --tap
yarn run v1.3.2
warning package.json: No license field
verbose 0.331 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/.npmrc".
verbose 0.331 Checking for configuration file "/Users/dshamim/.npmrc".
verbose 0.331 Checking for configuration file "/usr/local/etc/npmrc".
verbose 0.332 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/.npmrc".
verbose 0.332 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/anex/.npmrc".
verbose 0.332 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/.npmrc".
verbose 0.332 Checking for configuration file "/Users/dshamim/Projects/Acurus/.npmrc".
verbose 0.332 Checking for configuration file "/Users/dshamim/Projects/.npmrc".
verbose 0.332 Checking for configuration file "/Users/dshamim/.npmrc".
verbose 0.333 Checking for configuration file "/Users/.npmrc".
verbose 0.333 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/.yarnrc".
verbose 0.333 Checking for configuration file "/Users/dshamim/.yarnrc".
verbose 0.334 Found configuration file "/Users/dshamim/.yarnrc".
verbose 0.334 Checking for configuration file "/usr/local/etc/yarnrc".
verbose 0.334 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/.yarnrc".
verbose 0.334 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/anex/.yarnrc".
verbose 0.334 Checking for configuration file "/Users/dshamim/Projects/Acurus/ANEX/.yarnrc".
verbose 0.335 Checking for configuration file "/Users/dshamim/Projects/Acurus/.yarnrc".
verbose 0.337 Checking for configuration file "/Users/dshamim/Projects/.yarnrc".
verbose 0.338 Checking for configuration file "/Users/dshamim/.yarnrc".
verbose 0.338 Found configuration file "/Users/dshamim/.yarnrc".
verbose 0.338 Checking for configuration file "/Users/.yarnrc".
verbose 0.34 current time: 2018-02-19T00:39:49.960Z
$ /Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/.bin/ts-node Tests/runner.ts --tap
{ Error: EACCES: permission denied, scandir '/Library/Application Support/OpenVPN/profile'
at Object.fs.readdirSync (fs.js:924:18)
at GlobSync._readdir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:288:41)
at GlobSync._readdirInGlobStar (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:267:20)
at GlobSync._readdir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:276:17)
at GlobSync._processReaddir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:137:22)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:132:10)
at GlobSync._processReaddir (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:207:10)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:132:10)
at GlobSync._processGlobStar (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:380:10)
at GlobSync._process (/Users/dshamim/Projects/Acurus/ANEX/anex/ANEX.Website.ManagementPortal.Tests/node_modules/glob/sync.js:130:10)
errno: -13,
code: 'EACCES',
syscall: 'scandir',
path: '/Library/Application Support/OpenVPN/profile' }
verbose 51.049 Error: Command failed with exit code 1.
at /usr/local/Cellar/yarn/1.3.2/libexec/lib/cli.js:35620:15
at Generator.throw (<anonymous>)
at step (/usr/local/Cellar/yarn/1.3.2/libexec/lib/cli.js:92:30)
at /usr/local/Cellar/yarn/1.3.2/libexec/lib/cli.js:105:13
at <anonymous>
at process._tickCallback (internal/process/next_tick.js:160:7)
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
Some times it's the simple things that we miss, don't worry we have all been here.
This is a case of over thinking the issue, to steal a line from an Aussie beer commercial, you need to "UNDERTHINK IT". https://youtu.be/1MdAhVetBq8
The fact that your simple test script worked but the main test runner didn't, would have pointed me in the direction of stepping through the test runner script, rather than looking at yarn or any other culprit.
Turns out you were telling alsatian to search your entire hard drive for test cases, in which some folders it did not have permissions to access.
Change:
testSet.addTestsFromFiles('/**/*/*.spec.ts');
To:
testSet.addTestsFromFiles('**/*/*.spec.ts');
Or:
testSet.addTestsFromFiles('./**/*/*.spec.ts');
And all should work as you expect.
I try to run the prog :
CodeSign /Users/admin/Library/Developer/Xcode/DerivedData/POC2-byrqqhzjppbjxjemdbcmskhttxdm/Build/Products/Debug-iphoneos/POC2.app/Frameworks/MicroBlink.framework
cd /Users/admin/Documents/Development/POC2
export
CODESIGN_ALLOCATE=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate
export
PATH="/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin:/Applications/Xcode.app/Contents/Developer/usr/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
Signing Identity: "iPhone Distribution: **************name ***** (********)"
/usr/bin/codesign --force --sign 4070CCDBD98188BA13DE80C8A094CCDFAC2A2E4C --preserve-metadata=identifier,entitlements,flags --timestamp=none /Users/admin/Library/Developer/Xcode/DerivedData/POC2-byrqqhzjppbjxjemdbcmskhttxdm/Build/Products/Debug-iphoneos/POC2.app/Frameworks/MicroBlink.framework
/Users/admin/Library/Developer/Xcode/DerivedData/POC2-byrqqhzjppbjxjemdbcmskhttxdm/Build/Products/Debug-iphoneos/POC2.app/Frameworks/MicroBlink.framework: replacing existing signature
/Users/admin/Library/Developer/Xcode/DerivedData/POC2-byrqqhzjppbjxjemdbcmskhttxdm/Build/Products/Debug-iphoneos/POC2.app/Frameworks/MicroBlink.framework: unknown error -1=ffffffffffffffff
Command /usr/bin/codesign failed with exit code 1
Make sure you have a iTunes connect profile & try to create an app with the same name & build settings in there & then try to archive your project as sometime the developer account does not match the profile of the app so then you might get this error.
You have to go to iTunes & create a profile & give it the same name as the project builder & then try to validate the archive project from the Xcode.
If the validation is success then you can submit it to the app store & if not let me know what error you get while you validate the app so that we can look more in deep.
Does anybody know why when I use 'security' on os x to import a valid identity that it seems to think it has expired:
There are 2 machines, my development machine and a jenkins slave.
I am using the xcodebuild to create an archive and then use:
xcodebuild -exportArchive -archivePath myApp.xcarchive -exportOptionsPlist exportOptions.plist -exportPath . PROVISIONING_PROFILE=fdd0caeb-58fb-41df-a5e8-e5e9bd1f95c9 "OTHER_CODE_SIGN_FLAGS=--keychain /Users/me/Library/Keychains/Buildsystem"
to build an ipa for the store. This works on my development machine using the same archive and the same exportOptions.plist but not on the jenkins slave. I get this error:
016-10-06 23:29:23.438 xcodebuild[87720:8494157] [MT] IDEDistribution:
-[IDEDistributionLogging _createLoggingBundleAtPath:]: Created bundle at path
'/var/folders/yd/l_8k4cn91kjc9r853crzz98m0000gn/T/MyApp_2016-10-06_23-29-23.437.xcdistributionlogs'.
2016-10-06 23:29:23.888 xcodebuild[87720:8494157] [MT]
IDEDistribution: Step failed: : Error Domain=IDEDistributionErrorDomain Code=1 "The
operation couldn’t be completed. (IDEDistributionErrorDomain error
1.)"
error: exportArchive: The operation couldn’t be completed.
(IDEDistributionErrorDomain error 1.)
Error Domain=IDEDistributionErrorDomain Code=1 "The operation couldn’t
be completed. (IDEDistributionErrorDomain error 1.)"
** EXPORT FAILED **
I suspect it is because it thinks the code signing identity is bad. When I imported the identity as:
security import AP_Store.p12 -k /Users/me/Library/Keychains/Buildsystem -P ******* -T /usr/bin/codesign
then run:
security find-identity
I get:
1) 71497439A2987BC6830DF2E4879DBD3A5F1B2857 "iPhone Distribution:
xxxxx (xxxxxxxxx)" (CSSMERR_TP_CERT_EXPIRED)
If I import the same identity on my development machine it says it is OK.
Does anybody know why the same identity would be OK on one machine but not another?
This was caused by an expired intermediate certificate.
Apple Worldwide Developer Relations Certification Authority
had expired.
After replacing it everything worked.
A good reference is: MaintainingCertificates
Another thing that can lead to errors such as:
2016-10-11 11:41:11.780 xcodebuild[87463:15799133] [MT]
IDEDistribution: Step failed: : Error Domain=IDEDistributionErrorDomain Code=1
"(null)"
error: exportArchive: The operation couldn’t be completed.
(IDEDistributionErrorDomain error 1.)
is if you have an incorrect team ID in your exportOptions.plist file.