[Interest] OSX codesign question

[Andy]

If you are signing the application after creating it with macdeployqt (as I
think we've been working through this whole time?), then you will have to
create the DMG separately after you sign the application. You can then also
sign the DMG if you like.

If you are using macdeployqt to sign the application & create the DMG at
the same time, then I don't know how it works because I never got codesign
to work with macdeployqt (see my first message in this thread).

Also if you need to add "entitlements" - yes, it gets even more
complicated! - then you can't do that with macdeployqt as far as I know.

https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/AboutEntitlements.html

---
Andy Maloney  //  https://asmaloney.com
twitter ~ @asmaloney <https://twitter.com/asmaloney>



On Thu, Apr 9, 2020 at 9:25 AM "Alexander Carôt" <alexander_carot at gmx.net>
wrote:

> Hi Hamish,
>
> yes, in the meantime I figured that I signed the app before deployment and
> this leads to the crash because the other components must be signed as well.
>
> In that regard the next question comes up:
>
> Is it sufficient if I sign the DMG file which results from the macdeployqt
> call or do I have to run macdeployqt without dmg-creation, then sign the
> app and then create a DMG out of it ?
>
> Thanks,
> best
>
> Alex
>
> --
> http://www.carot.de
> Email : Alexander at Carot.de
> Tel.: +49 (0)177 5719797
>
>
> *Gesendet:* Donnerstag, 09. April 2020 um 02:40 Uhr
> *Von:* "Hamish Moffatt" <hamish at risingsoftware.com>
> *An:* interest at qt-project.org
> *Betreff:* Re: [Interest] OSX codesign question
> On 9/4/20 1:15 am, "Alexander Carôt" wrote:
>
> So - I received the new certificate, installed it on my keychain tool and
> this is what happened again:
>
> soulalex at alexandarotsMBP SJC % codesign --deep --force --verify --verbose
> --timestamp --options runtime --sign "Developer ID Application: Alexander
> Carot (92C65YCLK8)" ./soundjack.app
> ./soundjack.app: signed app bundle with Mach-O thin (x86_64)
> [com.yourcompany.soundjack]
>
> soulalex at alexandarotsMBP SJC % codesign --verify --deep --strict
> --verbose=2 ./soundjack.app
> ./soundjack.app: valid on disk
> ./soundjack.app: satisfies its Designated Requirement
>
> soulalex at alexandarotsMBP SJC % ./soundjack.app/Contents/MacOS/soundjack
> dyld: Library not loaded:
> @rpath/QtMultimediaWidgets.framework/Versions/5/QtMultimediaWidgets
>   Referenced from:
> /Users/soulalex/Desktop/wip/XP-shared/Soundjack/SJC/./soundjack.app/Contents/MacOS/soundjack
>   Reason: no suitable image found.  Did find:
>
>  /Users/soulalex/Qt-5.14.2/5.14.2/clang_64/lib/QtMultimediaWidgets.framework/Versions/5/QtMultimediaWidgets:
> code signature in
> (/Users/soulalex/Qt-5.14.2/5.14.2/clang_64/lib/QtMultimediaWidgets.framework/Versions/5/QtMultimediaWidgets)
> not valid for use in process using Library Validation: mapped file has no
> cdhash, completely unsigned? Code has to be at least ad-hoc signed.
> zsh: abort      ./soundjack.app/Contents/MacOS/soundjack
> soulalex at alexandarotsMBP SJC %
>
> Any idea left ?
>
>
>
> Is the QtMultimediaWidgets.framework included in your bundle? Are you
> using macdeployqt?
>
> It looks like a signing error because it is trying your (unsigned) Qt
> development install framework instead, while maybe the problem is that the
> framework is just missing from your bundle and therefore didn't get signed.
>
>
>
>
>
> Hamish
> _______________________________________________ Interest mailing list
> Interest at qt-project.org https://lists.qt-project.org/listinfo/interest
> _______________________________________________
> Interest mailing list
> Interest at qt-project.org
> https://lists.qt-project.org/listinfo/interest
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.qt-project.org/pipermail/interest/attachments/20200409/6365d080/attachment.html>