Had to disable library validations for my app to open

[dgrcode]

Hi,

I'm working on a Mac app that I could archive, package into a .dmg, and use as normal. However, after implementing Sparkle to have auto-updates, the app would run via Xcode, but it wouldn't run when archived.

When clicking on the app's icon, I'd see the icon animate as if the app was going to open, but it wouldn't do anything. No error, no warning, anything. Looking at the Console app I found there was an error stating something like "Mapped file has no Team ID and is not a platform binary".

After some digging, I found a working solution, as described on this SO answer. For me it was enough to "Disable Library Validations".

Is this something expected? Am I doing something wrong?

Thanks!
Daniel

[zorgiepoo]

https://sparkle-project.org/documentation/#1-add-the-sparkle-framework-to-your-project

If you enable Library Validation, which is part of the Hardened Runtime and required for notarization, you will also need to either sign your application with an Apple Development certificate for development (requires being in Apple’s developer program), or disable library validation for Debug configurations only. Otherwise, the system may not let your application load Sparkle if you attempt to sign to run locally via an ad-hoc signature. This is not an issue for distribution when you sign your application with a Developer ID certificate.

Normally people would see the error when debugging the app in Xcode. You can't keep library validation on if you use an adhoc-signature (i.e, "Sign to run locally"). For distribution developers usually sign their application with a Developer ID certificate and notarize their application so this is not an issue there.

[dgrcode]

My bad, I missed that section on the docs –again–. Sorry about that.

However this brings a good tangent question that I have. I don't have a Apple Developer subscription and I'm attempting to sign my app with a free personal account. Most information that I find assumes I have an Apple Developer subscription, and I'm not sure if there's something I should take into account if I don't have one.

[zorgiepoo]

Sparkle itself doesn't require signing with an Apple Developer ID (which requires a subscription to the developer). I don't know if a free personal account gets you an Apple Development certificate or not. Anyway, at least assuming you are not sandboxing, there is not much on there that assumes a developer account. However the majority of developers that use Sparkle are in Apple's developer program and have a Developer ID certificate, as this is the general expectation on Apple's platform for distributing apps outside the App Store; otherwise users won't be able to easily use your app thanks to Gatekeeper.

[dgrcode]

I was thinking more about the code signing section of the docs.

There it says it's recommended to use the method described in "4. Distributing your App". I quote here:

We recommend distributing your app in Xcode by creating a Product › Archive and Distribute App choosing Developer ID method of distribution

However, I can't use "Developer ID" because it requires the subscription. I choose "Copy App" instead. During the archiving process I was requested my password 4 times, and I believe I get the prompt twice for each signature, so I think I signed two different things via Xcode. But I don't really know what I signed, or if there's something still pending to be signed.

Is there a way for me to check if I need to re-sign Sparkle manually?

I can manually test everything works on my laptop, but given how Mac security works, is that enough to assume things will still work on other laptops?

[zorgiepoo]

However, I can't use "Developer ID" because it requires the subscription. I choose "Copy App" instead. During the archiving process I was requested my password 4 times, and I believe I get the prompt twice for each signature, so I think I signed two different things via Xcode. But I don't really know what I signed, or if there's something still pending to be signed.

I believe Copy App makes sense but it may not re-sign your binaries (not really sure here, might be wrong according to what you're saying) so it's possible it's the same as just pulling the app bundle outside of the xcarchive. Are you ad-hoc ("sign to run locally") signing your app, or are you signing it with a self-signed certificate you generated? If you are using an ad-hoc signature, there shouldn't be any keychain password prompts of the sort. And if you're using an ad-hoc signature Copy App should be pretty equivalent to manually pulling the app bundle outside of the xcarchive. Anyway, I think signing with a self-signed certificate is iffy and questionable. You can stick with an ad-hoc signature until your app is ready for mass deployment and get a subscription then (or just stick with ad-hoc forever..)

I can manually test everything works on my laptop, but given how Mac security works, is that enough to assume things will still work on other laptops?

You can test downloading your app from your server and opening it there. It may not be as good as testing on another machine but will get you more coverage.