We have an application bundle that has another application bundle nested within it. rcodesign properly detects this, but it messes up the signature in a way that makes Apple reject the notarization:
notary log> "issues": [
notary log> {
notary log> "architecture": "x86_64",
notary log> "code": null,
notary log> "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735",
notary log> "message": "The signature of the binary is invalid.",
notary log> "path": "ThinLinc Client Notarized.app.zip/ThinLinc Client Notarized.app/Contents/lib/tlclient/vncviewer.app/Contents/MacOS/vncviewer",
notary log> "severity": "error"
notary log> }
notary log> ],
The issue is the identifier used on the main binary for that nested bundle. It gets the generic one ("vncviewer"), rather than one of the bundle identifiers¹.
The workaround is to sign the nested bundle separately (although #148 caused some friction there).
¹ Apple seems to accept either identifier from ThinLinc Client Notarized.app or vncviewer.app
We have an application bundle that has another application bundle nested within it. rcodesign properly detects this, but it messes up the signature in a way that makes Apple reject the notarization:
The issue is the identifier used on the main binary for that nested bundle. It gets the generic one (
"vncviewer"), rather than one of the bundle identifiers¹.The workaround is to sign the nested bundle separately (although #148 caused some friction there).
¹ Apple seems to accept either identifier from
ThinLinc Client Notarized.apporvncviewer.app