I am trying to distribute a Java application to OS X users. I am not using the Mac store - it is to be distributed through my own website. Whatever I try, OS X's Gatekeeper rejects the app.
Here's my method:
(1) Build the app as usual, get a JAR file
(2) Use appbundler
as described here: https://docs.oracle.com/javase/7/docs/technotes/guides/jweb/packagingAppsForMac.html. This creates a .app around my JAR which runs nicely, and contains the JVM in the MyApp.app/Contents/PlugIns
directory.
(3) Sign the app with my Developer certificate:
codesign -s 'Developer ID Application: MyCompany Ltd' --deep MyApp.app
...process completes successfully
(4) Verify that the .app will adhere to Gatekeeper's iron-fist laws:
spctl --assess --verbose=4 --type execute MyApp.app
...and the result I get back is:
MyApp.app: a sealed resource is missing or invalid
Doesn't seem very verbose to me! What could I be doing wrong? Or how can I get more information?
SO/Google searches around 'a sealed resource...' refer to signing frameworks (which I don't have) or suggest signing with the --force
option (which I tried but doesn't work).
You can't use
--deep
. It sounds like the right option to use, since you also need to sign the embedded JRE, but it won't work. From Apple's docs:After a lot of hair-pulling, I cobbled this together from various tutorials. This one was the most helpful. Here was my final solution as an Ant script:
Another thing to look out for is not to use the command-line
zip
to package your app after signing, because it will break the codesign of the app. You should package it usingproductbuild
, PackageMaker,xip
, or in a dmg.