How to preserve alias property while signing app?

Question

I have created on JavaFX application app at Mavericks and signing with Xcode 5.0.2 using -

codesign --deep -s "my name" MayApp.app
codesign -v MayApp.app && echo MayApp.app is Signed Successfully!

WITHOUT SIGN MYAPP LAUNCHING FINE!!

Without using --deep, I am not able to sign app at Mavericks.

-- More Try --

Now at Mavericks, we can no longer sign a bundle if any nested bundle in that package is unsigned. I did sign the framework of my app by following the instruction written at - http://furbo.org/2013/10/17/code-signing-and-mavericks/

codesign --verbose --force --sign "my name" MyApp.app/Contents/PlugIns/jdk1.7.0_21.jdk

Signing framework commands alone or after signing framework, does not make any changes in signing app.

------ THE MAIN ISSUE ------

On running above commands (whether only sign app or along with framework signing), MyApp.app get signed successfully but that app not launching at Mac because of signing command not preserving ALIAS property for the file libjli.dylib that exist at - MyApp.app/Contents/PlugIns/jdk1.7.0_21.jdk/Contents/MacOS. Signing app code converting libjli.dylib alias into a Dynamic Library.

Then I thought of copying libjli.dylib via following command -

<target name="Copylib" depends="SigningApp">
<delete file="MyApp.app/Contents/PlugIns/jdk1.7.0_21.jdk/Contents/MacOS/libjli.dylib"/>
<exec executable="cp">
   <arg line="-R /Library/Java/JavaVirtualMachines/jdk1.7.0_21.jdk/Contents/MacOS/ MyApp.app/Contents/PlugIns/jdk1.7.0_21.jdk/Contents/MacOS"/>
</exec>
</target>

This preserving alias but now on verifying sign app to says -

admins-iMac:osx admin$ codesign -v -v MyApp.app
MyApp.app: code object is not signed at all
In subcomponent: MyApp.app/Contents/PlugIns/jdk1.7.0_21.jdk
In architecture: x86_64

Same happen if I am copying that alias manually at MyApp.app.

Please suggest any way to sign app with preserving the properties of the all files exist in my framework at - Contents/PlugIns/jdk1.7.0_21.jdk?

Thanks

Answer 1

My problem get resolved by updating Java from jdk7u21 to latest jdk7u45 because Oracle's Java version 7u25 and below have been disabled by Apple on OS X. Updating to the latest release will allow Java to be run on Mac OS X.

Additionally, I have to made these changes to make app valid to sign -

1. In MyApp.app/Contents/Info.plist for CFBundleExecutable to MyApp, CFBundleIconFile to MyApp.icns.
2. Need to copy /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/MacOS/libjli.dylib to MyApp.app/Contents/PlugIns/jdk1.7.0_45.jdk/Contents/MacOS for libjli.dylib alias.
3. We also need to copy /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Info.plist from system installed jdk to our MyApp.app/Contents/PlugIns/jdk1.7.0_45.jdk/Contents/

Note: Step-2 and 3 are required because on deploying JavaFx app, the deployment process only copying /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home by default into MyApp.app/Contents/PlugIns, it was skipping MacOS/ folder and Info.plist.

Without doing these above changes for signing app with -

codesign --deep -s "my name" MayApp.app

I was getting erron on signing - MyApp.app: bundle format unrecognized, invalid, or unsuitable - We are facing this issue so we need to identify about what are making app bundle format unrecognized, invalid, or unsuitable.

Thanks

Answer 2

I still get an error after applying the workaround suggested. Once there is a symlink, app verification doesn't come through. Used spctl -a -v MyApp.app command line to verify the bundle.

I dug deeper and found that GetJREPath method relies on libjli.dylib file location. Once it's moved into Contents/MacOS/ folder, everything is broken. I made a little change to the GetJREPath method and rebuilt JDK from sources. Here is a file difference to apply it to your build:

diff -r ff67c8965852 src/macosx/bin/java_md_macosx.c
--- a/src/macosx/bin/java_md_macosx.c   Wed Dec 11 11:19:00 2013 -0800
+++ b/src/macosx/bin/java_md_macosx.c   Wed Dec 18 17:33:29 2013 +0400
@@ -640,7 +640,7 @@
         return JNI_FALSE;
     }

-    const char lastPathComponent[] = "/lib/jli/libjli.dylib";
+    const char lastPathComponent[] = "/Contents/MacOS/libjli.dylib";
     size_t sizeOfLastPathComponent = sizeof(lastPathComponent) - 1;
     if (pathLen < sizeOfLastPathComponent) {
         return JNI_FALSE;
@@ -648,7 +648,11 @@

     size_t indexOfLastPathComponent = pathLen - sizeOfLastPathComponent;
     if (0 == strncmp(realPathToSelf + indexOfLastPathComponent, lastPathComponent, sizeOfLastPathComponent - 1)) {
-        realPathToSelf[indexOfLastPathComponent + 1] = '\0';
+        realPathToSelf[indexOfLastPathComponent + 10] = 'H';
+        realPathToSelf[indexOfLastPathComponent + 11] = 'o';
+        realPathToSelf[indexOfLastPathComponent + 12] = 'm';
+        realPathToSelf[indexOfLastPathComponent + 13] = 'e';
+        realPathToSelf[indexOfLastPathComponent + 14] = '\0';
         return JNI_TRUE;
     }

Here are building and packaging instructions for OpenJDK7: https://github.com/hgomez/obuildfactory/wiki/Building-and-Packaging-OpenJDK7-for-OSX

I filled a bug to Oracle as well. Hope this helps.