Asset validation failed (90287) Invalid Code Signing Entitlements when signing an electron app

Question

I am trying for the first time to sign an electron app (via electron-forge that uses @electron/osx-sign under the hood) and public in Mac App Store.

After several errors, I could successfully sign but two of them persisted:

Asset validation failed (90287)
Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'com.apple.application-identifier' in 'com.COMPANY.APP.pkg/Payload/APP.app/Contents/MacOS/APP'. (ID: ***)

Asset validation failed (90287)
Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'com.apple.developer.team-identifier' in 'com.COMPANY.APP.pkg/Payload/APP.app/Contents/MacOS/APP'. (ID: ***)

This happens when I try to send it via Apple's Transporter. I am searching for the last days but everything I tried was in vain, like:

• Download different provision profiles: Development, Distribution, Developer;
• Manually sign/notarize via CLI;
• Use Development/Distribution environments;

My configuration file:

const path = require('path');
const fs = require('fs');

require('dotenv').config();

const APP_BUNDLE_ID = 'com.COMPANY.APP';
const MACOS_ENTITLEMENTS_PATH = path.join('osx', 'entitlements.plist');

module.exports = {
  packagerConfig: {
    icon: './assets/icon.ico',
    appBundleId: APP_BUNDLE_ID,
    appVersion: process.env.APP_VERSION,
    name: 'APP',
    appCategoryType: 'public.app-category.developer-tools',
    darwinDarkModeSupport: true,
    executableName: 'APP',
    osxUniversal: {
      mergeASARs: true,
      x64ArchFiles: '**/{node_modules/\.cache,node_modules}/**'
    },
    osxSign: {
      identity: process.env.APPLE_SIGN_IDENTITY,
      provisioningProfile: path.join('osx', 'dist.provisionprofile'),
      hardenedRuntime: true,
      entitlements: MACOS_ENTITLEMENTS_PATH,
      'entitlements-inherit': MACOS_ENTITLEMENTS_PATH,
      'signature-flags': 'library',
      'gatekeeper-assess': false,
    },
    osxNotarize: {
      appleId: process.env.APPLE_SIGN_APPLEID,
      appleIdPassword: process.env.APPLE_SIGN_APPLEIDPASSWORD,
    }
  },
  makers: ['...']
}

my entitlements file:

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
  </dict>
</plist>

The question is: how can I add those keys to my provision profile? is it the correct thing to do?

Thanks in advance!

Answer 1

I could solve it by understanding a few topics:

• I believe notarisation is needed only when you plan to distribute your app in other places, but not in Mac App Store.
• To notarise, only Developer ID keys are accepted.
• The electron-forge does not update all fields from electron-notarize package and one of these fields is provisioningProfile, you will need to put it in the root folder in order to load it.
• You can set DEBUG=electron-osx-sign* to have a full signing log.
• I still need to sign the .pkg file manually as Transporter does not accept the package signed by electron-forge's make pipeline.