Unsealed contents present in the root directory of an embedded framework

Question

I am facing this issue when i try to sign the nwjs framework

codesign -f -v --deep -s '3rd Party Mac Developer Application: Company Name. (XXXXXXXXX)' --entitlements Child.plist hello.app/Contents/Versions/59.0.3071.115/nwjs\ Framework.framework

Can anyone please suggest what should i do

Bowel

Did you find answer ? – Bouncing

Have you take a look at #25951044? – Spellman

@63d26a1c yes, nothing helped – Bouncing

as pointed out in my answer the xattr -cr command removes all content that cannot be sealed – Disengagement

Answer 1

I tried this :

Do not change any other info.plist except for the below mentioned app files and the error was gone.

• Helper.app
• app_mode_loader.app
• nwjs.app [main app]

Also before signing the framework do

codesign -f -v --deep -s '3rd Party Mac Developer Application: Company Name. (XXXXXXXXX)' --entitlements Child.plist hello.app/Contents/Versions/59.0.3071.115/nwjs\ Framework.framework/Versions/A/nwjs\ Framework

then

codesign -f -v --deep -s '3rd Party Mac Developer Application: Company Name. (XXXXXXXXX)' --entitlements Child.plist hello.app/Contents/Versions/59.0.3071.115/nwjs\ Framework.framework

Bowel

Doesn't help for me – Bouncing

what nwjs version are you using? i have used 23.6 and things are fine there. can you check with this version if possible – Bowel

Yes, I'm on 23.6 too. Could you show all your sign script please – Bouncing

Also you build your app with nw-builder ? – Bouncing

The nwjs provides you a folder with nwjs.app file. Right click on this App file >> Show Package contents >> Contents folder, Inside this you have to place your Test.nw. What is Test.nw :: Create a folder named Test. This folder should contain your package.json and other files at root level. Rename this Test folder to Test.nw – Bowel

M not using nw builder. After i add app.nw in nwjs.app i run codesign command to sign the app and productbuild to create the package in terminal – Bowel

Answer 2

I have made a small script that should help you. The folder 60.0.3112.113 differs from version to version.

xattr is important to remove not allowed content also be careful with the name of you executable

app="yourapp.app"
identity="Developer ID Application: Yourname...."

echo "### removing unnecessary files"
rm -f "$app/Icon^M" #remove if exists
rm -r -f "$app/.idea" #remove if exists
xattr -cr "$app" #remove all unallowed files

echo "### signing libraries"
#codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/Libraries/exif.so"
#codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/libffmpeg.dylib"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/libnode.dylib"

echo "### signing frameworks"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/nwjs Framework"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/Helpers/crashpad_handler"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/timeBro Helper.app/Contents/MacOS/timeBro Helper"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/timeBro Helper.app/"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/helpers/crashpad_handler"

echo "### sing osx folder"
codesign --force --verify --sign "$identity"  "$app/Contents/MacOS/yourapp" #be careful here should be the exact name of your executably

echo "### signing app"
codesign --force --verify --sign "$identity" "$app"

echo "### verifying signature"
codesign -vv -d "$app"

Disengagement

Answer 3

I had the same issue trying to sign my nwjs app I received this message:

"Contents/Versions/67.0.3396.87/nwjs Framework.framework: unsealed contents present in the root directory of an embedded framework"

I solved this by doing the following steps:

1. move Versions/67.0.3396.87/nwjsFramework.framework/libnode.dylib into the A folder located Versions/67.0.3396.87/nwjsFramework.framework/Versions/A/libnode.dylib.
2. go back on command line to Versions/67.0.3396.87/nwjsFramework.framework.
3. enter ln -s Versions/A/libnode.dylib.
4. try sign again after this.

From what I read some files in the embedded framework folder should sit inside folder in order to be able to sign the code. so the steps above move the file to the required folder and then step 3 create a symlink folder for the file we moved.

This worked for me, hope it will help you solve your problem or whoever read this.

Annalist