EVS doesn't support macOS Universal builds?

[alectrocute]

Hi all,

Running into an issue when trying to use EVS signing utility on my Universal build of our darwin app –

> python3 -m castlabs_evs.vmp sign-pkg ./dist_electron/mac-universal
Signing: ./dist_electron/mac-universal/Lift.app
UnsupportedError: Binary type or archtecture not supported

Any way we can sign for Universal builds?

Debug details:

electronVersion: "13.1.6-wvvmp",

Python 3.9.1

node v14.15.3

Thanks!

[khwaaj]

Hi Alec,

This is something that is not currently supported by EVS. I can see how it became more relevant again now with the Apple Silicon migration, but most applications still appear to deliver separate builds for the different architectures, including Chrome (there are pros and cons to both alternatives).

VMP itself actually does support universal binaries, e.g. Firefox is delivered as a universal binary and can support VMP, but supporting it in EVS comes with additional complexity since we need to enforce that only official releases of ECS can be signed. I will consider this a feature request and we can take it under advisement for future development but, at least short-term, this is unfortunately not something that is supported by EVS.

[alectrocute]

Thanks for your speedy response @khwaaj. I personally would never distribute universal apps to consumers, but Setapp requires it. Whenever universal app support is added, I will gladly test it and report any issues. Thanks so much for this service.

[khwaaj]

I had some time to take a closer look at this and, as it turns out, implementing it in EVS was far easier than I had anticipated, so I went ahead and updated the service and client with support for universal binaries. If you want to try it out, you need to upgrade the client like this:

python3 -m pip install --upgrade castlabs-evs

Once you have the v1.1.0 client you will be able to sign universal binaries, as long as the included executables are based on EVS. Keep in mind that a universal binary with two architectures is twice the size, which means a signing request will take twice the time to upload the binary to the service (on slow connections passing -z may be beneficial).

On a separate note I noticed that @electron/universal, which is used under the hood by several packagers, is unable to merge ECS releases because of the pre-generated .sig files that exist in the app bundle. Since you have been experimenting with this you are probably aware already. Anyway, for the record, to fix this with electron-builder I simply added code to the afterPack hook that removes the offending .sig file from the package (it will be regenerated when you sign the package anyway):

const fs = require('fs')

exports.default = async function(context) {
  fs.unlinkSync(context.appOutDir + '/my.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/Electron Framework.sig')
}

[alectrocute]

You rock, @khwaaj. I'll be signing our universal app with this later this week, can't wait!

[alectrocute]

@khwaaj Following up to say I just successfully signed our Universal 13.1.6-wvvmp build with castlabs-evs. The -z flag wasn't needed, the artifact uploaded with zero issues. Safe to say, we now have full macOS support!