[Bug] macOS notarization fails

[nor0x]

MOVED FROM: microsoft/playwright-dotnet#1093

i'm using Playwright-Sharp in a macOS project which gets distributed to our customers. We use the apple notarization service to allow proper execution with gatekeeper enabled. Since i have added Playwright-Sharp to the project the notarization fails, because the added binaries are not properly signed and don't have the hardened runtime flag enabled. Here is a log of the apple notarization service:

{
  "logFormatVersion": 1,
  "jobId": "1234567890",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "MyApp.app.zip",
  "uploadDate": "2021-01-09T14:54:20Z",
  "sha256": "1234567890",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "MyApp.app.zip/MyApp.app/Contents/MonoBundle/playwright-cli",
      "message": "The binary is not signed.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyApp.app.zip/MyApp.app/Contents/MonoBundle/playwright-cli",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyApp.app.zip/MyApp.app/Contents/MonoBundle/playwright-cli",
      "message": "The executable does not have the hardened runtime enabled.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyApp.app.zip/MyApp.app/Contents/MonoBundle/ffmpeg-mac",
      "message": "The binary is not signed.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyApp.app.zip/MyApp.app/Contents/MonoBundle/ffmpeg-mac",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "MyApp.app.zip/MyApp.app/Contents/MonoBundle/ffmpeg-mac",
      "message": "The executable does not have the hardened runtime enabled.",
      "docUrl": null,
      "architecture": "x86_64"
    }
  ]
}

[nor0x]

i tried to self-sign the external dependencies of my application. for ffmpeg-mac it works if i sign it manually via terminal

codesign --force --options runtime --sign "Developer ID Application: myorg" ffmpeg-mac

doing the same for playwright-cli however leads to the following error message playwright-cli: main executable failed strict validation

Apple Documentation about this issue

codesign says my main executable failed strict validation.

• Your Mach-O executable does not conform to modern Mach-O layout rules.
• You may be using a third party development product that hasn't been brought up to date, or post-processed your file in unsupported ways.

https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG309

EDIT:

probably related to this one:
vercel/pkg#128

[yury-s]

We are changing the way cli is packaged and trying to move away from pkg, so it may help with this issue too.

[nor0x]

thanks for the reply @yury-s 👍
do you have a rough estimation on a timeline?

I'm just curious because so that i could plan my resources accordingly

[kblok]

@nor0x I'm working on that on the Sharp side. We should get something by the end of this week or early next week.

[nor0x]

hey @kblok do you already have an update for the notarization issues? Do you need more info or a repro?

[kblok]

@nor0x PlaywrightSharp v0.180.0 is shipped with the new "unpacked" driver. I think you would still get an error regarding ffmpeg-mac.