Tutorial on publishing Flex/Air app for Mac App Store or just using Developer ID for general distribution

[Daniel_McQuillen]

Has anybody put together a tutorial on publishing a Flex/AIR application for distribution as an OSX desktop app, either through Mac App Store or just using the Developer ID certificate?

In my time as a Flex developer, I've seen some things documented well and some that you had to dig for, but finding clear instructions on this is really difficult! I would have thought publishing your Flex/AIR app as a stand-alone (captive runtime) application either through the Mac App Store or to users directly (signing with an Apple Developer ID certificate) would be something many people are trying to do. But most of the helpful posts out there are dated or incomplete as well as being specifically targeted towards iOS. Furthermore, each time the AIR SDK changes it seems many of the past posts are no longer valid at some step.

Big thanks for anybody who can provide pointers or suggestions!

[KR-san]

Sorry, I use poor English.

Did you omit the explanation?

I had to remove WebKit.dylib and sign A2712Enabler.

Other than that, it succeeded in the same way.

[JonathanKaye19147]

I am getting stuck on this -- I can't seem to sign the .app/Contents/Frameworks/Adobe AIR.framework, codesign keeps telling me ".app/Contents/Frameworks/Adobe AIR.framework: bundle format is ambiguous (could be app or framework)". I also added the --deep option to the codesign, and doing it as sudo, still no luck. That seems to be my final obstacle (though I don't know what is in store)! Does anyone have an idea how to resolve is error?

[re-cycle]

Not come across this myself but googling around it seems that codesign ambiguous error often relates to having two certificates in Keychain with the same ID:

https://stackoverflow.com/questions/32925844/codesign-and-ambiguos-identity-matches-mac-developer-an...

[JonathanKaye19147]

Hi re-cycle, as you can imagine I've been following your thread but I got stuck on codesigning the Adobe AIR.framework, codesign gave me a 'bundle is ambiguous' error. Hours of digging and I finally discovered the problem -- the symlink structure inside the app was not correct coming out of ADT (AIR 32) -- here is a post that suggests the correct structure (https://stackoverflow.com/questions/27871099/creating-symlinks-in-osx-frameworks-inside-app-bundle). I have written up a detailed report and step-by-step instructions from codesigning through notarization, and have sent it to Harman, I am also thinking of posting it here but it is quite long (7 pages, ok so I am not particularly brief).

[JonathanKaye19147]

I just went through the process on Mac OSX 10.14.6, and the posts in this thread helped me a lot to get my app properly signed and notarized. The main obstacle that I did not resolve from these posts was correcting the symlinks in the app generated by adt. I had to manually go in and correct the linkages.

To help others who may be going through this, I detailed my whole experience from adt'ing through notarizing. This post is quite long, but it is kind of what I wish I could have seen in trying to fix my issues. I hope it is helpful to someone out there. If you have questions, ping me and I'll try to help (you'll see I'm no expert on bash scripts).

-jonathan

----------------------------------------------------------------------

My Steps for Building AIR app on Mac OS 10.14.6

I have been publishing my Flash/AIR app (called SimsUshare_v2) to Mac OSX since 2012. Recently, however, Apple required that the app not only be code signed, but also notarized, since in some upcoming release of Mac OS, they will require all apps to be notarized.

I basically followed the steps I found in other articles, but they didn’t quite get me there. Here are three central articles I used:

1. Notarizing the app, very useful: “How to notarize your software on macOS”
2. Codesigning and notarizing Mac AIR apps, specifically: “Tutorial on publishing Flex/Air app for Mac App Store or just using Developer ID for general distrib...”, particularly the post marked “Correct Answer” by re-cycle. Of course the success is due to several people who helped him or her, but it’s easiest to identify the last person who put it all together.
3. Codesigning and notarizing in general: “How to codesign and notarise your app for macOS 10.14 and higher”

In this post I will detail all the steps I used to get my app successfully codesigned and notarized. I am not going to go into how I got the certificates from my developer account, that should be clear from other places. I went into the process with my private key (myCertificate.p12), my password, and the latest AIR 32 build (as of September, 2019).

Compiling the App

I use adt to build the captive runtime as follows:

../AdobeAIRSDK/AdobeAIRSDK-32/bin/adt -package -storetype pkcs12 -keystore myCertificate.p12 -tsa http://sha256timestamp.ws.symantec.com/sha256/timestamp -target bundle "SimsUshare_v2.app" SUSFreeWinMac-app.xml -C . SUSFreeWinMac.swf libs/ examples/ icons/ piccache/ assets/

I am prompted for my certificate password, which I entered. This builds the SimsUshare_v2.app in the same folder.

The Start of Codesign woes

The original codesign statement I used to use did not have the parameters that were needed now to codesign and notarize the app, namely stuff about the hardened runtime.

codesign -f -v --options runtime -s "Developer ID Application: Equipment Simulations LLC" --entitlements "$APP_DIR/entitlements.plist" "$APP_DIR/SimsUshare_v2.app"

You’ll see from this statement I also added an entitlements.plist file which was suggested by the #2 article above (re-cycle). I am including that file with this post so you can see it directly. I did not try the build after getting it working to see if I truly need the entitlements.plist file, though. BTW, the $APP_DIR is from my build (bash) script (below) and merely points to the folder in which I have the app.

When I tried to follow the steps in article #2 after making my build script, I kept getting this error from codesign

SimsUshare_v2.app: bundle format is ambiguous (could be app or framework)

In subcomponent: /Users/jonathankaye/Dropbox/SimsUshare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework

After reviewing a lot of the posts in the article #2 from above, I saw I had to remove certain parts of the app (like WebKit) and codesign the pieces directly. I was trying to do it once with the codesign --deep parameter. However, Apple’s codesigning documentation (which actually was useful, albeit very long) said that it is best to sign each part individually rather than to rely on --deep. This documentation also clued me into the real culprit, because it mentions “symlinks” under the error for ambiguous bundle format.

The symlink mention reminded me I had seen this post and comment from Juergen saying to examine the symlinks and the application needs to be in a certain structure. Honestly I didn’t quote understand what that structure was from Juergen’s comment, but I was able to find this somewhere else based on Dass’ comment that made it clearer:

I used this example to clean up the SimsUshare_v2.app structure to have the correct symlinks, which I then put into my codesign script, below. FWIW, here is my diagram of the app (‘…’ is whatever is in there, -> are symlinks):

Adobe AIR.framework/ ADOBE AIR  ->     Versions/Current/ADOBE AIR ADOBE AIR_64 ->     Versions/Current/ADOBE AIR_64 Resources  ->     Versions/Current/Resources Versions/      1.0/            ADOBE AIR …            ADOBE AIR_64 …            Resources …      Current    -> 1.0

Structure of AIR app under SimsUshare_v2.app/Contents/Frameworks

To make these changes, I added the fixes to my script for codesigning (I did hardcode the 2.8.6 into the APP_DIR variable which I will replace with VERSION at some later time, also I could make the script with a parameter for VERSION to make it more general).

You will see in the script that in addition to the symlink fixing, I also added some a command I had found to remove extended attributes (which Apple labels as “detritus”, if you don’t do that step), and I also put in checks to see that the app, once codesigned, passes two tests – one to verify the codesign, and the second to see if Gatekeeper will accept it. Of course I removed my passwords from the script, for posting. At the bottom of the script I put the complete output I received.

You’ll see I commented out a line (line 11) about copying icons, I did not have a problem with icons AFAIK but that copy statement was from a different article that had problems with AIR 31 and icons.

#!/usr/bin/env bash

VERSION="2.8.6"

APP_DIR="/Users/jonathankaye/Dropbox/SimsUShare Mac Stuff/SimsUshare 2.8.6"

INFO_PLIST="$APP_DIR/SimsUshare_v2.app/Contents/Info.plist"

cd "$APP_DIR"

# copy icons file over -- the one built by AIR which is still packaged incorrectly as of AIR SDK 31

# cp -f ./packaging/Icon.icns ./SimsUshare_v2.app/Contents/Resources/Icon.icns

printf "\n++++ Fix the symlinks manually\n"

cd "SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework"

rm "Adobe AIR"

ln -s Versions/Current/Adobe\ AIR "Adobe AIR"

ln -s Versions/Current/Adobe\ AIR_64 "Adobe AIR_64"

rm -fr Resources/

ln -s Versions/Current/Resources Resources

cd Versions

rm -fr Current

ln -s 1.0 Current

cd "$APP_DIR"

printf "\n>>>> removing stuff that would cause problems\n"

rm -f "./SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/WebKit.dylib"

rm -f "./SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Adobe AIR.vch"

rm -fr "./SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/__MACOSX"

printf "\n>>>> removing extended resources (Apple calls it detritus)\n"

xattr -cr SimsUshare_v2.app

printf "\n>>>> updating the info.plist\n"

/usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString \"${VERSION}\"" "${INFO_PLIST}"

/usr/libexec/PlistBuddy -c "Set :CFBundleGetInfoString \"${VERSION}, © 2019 Equipment Simulations LLC. All rights reserved.\"" "${INFO_PLIST}"

/usr/libexec/PlistBuddy -c "Add :LSApplicationCategoryType string public.app-category.business" "${INFO_PLIST}"

codesign -f -v -s "Developer ID Application: Equipment Simulations LLC" "$APP_DIR/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0"

codesign -f -v -s "Developer ID Application: Equipment Simulations LLC" "$APP_DIR/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR"

codesign -f -v -s "Developer ID Application: Equipment Simulations LLC" "$APP_DIR/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR_64"

printf "\n>>>> code sign Frameworks/Adobe AIR.framework\n"

codesign -f -v -s "Developer ID Application: Equipment Simulations LLC" "$APP_DIR/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework"

printf "\n>>>> code signing the app\n"

codesign -f -v --options runtime -s "Developer ID Application: Equipment Simulations LLC" --entitlements "$APP_DIR/entitlements.plist" "$APP_DIR/SimsUshare_v2.app"

printf "\n+++ Check to see if signed properly\n"

codesign --verify --verbose=4 SimsUshare_v2.app

printf "\n+++ Check if app passes Gatekeeper test\n"

spctl -a -t exec -vv SimsUshare_v2.app/

: '

#################################################

############    EXPECTED OUTPUT      ############

#################################################

Jonathans-Mini:SimsUshare 2.8.6 jonathankaye$ ./build.sh

>>>> removing stuff that would cause problems

>>>> removing extended resources (Apple calls it detritus)

>>>> updating the info.plist/Users/jonathankaye/Dropbox/SimsUShare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0: code object is not signed at all

In subcomponent: /Users/jonathankaye/Dropbox/SimsUshare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR_64

/Users/jonathankaye/Dropbox/SimsUShare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR: code object is not signed at all

In subcomponent: /Users/jonathankaye/Dropbox/SimsUshare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR_64

/Users/jonathankaye/Dropbox/SimsUShare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Adobe AIR_64: signed Mach-O thin (x86_64) [Adobe AIR_64]

>>>> code sign Frameworks/Adobe AIR.framework/Users/jonathankaye/Dropbox/SimsUShare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework: signed bundle with Mach-O thin (x86_64) [com.adobe.AIR]

>>>> code signing the app/Users/jonathankaye/Dropbox/SimsUShare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app: signed app bundle with Mach-O thin (x86_64) [com.simsushare.desktop.free]

+++ Check to see if signed properly--prepared:/Users/jonathankaye/Dropbox/SimsUshare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/Current/.

--validated:/Users/jonathankaye/Dropbox/SimsUshare Mac Stuff/SimsUshare 2.8.6/SimsUshare_v2.app/Contents/Frameworks/Adobe AIR.framework/Versions/Current/.

SimsUshare_v2.app: valid on disk

SimsUshare_v2.app: satisfies its Designated Requirement

+++ Check if app passes Gatekeeper testSimsUshare_v2.app/:

accepted

source=Developer ID

origin=Developer ID Application: Equipment Simulations LLC (8AXD232TA7)

Jonathans-Mini:SimsUshare 2.8.6 jonathankaye$

'

From the last few lines you can see my app was now properly codesigned and it passes Gatekeeper’s test. On to the notarization!

For this, I followed article #1 that I had listed at the top. That article was very clear, so here are my instructions that made it work:

1. I made a DMG using DropDMG, which is a great app, BTW, for making DMG’s really simply. Well worth the cost!
2. Now I had to upload the DMG to Apple’s servers:

xcrun altool --type osx --file SimsUshare_v2.dmg --primary-bundle-id com.simsushare.SUSMobileDesktop --notarize-app --username u@eqsim.com

1. Before doing this, I had to go through the Developer portal to create an app-specific password, which I was prompted for, and entered.
2. I received the following response after 5 minutes (of course I blanked out the actual UUID [the notarize ID] received):

No errors uploading 'SimsUshare_v2.dmg'.

RequestUUID = 1xxxxxxxx-xxxx-xxxxx-xxxx-xxxxx1f1

1. I put the notarize ID into the next command:

xcrun altool --notarization-info 1xxxxxxxx-xxxx-xxxxx-xxxx-xxxxx1f1 --username u@eqsim.com

1. After it asked for the app-specific password, I received (I removed my password below!)

No errors getting notarization info.

Date: 2019-09-25 13:43:51 +0000

       Hash: bd86076feaxxxxxxxxxxxxxxxxxxx5ac2bc631bc7

RequestUUID: 1xxxxxxxx-xxxx-xxxxx-xxxx-xxxxx1f1

     Status: in progress

To query the status (from https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution/customizi...😞

xcrun altool --notarization-info 1xxxxxxxx-xxxx-xxxxx-xxxx-xxxxx1f1 -u u@eqsim.com -p <my password!> --output-format xml

1. I did check the status using the command it stated, but about 4-5 minutes later, I checked it and received the approval notice, like this:

xcrun altool --notarization-info 1xxxxxxxx-xxxx-xxxxx-xxxx-xxxxx1f1 -u u@eqsim.com -p <my password!> --output-format xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

     <key>notarization-info</key>

     <dict>

           <key>Date</key>

           <date>2019-09-25T13:43:51Z</date>

           <key>Hash</key>

           <string>bd86076feaxxxxxxxxxxxxxxxxxxx5ac2bc631bc7</string>

           <key>LogFileURL</key>

           <string>https://osxapps-ssl.itunes.apple.com/itunes-assets/Enigma123/v4/0e/48/4f/0e484f28-9919-3c8c-f0d1-045...>

           <key>RequestUUID</key>

           <string>xxxxxxxxxxxxxxxxxxxxx</string>

           <key>Status</key>

           <string>success</string>

           <key>Status Code</key>

           <integer>0</integer>

           <key>Status Message</key>

           <string>Package Approved</string>

     </dict>

     <key>os-version</key>

     <string>10.14.6</string>

     <key>success-message</key>

     <string>No errors getting notarization info.</string>

     <key>tool-path</key>

     <string>/Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/Frameworks/AppStoreService.framework</string>

     <key>tool-version</key>

     <string>4.00.1181</string>

</dict>

</plist>

1. Yay! Last step was to staple the output, or something:

xcrun stapler staple -v SimsUshare_v2.dmg

1. Which after a little bit came back with a long response that ended with

…

The staple and validate action worked!

1. As the article #1 I mentioned says: Congratulations ... your app has now been codesigned and notarized
2. After you installed the app (from the .dmg) you can double check if everything is working:

spctl -a -v </Path/to/your.app>

1. After your app has been successfully notarized, you will also receive a mail from Apple:

Dear Sir,

Your Mac software (bundle identifier ) has been notarized. You can now export this software and distribute it directly to users.

For details on exporting a notarized app, visit Xcode Help.

Best Regards,

Apple Developer Relations

[DHL83]

Thank you for the tip about DropDMG @JonathanKaye19147! I ended up purchasing it and I am now using it to build my .dmgs

[Born2code]

THANK YOU!!!!

[dunielson]

Thank you.  This was very helpful for me.

[SirRookie]

Thanks for your summarize

I have mojave and i followed exactly the steps. 

I also created the entitlements.plist with Xcode

but i have the same error. When I codesign my SM.app with entitlements

then my App crashes

When i cut off the --options runtime it rund but is not notarized.

I double checked the PLIST a hundert times. What is wrong. Please help

that is my command

codesign -f -v --deep -s "Developer ID Application: Michael Menard (7RRN669PF8)" --entitlements "/Users/Menard/Desktop/Pack/MM.plist" "$AppLocation"

app is running

codesign -f -v --options runtime --deep -s "Developer ID Application: Michael Menard (7RRN669PF8)" --entitlements "/Users/Menard/Desktop/Pack/MM.plist" "$AppLocation"

app is crashing at start

[JonathanKaye19147]

Hi, I don't think you need to use --deep if you look through the .app file and codesign the pieces I mention directly. The app should run when codesigned, so I would not go farther until this is good, but the notarization is the steps after codesigning, are you doing that?

I would strongly recommend you move your question to AS3Lang. Here is where I'd look first

• https://discuss.as3lang.org/t/how-i-notarized-my-desktop-air-project-for-macos-appstore/2222

-jonathan

[SirRookie]

Thanks

I tried without --deep but app also crashes 

I am stuck

Cheers michael

[JonathanKaye19147]

I don't know what to suggest, I'm sorry. If you do not use options runtime, then you try to go to notarize the app, it fails then? I may be saying something obvious but the notarization is another step.

Maybe posting your message on as3lang someone can help?

I have to make an update in the next couple of days and I plan to use the script I made above, I will let you know if I have a problem. I will be compiling on Catalina, not Mojave.

-jonathan

[JonathanKaye19147]

Just wanted to post a note after I updated my Mac app using AIR 33.1.1.217 based on my previous steps I posted. I tried using adt then going to codesigning and notarizing directly (without the symbolic link and package removal changes I had to do before), but it choked at the notarization step with Apple, with the oh-so-useful error message from them "Package Invalid". Thanks, Apple.

Anyway, I steeled myself and went through all the link re-doing and removing packages from the adt output, then it all worked fine (albeit adding more grey hairs to my head).

I don't know specifically which things Harman has fixed in the meantime that I really didn't have to do, so I repeated all of what worked the last time. My guess is they probably did the symbolic linkage correctly, but I still saw packages in the .app might have. Just wanted to give others hope in case they were wondering if anything changed since I had done this successfully with AIR 32.

Ping me if you need any clarification on my steps, I will do my best.

-jonathan

[KR-san]

Hi. Has anyone succeeded in notarization using macOS 10.15 Catalina?

Doing the same, mojave succeeds but catalina fails.

When the app signature is confirmed with the spctl command, it is rejected.

spctl command displays "source=no usualble signature"

[JonathanKaye19147]

Hi KR-san, yes I have successfully notarized my Mac app in 10.15 -- did you see my post directly above your's (https://community.adobe.com/t5/air/tutorial-on-publishing-flex-air-app-for-mac-app-store-or-just-usi...)? I documented all the steps and results. I was helping someone else who told me that the latest Harman build solved the symbolic linking thing I experienced, but try following my notes and let me know where yours gets different results.

-jonathan

[el111]

Here is what I am using.

I have created both notarized Developer Id and App Store apps using the bash scripts provided.

https://github.com/tuarua/WebViewANE/tree/development/example-desktop-complete/mac_packaging

[KR-san]

It's been a long time.

After the last writing, I ended up making it in Mojave.

I'm sorry I didn't reply.

It will be made with Adobe AIR for the first time in a year, and I confirmed your writing.
I learned a lot.😊

First of all, regarding "source = no usualble signature", I just got a new mac and most likely forgot to set up my keychain 😨

Then I tried to capture your method, but it failed.
(I can use Python a little, so I can sign, create an installer, and notarize with one command. I modified the script.
For this reason, I can't say I did what you said.)

Looking at the notary log, it still says that the A2712 Enabler file needs to be signed.
It also said that the Flash Plugin file in AIR also needs to be signed.
(I was very surprised not to know that Adobe AIR contains the ancient Flash Player 10.6 Plugin.)

I went back to re-cycle's way (using the --deep-sign option) to sign Plugins that are ridiculously deep.
Did it! I have succeeded in notarization.

[KR-san]

There are some supplements.

I'm not so familiar with CLI, so I use AnimateCC (GUI) to create APP files.
Also, when creating an APP, it is necessary to set the signature, but there is a bug in Animate CC and it fails to sign using Apple's certificate.
For this reason, I make an APP with my own certificate and then re-sign it using the CodeSign command and the Developer ID certificate.

I created it in the following environment.
machine: macBookPro 2019
OS: macOS 10.15 Catalina
App: Animate 2021
AIR: 32.0.0.116 (Last released version by Adobe)

Finally, the following processing is scripted
- Delete WebKit.dylib
- Signing A2712 Enabler (using "--options runtime" and "--deep" options)
- Signing Flash Player-10.6 (using "--options runtime" and "--deep" options)
- Signing APP (using "--entitlements <your plistFile>", "--options runtime" and "--deep" options)

Due to lack of knowledge about Codesign commands, you may have some options you don't need.
But I'm tired of trials and errors😫