[External] : Re: jpackage OS/X --app-image signing

[Alexander Matveev]

Hi Michael,

I file following issue for this:
https://bugs.openjdk.org/browse/JDK-8293462

Yes, you right it is related to JDK-8289030. I put suggested workaround to https://bugs.openjdk.org/browse/JDK-8293462 in comment section.

There are two possible workarounds:
1) Generate signed application image initially, then post process it and sign again.
2) Generate unsigned application image and change value of <signed> from false to true in "APPNAME.app/Contents/app/.jpackage.xml" and then do post processing and sign it again.

There is a bug in "jpackage --type app-image --app-image APPNAME.app --mac-sign” command which signs app image correctly, but never changes value in “.jpackage.xml” to mark image as signed. Thus we will treat such images as unsigned even if they signed and as result we adding “.package” file when generating DMG or PKG from such images.

Thanks,
Alexander

On Sep 7, 2022, at 6:28 AM, Michael Hall <mik3hall at gmail.com<mailto:mik3hall at gmail.com>> wrote:



On Sep 6, 2022, at 8:00 PM, Michael Hall <mik3hall at gmail.com<mailto:mik3hall at gmail.com>> wrote:



On Sep 6, 2022, at 4:52 PM, Michael Hall <mik3hall at gmail.com<mailto:mik3hall at gmail.com>> wrote:



On Sep 6, 2022, at 4:48 PM, Alexander Matveev <alexander.matveev at oracle.com<mailto:alexander.matveev at oracle.com>> wrote:

Hi Michael,

Did you generate application image with same JDK version (19+36-2238)? With latest JDK version .jpackage.xml file should be present. We do not support signing of application images generate by another versions of JDK. It should be same JDK.

Thanks,
Alexander



Found this explains some of it.

Re: [jdk19] RFR: 8289030: [macos] app image signature invalid when creating DMG or PKG [v3]

Added this after my build script jpackage invocation to verify .jpackage.xml and version are correct

cat "BlackJack Blastoff_Unsigned.app/Contents/app/.jpackage.xml" | grep "jpackage-state version=“

Showing
<jpackage-state version="19" platform="macOS">

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/core-libs-dev/attachments/20220907/4067c56f/attachment-0001.htm>