google / google/conscrypt

Sign native macOS binaries so that they can be embedded in macOS desktop apps

Open
#1,026 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

My project https://github.com/ylexus/jiotty-photos-uploader uses https://github.com/google/java-photoslibrary which transitively depends on conscrypt jars. When I use openjdk jpackage utility to create a distributable package (.dmg in case of macOS), it fails to get notarized by Apple with these errors:
```
{
"severity": "error",
"code": null,
"path": "Jiotty_Photos_Uploader-2.0.3.dmg/Jiotty Photos Uploader.app/Contents/app/conscrypt-openjdk-uber-2.5.1.jar/META-INF/native/libconscrypt_openjdk_jni-osx-x86_64.dylib",
"message": "The binary is not signed.",
"docUrl": null,
"architecture": "x86_64"
},
{
"severity": "error",
"code": null,
"path": "Jiotty_Photos_Uploader-2.0.3.dmg/Jiotty Photos Uploader.app/Contents/app/conscrypt-openjdk-uber-2.5.1.jar/META-INF/native/libconscrypt_openjdk_jni-osx-x86_64.dylib",
"message": "The signature does not include a secure timestamp.",
"docUrl": null,
"architecture": "x86_64"
},
```

It makes jpackage tool's sign functionality unusable as is. I have to apply complex workarounds during build time like unpacking conscrypt jar, signing binaries, re-packing, and re-packaging.

it would be very convenient if conscrypt jars contained native libraries that were properly signed by Apple in the first place.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.