Re: [gtk-osx-users] CodeSigning and Catalina security issue.

[Pascal <p p14 orange fr>]

Hello John,

> Le 14 févr. 2020 à 21:40, John Ralls <jralls ceridwen us> a écrit :
>
> > On Feb 14, 2020, at 12:16 PM, Pascal <p p14 orange fr> wrote:
> >
> > Hello,
> >
> > I've now codesign my GTK-OSX app for the bundle:
> > % APPLICATION_CERT=gtk-cert /opt/gtk-mac-bundler/gtk-mac-bundler /opt/chapitre6/gtk3-ch6.bundle 
> >
> > But I've still the issue for opening the Documents folder:
> > <Capture d’écran 2020-02-14 à 21.08.36.png>
> >
> > What else would I have to do?
> > Any clue?
>
> It works OK when unsigned but is sandboxed when signed?

Both gave the same opening error. I hoped the error would have disappeared when signing but it was not the 
case.

> Is gtk-cert an Apple developer cert? Don't try to use anything else on MacOS, Apple's security stuff 
> recognizes only their own certificates.

I created the certificate with KeyChain app, as the following link description but I created it in session 
and not system keychain:
https://gcc.gnu.org/onlinedocs/gnat_ugn/Codesigning-the-Debugger.html

> What does `codesign -dvvv --deep -r- --entitlements /path/to/bundle` report?

The option entitlements provoques an error, so I ran:
[JH]% codesign -dvvv --deep -r- /opt/Gtk3-ch6cs.app 
Executable=/opt/Gtk3-ch6cs.app/Contents/MacOS/Gtk3-ch6cs
Identifier=org.gtk.demo
Format=app bundle with generic
CodeDirectory v=20100 size=189 flags=0x0(none) hashes=1+3 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=b28b4c9e64ed173da496d02551d7f3c7e3f51319
CandidateCDHashFull sha1=b28b4c9e64ed173da496d02551d7f3c7e3f51319
CandidateCDHash sha256=e43d65739d1536d317dc613cb55699bab58f6abe
CandidateCDHashFull sha256=e43d65739d1536d317dc613cb55699bab58f6abe868156bb20e64e6f593597ac
Hash choices=sha1,sha256
CMSDigest=7b52c5fef40e4f6e548951bb836f2599ff473fe146d6b9f0633179f46affe530
CMSDigestType=2
CDHash=e43d65739d1536d317dc613cb55699bab58f6abe
Signature size=1700
Authority=gtk-cert
Signed Time=14 Feb 2020 at 21:07:56
Info.plist entries=14
TeamIdentifier=not set
Sealed Resources version=2 rules=13 files=6030
Nested=MacOS/Gtk3-ch6cs-bin
designated => identifier "org.gtk.demo" and certificate leaf = H"2b39404416b9dbbb67d4f87193068dd5e9e9d4e8"

Regards, Pascal.
https://blady.pagesperso-orange.fr