JDK-8289030 : [macos] app image signature invalid when creating DMG or PKG
  • Type: Bug
  • Component: tools
  • Sub-Component: jpackage
  • Affected Version: 19,20
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2022-06-23
  • Updated: 2022-08-05
  • Resolved: 2022-07-08
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 19 JDK 20
19 b31Fixed 20Fixed
Related Reports
Relates :  
JDK-8250950 - Allow per-user and system wide configuration of a jpackaged app
Description
Signature is invalid on app-image after it was install/deployed via DMG or PKG.

PKG issue:
1) jpackage --type pkg -i input -n Test --main-class components.DynamicTreeDemo --main-jar DynamicTreeDemo.jar --mac-sign
2) Install pkg file
3) Verify signature and it will not be valid signature.
codesign -vvvv /Applications/Test.app 
/Applications/Test.app: a sealed resource is missing or invalid
file added: /Applications/Test.app/Contents/app/.package
file missing: /Applications/Test.app/Contents/app/.jpackage.xml

DMG issue:
1) jpackage --type dmg -i input -n Test --main-class components.DynamicTreeDemo --main-jar DynamicTreeDemo.jar --mac-sign
2) Mount DMG file
3) Verify signature and it will not be valid signature.
codesign -vvvv /Volumes/Test/Test.app
/Volumes/Test/Test.app: a sealed resource is missing or invalid
file added: /Volumes/Test/Test.app/Contents/app/.package
file missing: /Volumes/Test/Test.app/Contents/app/.jpackage.xml

App-image DMG issue:
1) jpackage --type app-image -i input -n Test --main-class components.DynamicTreeDemo --main-jar DynamicTreeDemo.jar --mac-sign
2) jpackage --type dmg --app-image Test.app
3) Verify signature and it will not be valid signature.
codesign -vvv /Volumes/Test/Test.app 
/Volumes/Test/Test.app: a sealed resource is missing or invalid
file added: /Volumes/Test/Test.app/Contents/app/.package
file modified: /Volumes/Test/Test.app/Contents/runtime/Contents/Home/legal/java.compiler/COPYRIGHT
.....
file modified: /Volumes/Test/Test.app/Contents/runtime/Contents/Home/legal/jdk.zipfs/LICENSE
file missing: /Volumes/Test/Test.app/Contents/app/.jpackage.xml

App-image PKG issue:
Same as "App-image DMG issue".
Comments
Changeset: 64286074 Author: Alexander Matveev <almatvee@openjdk.org> Date: 2022-07-08 00:17:11 +0000 URL: https://git.openjdk.org/jdk19/commit/64286074ba763d4a1e8879d8af69eee34d32cfa6
08-07-2022
A pull request was submitted for review. URL: https://git.openjdk.org/jdk19/pull/89 Date: 2022-06-29 03:03:15 +0000
29-06-2022