Bug ID: JDK-8332110 [macos] jpackage tries to sign added files without the --mac-sign option

JDK-8332110 : [macos] jpackage tries to sign added files without the --mac-sign option

Type: Bug
Component: tools
Sub-Component: jpackage
Affected Version: 22

Priority: P3
Status: Resolved
Resolution: Fixed
OS: os_x

Submitted: 2024-05-11
Updated: 2025-05-05
Resolved: 2024-05-31

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 23
23 b26Fixed

Related Reports

Relates :	JDK-8356218 - [macos] Document --app-content
Relates :	JDK-8311877 - [macos] Add CLI options to provide signing identity directly to codesign and productbuild

Description

Running jpackage on MacOS 14.4.1 without the --mac-sign option, but with
--type app-image --app-content NOTICE.txt
will throw an exception when trying to sign NOTICE.txt:

[17:21:59.454] Command [PID: 4876]:
    /usr/bin/codesign -s - -vvvv --force /Users/runner/work/gui/gui/build/jpackage/gui.app
[17:21:59.454] Output:
    /Users/runner/work/gui/gui/build/jpackage/gui.app: replacing existing signature
    /Users/runner/work/gui/gui/build/jpackage/gui.app: code object is not signed at all
    In subcomponent: /Users/runner/work/gui/gui/build/jpackage/gui.app/Contents/NOTICE.txt
[17:21:59.454] Returned: 1

Error: "codesign" failed with following output:
/Users/runner/work/gui/gui/build/jpackage/gui.app: replacing existing signature
/Users/runner/work/gui/gui/build/jpackage/gui.app: code object is not signed at all
In subcomponent: /Users/runner/work/gui/gui/build/jpackage/gui.app/Contents/NOTICE.txt
[17:21:59.455] java.io.IOException: Command [/usr/bin/codesign, -s, -, -vvvv, --force, /Users/runner/work/jextractGUI/jextractGUI/build/jpackage/jextractGUI.app] exited with 1 code
	at jdk.jpackage/jdk.jpackage.internal.Executor.executeExpectSuccess(Executor.java:90)
	at jdk.jpackage/jdk.jpackage.internal.IOUtils.exec(IOUtils.java:229)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.runCodesign(MacAppImageBuilder.java:741)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.signAppBundle(MacAppImageBuilder.java:880)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.doSigning(MacAppImageBuilder.java:425)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.prepareApplicationFiles(MacAppImageBuilder.java:367)
	at jdk.jpackage/jdk.jpackage.internal.AppImageBundler.createAppBundle(AppImageBundler.java:189)
	at jdk.jpackage/jdk.jpackage.internal.AppImageBundler.execute(AppImageBundler.java:93)
	at jdk.jpackage/jdk.jpackage.internal.Arguments.generateBundle(Arguments.java:714)
	at jdk.jpackage/jdk.jpackage.internal.Arguments.processArguments(Arguments.java:561)
	at jdk.jpackage/jdk.jpackage.main.Main.execute(Main.java:92)
	at jdk.jpackage/jdk.jpackage.main.Main.main(Main.java:53)
[17:21:59.456] jdk.jpackage.internal.PackagerException: java.io.IOException: Command [/usr/bin/codesign, -s, -, -vvvv, --force, /Users/runner/work/jextractGUI/jextractGUI/build/jpackage/jextractGUI.app] exited with 1 code
	at jdk.jpackage/jdk.jpackage.internal.AppImageBundler.execute(AppImageBundler.java:98)
	at jdk.jpackage/jdk.jpackage.internal.Arguments.generateBundle(Arguments.java:714)
	at jdk.jpackage/jdk.jpackage.internal.Arguments.processArguments(Arguments.java:561)
	at jdk.jpackage/jdk.jpackage.main.Main.execute(Main.java:92)
	at jdk.jpackage/jdk.jpackage.main.Main.main(Main.java:53)
Caused by: java.io.IOException: Command [/usr/bin/codesign, -s, -, -vvvv, --force, /Users/runner/work/gui/gui/build/jpackage/gui.app] exited with 1 code
	at jdk.jpackage/jdk.jpackage.internal.Executor.executeExpectSuccess(Executor.java:90)
	at jdk.jpackage/jdk.jpackage.internal.IOUtils.exec(IOUtils.java:229)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.runCodesign(MacAppImageBuilder.java:741)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.signAppBundle(MacAppImageBuilder.java:880)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.doSigning(MacAppImageBuilder.java:425)
	at jdk.jpackage/jdk.jpackage.internal.MacAppImageBuilder.prepareApplicationFiles(MacAppImageBuilder.java:367)
	at jdk.jpackage/jdk.jpackage.internal.AppImageBundler.createAppBundle(AppImageBundler.java:189)
	at jdk.jpackage/jdk.jpackage.internal.AppImageBundler.execute(AppImageBundler.java:93)
	... 4 more

Without
--app-content NOTICE.txt
the process completes correctly.
Not sure if this is considered a bug, or if jpackage must have its input image signed already.

Comments

Changeset: 9fd0e734 Author: Alexander Matveev <almatvee@openjdk.org> Date: 2024-05-31 20:30:32 +0000 URL: https://git.openjdk.org/jdk/commit/9fd0e7349ebf4a49b5c0c7a16c866b5b8e626b53
31-05-2024
Not sure how to put files like LICENSE and NOTICE in the root directory in such case. If you want to include it with DMG, then use --mac-dmg-content or for PKG you can use --license-file.
28-05-2024
License files like LICENSE and NOTICE are put in the root directory. How is this supported, at least on mac?
25-05-2024
Yes, problem is adding files in the root directory.
24-05-2024
So the problem is adding files in the root directory of the image?
24-05-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/19377 Date: 2024-05-24 01:08:03 +0000
24-05-2024
This issue is reproducible with and without --mac-sign. jpackage will "ad-hoc" sign application bundle when --mac-sign is not specified by using pseudo-identity "-". This is why jpackage tries to sign added files and this is expected behavior by jpackage. "codesign" fails since added content made application bundle structure invalid. There is nothing we can do on jpackage side to sign such invalid bundles. As proposed solution we will output possible reason for "codesign" failure if it fails and --app-content was specified and possible solution. Proposed message: "One of the possible reason for "codesign" failure is additional content provided via "--app-content", which made application bundle structure invalid. Make sure to provide additional content in a way it will not break application bundle structure, otherwise add additional content as post-processing step." Example: Lets assume we have "ReadMe" folder with "ReadMe.txt" file in it. 1) jpackage --type app-image -n Test --app-content ReadMe/ReadMe.txt ... "codesign" will fail with "In subcomponent: Test.app/Contents/ReadMe.txt". This is expected and "ReadMe.txt" placed in "Test.app/Contents" which is also expected. 2) jpackage --type app-image -n Test --app-content ReadMe ... Works and "ReadMe.txt" will be placed under "Test.app/Contents/ReadMe".
24-05-2024