macOS Store Crash: Entitlements as Binary Plist instead of Plist

[idoodler]

MAS-signed App crashes which results in the apps rejection by Apple.

After a few hours of investigation I figured out that there is an issue with the entitlements of the App. In the Console Application the following message is thrown.

failed to parse entitlements for MyApp[84767]: OSUnserializeXML: syntax error near line 1

I then enabled DEBUG=electron-osx-sign* which allowed me to see that the entitlements of the app were in binary plist format, not in plist format. The entitlements are provided as a valide plist, but codesign somehow "converts" it to the binary format.

In fact the current version available in the AppStore has the entitlements provided as plist, not as binary plist.

Any input on this odd behaviour?

[idoodler]

I also opened an TSI at Apple. My guess is, that there was a change in Apples codesign tool.

[idoodler]

Apple hasn't responded to the TSI yet:/

[idoodler]

Am I the only one that experience this issue?

[copperschnack]

I had this problem too: Resigning the app with codesign introduced a binary diff in the first XML line of the entitlements. I could reproduce this in every run of codesign, even when resigning with the exact same entitlements.

The problem finally disappeared after rebooting (!) the OS-X machine. Believe it or not. This is not a real solution for sure. Nevertheless, anyone struggling with this problem might want to try this.

[tinacious]

I found this because I am also experiencing a similar error related to entitlements parsing:

  ⨯ Command failed: codesign --sign XXXX --force --timestamp --entitlements build/entitlements.mas.inherit.plist /path/to/project/dist/mas/MyAppName.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib
Failed to parse entitlements: AMFIUnserializeXML: syntax error near line 6

I was able to find a solution. In case anyone comes across this, I will share what worked for me.

I ran the following scripts on my plist files:

plutil -convert xml1 build/entitlements.mas.plist
plutil -convert xml1 build/entitlements.mas.loginhelper.plist
plutil -convert xml1 build/entitlements.mas.inherit.plist

This modified each of my plist files to change whitespace characters. It looks like spaces have been converted to tabs, so perhaps some kind of auto-formatting ran in my editor to reformat the Plist files incorrectly. Running plutil -convert xml1 on them seems to fix it. Code signing is now passing for me.

Example diff:

diff --git a/build/entitlements.mas.inherit.plist b/build/entitlements.mas.inherit.plist
index 57d0b41..4759d0a 100644
--- a/build/entitlements.mas.inherit.plist
+++ b/build/entitlements.mas.inherit.plist
@@ -1,14 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
-  <dict>
-    <key>com.apple.security.app-sandbox</key>
-    <true />
-    <key>com.apple.security.inherit</key>
-    <true />
-    <key>com.apple.security.cs.allow-jit</key>
-    <true />
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true />
-  </dict>
+<dict>
+       <key>com.apple.security.app-sandbox</key>
+       <true/>
+       <key>com.apple.security.cs.allow-jit</key>
+       <true/>
+       <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+       <true/>
+       <key>com.apple.security.inherit</key>
+       <true/>
+</dict>
 </plist>

[t-mish]

Strugled with this issue today. IMO should be in docs.

[MarshallOfSound]

Sounds like this is malformed user plist files, not sure how they become malformed but it's not an issue with osx-sign specifically

[1rach]

I've identified that when I open the file entitlements.mac.inherit.plist with vscode, and save it (tested on mac), the bug appears.

Solution ?
Maybe there is an option in vscode about formatting the file... I don't know.

Submit an issue to vscode ?