The installer package includes files that are only readable by the root user (3.13.0)

[adil192]

Is there an existing issue for this?

• I have searched the existing issues
• I have read the guide to filing a bug

Steps to reproduce

Follow https://docs.flutter.dev/deployment/macos#create-a-build-archive-with-codemagic-cli-tools up to and including app-store-connect publish --path "$PACKAGE_NAME"

Expected results

Publishing to the App Store works

Actual results

2023-08-17 01:59:37.169  INFO: Show Progress: Waiting for App Store Connect SPI analysis response…
2023-08-17 02:01:23.077  INFO: Show Progress: Upload failed.
Asset validation failed
The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app. (ID: 7e9d5e25-9883-4df3-a89f-b2816e3e1723)
2023-08-17 02:01:23.077  INFO: 
=============
UPLOAD FAILED with 1 error.
=============
{"tool-version":"6.043.14043","tool-path":"\/Applications\/Xcode_14.2.app\/Contents\/SharedFrameworks\/ContentDeliveryServices.framework\/Versions\/A\/Frameworks\/AppStoreService.framework","os-version":"12.6.7","product-errors":[{"message":"Asset validation failed","userInfo":{"NSLocalizedFailureReason":"The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app. (ID: 7e9d5e25-9883-4df3-a89f-b2816e3e1723)","NSLocalizedDescription":"Asset validation failed","original_server_error":{"status":"409","id":"7e9d5e25-9883-4df3-a89f-b2816e3e1723","code":"STATE_ERROR.VALIDATION_ERROR.90255","title":"Asset validation failed","detail":"The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app."}},"code":90255}]}


Failed to upload archive at "build/macos/Build/Products/Release/Ricochlime.pkg"
Failed to publish build/macos/Build/Products/Release/Ricochlime.pkg
Error: Process completed with exit code 1.

Code sample

I haven't been able to reproduce this since to get to the point of publishing to the App Store, you need to set up all of the certificates etc. I'm guessing this occurs in a blank Flutter project though.

I can confirm, however, that reverting to Flutter 3.10.6 doesn't have this issue.

Screenshots or Video

No response

Logs

Logs

Publish "build/macos/Build/Products/Release/Ricochlime.pkg" to App Store Connect
Bundle identifier: com.adilhanney.ricochlime
Install size: 51919KB
Version code: 5000
Version: 0.5.0

Upload "build/macos/Build/Products/Release/Ricochlime.pkg" to App Store Connect
2023-08-17 01:58:52.863  INFO: ContentDelivery version 2.141.101 (141101).
2023-08-17 01:58:52.866  INFO: Show Progress: Contacting Apple Services…
2023-08-17 01:58:53.253  INFO: Received build ID: 2ad9c639-c1cd-428d-8852-fda1f2482567
2023-08-17 01:58:53.254  INFO: Show Progress: Making copy of ‘Ricochlime.pkg’…
2023-08-17 01:58:53.258  INFO: Show Progress: Preparing to upload ‘Ricochlime.pkg’…
2023-08-17 01:58:53.323  INFO: Show Progress: Analyzing package…
2023-08-17 01:59:27.503  INFO: Show Progress: Sending analysis to App Store Connect…
2023-08-17 01:59:27.658  INFO: COMPLETED - PART 1 - asset-description-7A7A7DB4-CA1D-4C43-8C0C-6C16908C3832.xml - eTag: "13390147FC1CACB9B3A15C2BAFE1905F"
2023-08-17 01:59:27.662  INFO: Show Progress: Waiting for App Store Connect analysis response…
2023-08-17 01:59:36.215 *** Error: ERROR: Asset validation failed (90255) The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app. (ID: 7e9d5e25-9883-4df3-a89f-b2816e3e1723)
2023-08-17 01:59:36.663  INFO: Show Progress: Sending SPI analysis to App Store Connect…
2023-08-17 01:59:36.994  INFO: COMPLETED - PART 1 - DTAppAnalyzerExtractorOutput-80C2D7FD-2FBA-4C4C-933E-D64EBF5B72D2.zip - eTag: "A3D0EA536B66AEADC014CD3643C3C615"
2023-08-17 01:59:37.077  INFO: COMPLETED - PART 4 - DTAppAnalyzerExtractorOutput-80C2D7FD-2FBA-4C4C-933E-D64EBF5B72D2.zip - eTag: "9E53CF42A803A4BC10D6521FD748E71B"
2023-08-17 01:59:37.092  INFO: COMPLETED - PART 2 - DTAppAnalyzerExtractorOutput-80C2D7FD-2FBA-4C4C-933E-D64EBF5B72D2.zip - eTag: "11355DC834E9AF31B82E04048AA496B1"
2023-08-17 01:59:37.165  INFO: COMPLETED - PART 3 - DTAppAnalyzerExtractorOutput-80C2D7FD-2FBA-4C4C-933E-D64EBF5B72D2.zip - eTag: "F1A76EEED562D78C1171AAC230695A1B"
2023-08-17 01:59:37.169  INFO: Show Progress: Waiting for App Store Connect SPI analysis response…
2023-08-17 02:01:23.077  INFO: Show Progress: Upload failed.
Asset validation failed
The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app. (ID: 7e9d5e25-9883-4df3-a89f-b2816e3e1723)
2023-08-17 02:01:23.077  INFO: 
=============
UPLOAD FAILED with 1 error.
=============
{"tool-version":"6.043.14043","tool-path":"\/Applications\/Xcode_14.2.app\/Contents\/SharedFrameworks\/ContentDeliveryServices.framework\/Versions\/A\/Frameworks\/AppStoreService.framework","os-version":"12.6.7","product-errors":[{"message":"Asset validation failed","userInfo":{"NSLocalizedFailureReason":"The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app. (ID: 7e9d5e25-9883-4df3-a89f-b2816e3e1723)","NSLocalizedDescription":"Asset validation failed","original_server_error":{"status":"409","id":"7e9d5e25-9883-4df3-a89f-b2816e3e1723","code":"STATE_ERROR.VALIDATION_ERROR.90255","title":"Asset validation failed","detail":"The installer package includes files that are only readable by the root user. This will prevent verification of the application's code signature when your app is run. Ensure that non-root users can read the files in your app."}},"code":90255}]}


Failed to upload archive at "build/macos/Build/Products/Release/Ricochlime.pkg"
Failed to publish build/macos/Build/Products/Release/Ricochlime.pkg
Error: Process completed with exit code 1.

Flutter Doctor output

Doctor output

Note that this was run on the GitHub Actions runner:

  ╔════════════════════════════════════════════════════════════════════════════╗
  ║                 Welcome to Flutter! - https://flutter.dev/                  ║
  ║                                                                            ║
  ║ The Flutter tool uses Google Analytics to anonymously report feature usage ║
  ║ statistics and basic crash reports. This data is used to help improve      ║
  ║ Flutter tools over time.                                                   ║
  ║                                                                            ║
  ║ Flutter tool analytics are not sent on the very first run. To disable      ║
  ║ reporting, type 'flutter config --no-analytics'. To display the current    ║
  ║ setting, type 'flutter config'. If you opt out of analytics, an opt-out    ║
  ║ event will be sent, and then no further information will be sent by the    ║
  ║ Flutter tool.                                                              ║
  ║                                                                            ║
  ║ By downloading the Flutter SDK, you agree to the Google Terms of Service.  ║
  ║ Note: The Google Privacy Policy describes how data is handled in this      ║
  ║ service.                                                                   ║
  ║                                                                            ║
  ║ Moreover, Flutter includes the Dart SDK, which may send usage metrics and  ║
  ║ crash reports to Google.                                                   ║
  ║                                                                            ║
  ║ Read about data we send with crash reports:                                ║
  ║ https://flutter.dev/docs/reference/crash-reporting                         ║
  ║                                                                            ║
  ║ See Google's privacy policy:                                               ║
  ║ https://policies.google.com/privacy                                        ║
  ╚════════════════════════════════════════════════════════════════════════════╝
Could not parse java version from: 
If there is a version please look for an existing bug https://github.com/flutter/flutter/issues/ and if one does not exist file a new issue.
[✓] Flutter (Channel stable, 3.13.0, on macOS 12.6.7 21G651 darwin-x64, locale en)
    • Flutter version 3.13.0 on channel stable at /Users/runner/hostedtoolcache/flutter/stable-3.13.0-x64
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision efbf63d9c6 (25 hours ago), 2023-08-15 21:05:06 -0500
    • Engine revision 1ac611c64e
    • Dart version 3.1.0
    • DevTools version 2.25.0
[!] Android toolchain - develop for Android devices (Android SDK version 34.0.0)
    • Android SDK at /Users/runner/Library/Android/sdk
    • Platform android-34, build-tools 34.0.0
    • ANDROID_HOME = /Users/runner/Library/Android/sdk
    • ANDROID_SDK_ROOT = /Users/runner/Library/Android/sdk
    • Java binary at: /Users/runner/hostedtoolcache/Java_Temurin-Hotspot_jdk/8.0.382-5/x64/Contents/Home/bin/java
    ✗ Could not determine java version
    ! Some Android licenses not accepted. To resolve this, run: flutter doctor --android-licenses
[✓] Xcode - develop for iOS and macOS (Xcode 14.2)
    • Xcode at /Applications/Xcode_14.2.app/Contents/Developer
    • Build 14C18
    • CocoaPods version 1.12.1
[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
[!] Android Studio (not installed)
    • Android Studio not found; download from https://developer.android.com/studio/index.html
      (or visit https://flutter.dev/docs/get-started/install/macos#android-setup for detailed instructions).
[✓] Connected device (2 available)
    • macOS (desktop) • macos  • darwin-x64     • macOS 12.6.7 21G651 darwin-x64
    • Chrome (web)    • chrome • web-javascript • Google Chrome 115.0.5790.170
[✓] Network resources
    • All expected network resources are available.
! Doctor found issues in 2 categories.
The Flutter CLI developer tool uses Google Analytics to report usage and diagnostic data
along with package dependencies, and crash reporting to send basic crash reports.
This data is used to help improve the Dart platform, Flutter framework, and related tools.
Telemetry is not sent on the very first run.
To disable reporting of telemetry, run this terminal command:
flutter --disable-telemetry.
If you opt out of telemetry, an opt-out event will be sent,
and then no further information will be sent.
This data is collected in accordance with the
Google Privacy Policy (https://policies.google.com/privacy).

Edit: This is also happening with Saber (another one of my apps).

[huycozy]

Hi @adil192
Which type of user did you log in when you build the app? (root or normal user?)

Regarding the error message above, can you try this solution to see if it works?

[adil192]

Hi @adil192 Which type of user did you log in when you build the app? (root or normal user?)

This is on a GitHub Actions runner which uses the runner user (which isn't root).

Regarding the error message above, can you try this solution to see if it works?

I tried running xattr -rc * on my local machine and git status doesn't show that anything changed. I also ran ls -l@ to see if anything had extended attributes and it doesn't show anything:

ls -l@

Adils-MacBook-Air:ricochlime adilhanney$ ls -l@ assets/images/
total 120
-rw-r--r--  1 adilhanney  staff    585 17 Aug 03:44 LICENSE.txt
-rw-r--r--  1 adilhanney  staff   5787 17 Aug 03:44 plains.png
-rw-r--r--  1 adilhanney  staff  12465 17 Aug 03:44 player.png
-rw-r--r--  1 adilhanney  staff   4413 17 Aug 03:44 slime.png
-rw-r--r--  1 adilhanney  staff   1397 17 Aug 03:44 water1.png
-rw-r--r--  1 adilhanney  staff   1410 17 Aug 03:44 water2.png
-rw-r--r--  1 adilhanney  staff   1425 17 Aug 03:44 water3.png
-rw-r--r--  1 adilhanney  staff   1427 17 Aug 03:44 water4.png
-rw-r--r--  1 adilhanney  staff   1410 17 Aug 03:44 water5.png
-rw-r--r--  1 adilhanney  staff   1430 17 Aug 03:44 water6.png

Adils-MacBook-Air:ricochlime adilhanney$ ls -l@
total 168
-rw-r--r--   1 adilhanney  staff  34260 17 Aug 03:44 LICENSE.md
-rw-r--r--   1 adilhanney  staff   1391 17 Aug 03:44 README.md
-rw-r--r--   1 adilhanney  staff   2357 17 Aug 03:44 analysis_options.yaml
drwxr-xr-x  14 adilhanney  staff    448 17 Aug 03:44 android
drwxr-xr-x   4 adilhanney  staff    128 17 Aug 03:44 appimage
drwxr-xr-x   4 adilhanney  staff    128 17 Aug 03:44 assets
drwxr-xr-x   8 adilhanney  staff    256 17 Aug 03:44 assets_raw
drwxr-xr-x   5 adilhanney  staff    160 17 Aug 03:44 flatpak
-rw-r--r--   1 adilhanney  staff    842 17 Aug 03:42 flutter_test_macos_build.iml
drwxr-xr-x   3 adilhanney  staff     96 17 Aug 03:44 installers
drwxr-xr-x   9 adilhanney  staff    288 17 Aug 03:44 ios
drwxr-xr-x   8 adilhanney  staff    256 17 Aug 03:44 lib
drwxr-xr-x   8 adilhanney  staff    256 17 Aug 03:44 linux
drwxr-xr-x  10 adilhanney  staff    320 17 Aug 03:44 macos
drwxr-xr-x   3 adilhanney  staff     96 17 Aug 03:44 metadata
drwxr-xr-x   3 adilhanney  staff     96 17 Aug 03:44 patches
-rw-r--r--   1 adilhanney  staff   1514 17 Aug 03:44 privacy_policy.md
-rw-r--r--   1 adilhanney  staff  18653 17 Aug 03:57 pubspec.lock
-rw-r--r--   1 adilhanney  staff   4333 17 Aug 03:44 pubspec.yaml
drwxr-xr-x   3 adilhanney  staff     96 17 Aug 03:44 scripts
-rw-r--r--   1 adilhanney  staff    147 17 Aug 03:44 slang.yaml
drwxr-xr-x   3 adilhanney  staff     96 17 Aug 03:44 snap
drwxr-xr-x   4 adilhanney  staff    128 17 Aug 03:44 test
drwxr-xr-x   7 adilhanney  staff    224 17 Aug 03:44 web
drwxr-xr-x   6 adilhanney  staff    192 17 Aug 03:44 windows

Another thing I tried (unsuccessfully) is running chown on the GitHub Actions workflow on everything right after cloning, after flutter build macos, and after packaging and signing.

[AndreiMisiukevich]

I've run into the same issue today with code magic CI.

Xcode 14.3.1
cocoapods (1.12.1)
flutter_macos_arm64_3.13.0-stable.zip

[huycozy]

I tried running xattr -rc * on my local machine

@adil192 Did you run it on the project root directory? Can you try xattr on *.app after building Flutter macOS? (right after step 12th on the instruction above)

@AndreiMisiukevich Please try the same.

---

UPDATE: If it can not make this work, please try the suggested solution here: https://github.com/orgs/codemagic-ci-cd/discussions/1498#discussioncomment-5381028

[JulienDev]

Same problem here:

[JulienDev]

As a workaround I had to downgrade to 3.10.6 :(
flutter downgrade v3.10.6

[jayjah]

I tried running xattr -rc * on my local machine

@adil192 Did you run it on the project root directory? Can you try xattr on *.app after building Flutter macOS? (right after step 12th on the instruction above)

@AndreiMisiukevich Please try the same.

UPDATE: If it can not make this work, please try the suggested solution here: https://github.com/orgs/codemagic-ci-cd/discussions/1498#discussioncomment-5381028

Same problem here - suggested workaround in codemagic-ci-cd/discussions does not work for me.

[adil192]

I tried running xattr -rc * on my local machine

@adil192 Did you run it on the project root directory? Can you try xattr on *.app after building Flutter macOS? (right after step 12th on the instruction above)

@AndreiMisiukevich Please try the same.

UPDATE: If it can not make this work, please try the suggested solution here: https://github.com/orgs/codemagic-ci-cd/discussions/1498#discussioncomment-5381028

Here are the commands I ran (on the GitHub Actions runner):

  - name: Build for macOS
    run: |
      flutter build macos
      ls -l@ build/macos/Build/Products/Release
      xattr build/macos/Build/Products/Release/*.app
      echo 'Removing extended attributes'
      xattr -rc build/macos/Build/Products/Release/*.app
      echo 'Setting frag shader permissions'
      find build/macos/Build/Products/Release -name "*.frag" -exec chmod 0644 {} \;

and the output:

Updating project for Xcode compatibility.
Upgrading project.pbxproj
Upgrading Runner.xcscheme
Running pod install...                                           1,758ms
Building macOS application...                                   
warning: Run script build phase 'Run Script' will be run during every build because it does not specify any outputs. To address this warning, either add output dependencies to the script phase, or configure it to run in every build by unchecking "Based on dependency analysis" in the script phase. (in target 'Flutter Assemble' from project 'Runner')
total 0
drwxr-xr-x  5 runner  staff  160 Aug 21 15:57 App.framework
drwxr-xr-x  3 runner  staff   96 Aug 21 15:57 App.framework.dSYM
drwxr-xr-x@ 2 runner  staff   64 Aug 21 15:54 FlutterMacOS
	com.apple.xcode.CreatedByBuildSystem	  4 
drwxr-xr-x  7 runner  staff  224 Aug 16 17:15 FlutterMacOS.framework
drwxr-xr-x  7 runner  staff  224 Aug 21 15:54 Pods_Runner.framework
drwxr-xr-x  3 runner  staff   96 Aug 21 15:57 Ricochlime.app
drwxr-xr-x  3 runner  staff   96 Aug 21 15:57 Ricochlime.app.dSYM
drwxr-xr-x  9 runner  staff  288 Aug 21 15:57 Ricochlime.swiftmodule
drwxr-xr-x@ 4 runner  staff  128 Aug 21 15:54 path_provider_foundation
	com.apple.xcode.CreatedByBuildSystem	  4 
drwxr-xr-x@ 4 runner  staff  128 Aug 21 15:54 shared_preferences_foundation
	com.apple.xcode.CreatedByBuildSystem	  4 
Removing extended attributes
Setting frag shader permissions

Publishing to the App Store fails with the same error. I've attached the full logs if they're relevant.
logs_409.zip

[huycozy]

@adil192 Thanks for the info. I haven't had a fully-configured CLI tool set up to check this now but I just tried publishing distribution via XCode and it works without issue. Can you also try and confirm?

Also, I wonder if this issue only occurs in CI or also in local environment?

UPDATE: A hint to debug this is to unzip ipa/pkg file and check which files have incorrect permissions.