Cross-exporting to macOS is broken

[YeldhamDev]

Godot version:
3.3.stable

OS/device including version:
Debian 10.9

Issue description:
Exporting for macOS from another OS (or at the very least from GNU/Linux) appears to be broken. When opened in a mac, it shows an error that the app is "broken" and can't be run:

It can be tested by exporting a completely blank project.

(Thanks @RevoluPowered for helping test this)

Minimal reproduction project:
New Game Project.zip

[bruvzg]

Can't reproduce, apart from Gatekeeper warnings (see https://disable-gatekeeper.github.io/), export done on Ubuntu 20.10 is working fine on macOS 11.2.3.

Can you upload exported project to check what'w wrong with it?
Which architecture (x86_64 or Apple Silicon) and macOS version was used? And which app was used to extract .ZIP on macOS?

[RevoluPowered]

The Macbook pro in question. Non M1 silicone. RX 5500 PRO GPU

Maybe then the issue is on debian only?

Here is the example binary sent to me:
https://mega.nz/file/x6oHQSCT#EwSNkRDXyltA-HVYjE5e8y2YaqJrumyYX98RaVtUWJg

[bruvzg]

Here is the example binary sent to me:
https://mega.nz/file/x6oHQSCT#EwSNkRDXyltA-HVYjE5e8y2YaqJrumyYX98RaVtUWJg

It is giving an error, but after removing the Gatekeeper quarantine flag, it is working fine.

I guess it's expected behavior from a fully unsigned app (if it was not the same in 3.2, it's probably cased by the linker signature present in the M1 part of binary).

When exporting from macOS, it's always possible to ad-hoc sign, but I do not think we can do anything with exports from Linux/Windows, there's no codesign equivalent.

[RevoluPowered]

To me this is broken so we can't recommend users disable this gatekeeper. Would signing the executable on Ubuntu work?

[RevoluPowered]

Never mind I see the only way to sign a MacOS executable is from OSX.

[bruvzg]

To me this is broken so we can't recommend users disable this gatekeeper.

There's no need to disable Gatekeeper, just run xattr -dr com.apple.quarantine AppName.app command after extracting the app. Some distribution platforms (Steam, MacPorts) do not set the flag, and apps will work without extra steps.

Would signing the executable on Ubuntu work?

No, AFAIK there is no working signing tools for Linux.

[RevoluPowered]

To me this is broken so we can't recommend users disable this gatekeeper.

There's no need to disable Gatekeeper, just run xattr -dr com.apple.quarantine AppName.app command after extracting the app. Some distribution platforms (Steam, MacPorts) do not set the flag, and apps will work without extra steps.

Would signing the executable on Ubuntu work?

No, AFAIK there is no working signing tools for Linux.

Makes me wonder if we should make a .app file which is tiny which can disable the flag for the user

[RevoluPowered]

For anyone else experiencing this issue who doesn't have a mac to deploy from:

• if you use github actions you can use it to build your game export and this will run on an OSX builder. I will put some docs here if we do this.
• typically the idea is simple: if you use any osx builder which provides an actual apple device for the build you should be able to give the executable without the gatekeeper security enabling because you built the binary on the CI process.
• You can also ask someone with a macbook to build your binary for you.

It might take longer to export this way but definitely worth it IMHO

I will update here once i have tested this method out without the macbook.

[bruvzg]

Makes me wonder if we should make a .app file which is tiny which can disable the flag for the user

Can be done with simple AppleScript (as is or packed into the App).

on run
    do shell script "xattr -dr com.apple.quarantine " & quoted form of the POSIX path of (choose file of type "APP")
end run

Remove Quarantine.zip

[bruvzg]

You can also ask someone with a macbook to build your binary for you.

Note, that the whole exported bundle need to be signed, signing just an export template executable will result in the same error.

[RevoluPowered]

Makes me wonder if we should make a .app file which is tiny which can disable the flag for the user

Can be done with simple AppleScript (as is or packed into the App).

on run
    do shell script "xattr -dr com.apple.quarantine " & quoted form of the POSIX path of (choose file of type "APP")
end run

Remove Quarantine.zip

This is perfect :) I will try this out.

You can also ask someone with a macbook to build your binary for you.

Note, that the whole exported bundle need to be signed, signing just an export template executable will result in the same error.

I'm guessing the problem then is actually because we sign the export templates at all? I saw another project disabled signing temporarily until they could come up with a better solution.

MacDownApp/macdown#1127