Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect the presence of the "Resources" folder when signing and show an helpful error. #20135

Closed
rolfbjarne opened this issue Feb 19, 2024 · 2 comments · Fixed by #20593
Closed
Assignees
Labels
enhancement The issue or pull request is an enhancement msbuild Issues affecting our msbuild tasks/targets
Projects
Milestone

Comments

@rolfbjarne
Copy link
Member

rolfbjarne commented Feb 19, 2024

If an iOS or tvOS app contains a Resources folder, codesigning fails with a very unhelpful message:

  Tool /usr/bin/codesign execution finished (exit code = 1).

  bin/Release/net8.0-ios/ios-arm64/SomeApp.app: code object is not signed at all
  In subcomponent: bin/Release/net8.0-ios/ios-arm64/SomeApp.app/System.Security.Cryptography.aotdata.arm64

And this causes a lot of confusion (ref: dotnet/maui#20640).

We should detect the presence of a Resources folder before trying to sign, and show an error (we should probably allow the user to opt out of the error in case we get something wrong or Apple changes their logic at some point).

References:

@rolfbjarne rolfbjarne added enhancement The issue or pull request is an enhancement msbuild Issues affecting our msbuild tasks/targets labels Feb 19, 2024
@rolfbjarne rolfbjarne added this to the .NET 9 milestone Feb 19, 2024
@rolfbjarne rolfbjarne added this to Other in .NET 9 Feb 19, 2024
@anupniit
Copy link

anupniit commented Mar 21, 2024

I am getting same issue. I have tried all soloutions provided but no luck. I really dont know why this is happening. I moved to MAUI for easyness of coading. Now its getting nightmare.

Even I am not having resources folder in iOS Project. I have removed all referenace in project file.

/usr/bin/mdimport bin/Release/net8.0-ios/ios-arm64/
Tool /usr/bin/codesign execution finished (exit code = 1).

Warning: unable to build chain to self-signed root for signer "Apple Distribution: XXXXXXXXXXXXXXXXXX"
/Users/XXXXXXXX/Library/Caches/Xamarin/mtbs/builds/XXXXXXXXXX/9ddc627ef46cc5ac62b73a4dca1a443892a67f1615e76a9087401adec42eee58/bin/Release/net8.0-ios/ios-arm64/NewDuaHealingsApp2.app: errSecInternalComponent

C:\Program Files\dotnet\packs\Microsoft.iOS.Sdk\17.2.8004\tools\msbuild\iOS\Xamarin.Shared.targets(2256,3): error : /usr/bin/codesign exited with code 1: [C:\Users\ANUP\source\repos\NewDuaHealingsApp2\NewDuaHealingsApp2.csproj::TargetFr
amework=net8.0-ios]

@rolfbjarne
Copy link
Member Author

Warning: unable to build chain to self-signed root for signer

This might help: https://blog.verslu.is/app-publishing/unable-to-build-chain-for-self-signed-root/

rolfbjarne added a commit to rolfbjarne/xamarin-macios that referenced this issue May 9, 2024
…es subdirectory. Fixes xamarin#20135.

iOS (and presumably tvOS) app bundles can't contain a subdirectory named "Resources".

Apple says:

> Note: An iOS app bundle cannot include a custom folder named “Resources.”

Ref: https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFBundles/BundleTypes/BundleTypes.html#//apple_ref/doc/uid/10000123i-CH101-SW1

Unfortunately Apple's toolchain won't show a helpful error message, the
eventual failure is codesign saying something like this:

    bin/Release/net8.0-ios/ios-arm64/SomeApp.app: code object is not signed at all
    In subcomponent: bin/Release/net8.0-ios/ios-arm64/SomeApp.app/System.Security.Cryptography.aotdata.arm64

Which is confusing, to say the least.

After debugging this myself a few times, and seeing customers running into the
same issue periodically, it's time to make the error more actionable.

I've added code to our Codesign task to detect the "Resources" subdirectory,
and show a better error message. There's also a way to disable the validation
(by setting `CodesignDisallowResourcesSubdirectoryInAppBundle=false`), just in
case we end up being overeager with the validation.

Fixes xamarin#20135.
@rolfbjarne rolfbjarne self-assigned this May 9, 2024
rolfbjarne added a commit that referenced this issue May 21, 2024
…es subdirectory. Fixes #20135. (#20593)

iOS (and presumably tvOS) app bundles can't contain a subdirectory named "Resources".

Apple says:

> Note: An iOS app bundle cannot include a custom folder named “Resources.”

Ref: https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFBundles/BundleTypes/BundleTypes.html#//apple_ref/doc/uid/10000123i-CH101-SW1

Unfortunately Apple's toolchain won't show a helpful error message, the
eventual failure is codesign saying something like this:

    bin/Release/net8.0-ios/ios-arm64/SomeApp.app: code object is not signed at all
    In subcomponent: bin/Release/net8.0-ios/ios-arm64/SomeApp.app/System.Security.Cryptography.aotdata.arm64

Which is confusing, to say the least.

After debugging this myself a few times, and seeing customers running into the
same issue periodically, it's time to make the error more actionable.

I've added code to our Codesign task to detect the "Resources" subdirectory,
and show a better error message. There's also a way to disable the validation
(by setting `CodesignDisallowResourcesSubdirectoryInAppBundle=false`), just in
case we end up being overeager with the validation.

Fixes #20135.

---------

Co-authored-by: Manuel de la Pena <mandel@microsoft.com>
.NET 9 automation moved this from Other to Done May 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement The issue or pull request is an enhancement msbuild Issues affecting our msbuild tasks/targets
Projects
2 participants