SD Notary - can't re-notarize LibreOffice

SD Notary
#1

Here is a minor puzzle. I maintain a script app that contains a complete copy of the open-source LibreOffice app (which, according to the LibreOffice site, can be used for any purpose whatever). In order to avoid conflicts with a user’s existing copy of LibreOffice, I rename the copy of the app in my bundle to “LOWP” (i.e. LibreOffice for WordPerfect), replace the icon, and change two things in info.plist: the bundle identifier, so that I can try to notarize it, and the name of the bundle.

When I try to notarize it in SD Notary, I get this error message from codesign at the point where it tries to codesign the unix executables in LibreOffice. If I remove the executable that causes the problem on my first attempt to notarize, another executable causes the same problem the next time. The only one I really need is “soffice” and that also produces this failure if I take out everything else from the MacOS folder:

Screen Shot 2021-02-20 at 11.49.38 AM
Screen Shot 2021-02-20 at 11.49.38 AM729×106 19.8 KB

I’ve checked off all the boxes in the Advanced section (except for “Is debugging tool” and “Extra entitlements”) and have checked “Can send Apple events.”

What am I missing that made it possible for the LibreOffice developers manage to notarize their app?

#2

The issue here is that the file senddoc is not a binary file, and therefore should not be in /Contents/MacOS/. (There are others in there too.) To quote from Apple tech note 2206 on code signing:

Store Python, Perl, shell, and other script files and other non-Mach-O executables in your app’s Contents/Resources directory. While it’s possible to sign such executables and store them in Contents/MacOS, this is not recommended.

You can see the tech note here, with full details:

https://developer.apple.com/library/archive/technotes/tn2206/_index.html

In short, it can be done, but for the reasons outlined in the tech note, SD Notary doesn’t.

#3

Thank you for that. It seems clear that the LibreOffice developers chose to sign the files, despite the tech note. I understand fully that SD Notary doesn’t do that, and for good reason.

Thanks for looking into this!

#4

Shane, You pointed me to the easy solution: My specific application didn’t need the scripts that were in the MacOS; I simply deleted them, and the app notarized perfectly in SD Notary.

Thank you again for looking into this!