Unsealed contents present in the root directory of an embedded framework

Question

I am facing this issue when i try to sign the nwjs framework

codesign -f -v --deep -s '3rd Party Mac Developer Application: Company Name. (XXXXXXXXX)' --entitlements Child.plist hello.app/Contents/Versions/59.0.3071.115/nwjs\ Framework.framework

Can anyone please suggest what should i do

Have you take a look at https://stackoverflow.com/questions/25950544/codesign-what-are-unsealed-contents? — , Aug 08 '17 at 15:11
as pointed out in my answer the xattr -cr command removes all content that cannot be sealed — Silve2611, Oct 18 '17 at 15:56

Swati · Answer 1 · 2017-08-23T12:24:43.587

2

I tried this :

Do not change any other info.plist except for the below mentioned app files and the error was gone.

Helper.app
app_mode_loader.app
nwjs.app [main app]

Also before signing the framework do

codesign -f -v --deep -s '3rd Party Mac Developer Application: Company Name. (XXXXXXXXX)' --entitlements Child.plist hello.app/Contents/Versions/59.0.3071.115/nwjs\ Framework.framework/Versions/A/nwjs\ Framework

then

codesign -f -v --deep -s '3rd Party Mac Developer Application: Company Name. (XXXXXXXXX)' --entitlements Child.plist hello.app/Contents/Versions/59.0.3071.115/nwjs\ Framework.framework

edited Aug 23 '17 at 12:24

answered Aug 23 '17 at 08:55

Swati

2,870
7
45
87

Doesn't help for me – Arti Aug 24 '17 at 18:17
what nwjs version are you using? i have used 23.6 and things are fine there. can you check with this version if possible – Swati Aug 25 '17 at 07:03
Yes, I'm on 23.6 too. Could you show all your sign script please – Arti Aug 25 '17 at 07:56
Also you build your app with nw-builder ? – Arti Aug 25 '17 at 08:07
The nwjs provides you a folder with nwjs.app file. Right click on this App file >> Show Package contents >> Contents folder, Inside this you have to place your Test.nw. What is Test.nw :: Create a folder named Test. This folder should contain your package.json and other files at root level. Rename this Test folder to Test.nw – Swati Aug 25 '17 at 09:00
M not using nw builder. After i add app.nw in nwjs.app i run codesign command to sign the app and productbuild to create the package in terminal – Swati Aug 25 '17 at 09:01

score 1 · Answer 2 · answered Jun 28 '18 at 18:25

I had the same issue trying to sign my nwjs app I received this message:

"Contents/Versions/67.0.3396.87/nwjs Framework.framework: unsealed contents present in the root directory of an embedded framework"

I solved this by doing the following steps:

move Versions/67.0.3396.87/nwjsFramework.framework/libnode.dylib into the A folder located Versions/67.0.3396.87/nwjsFramework.framework/Versions/A/libnode.dylib.
go back on command line to Versions/67.0.3396.87/nwjsFramework.framework.
enter ln -s Versions/A/libnode.dylib.
try sign again after this.

From what I read some files in the embedded framework folder should sit inside folder in order to be able to sign the code. so the steps above move the file to the required folder and then step 3 create a symlink folder for the file we moved.

This worked for me, hope it will help you solve your problem or whoever read this.

score 0 · Answer 3 · answered Oct 18 '17 at 15:54

I have made a small script that should help you. The folder 60.0.3112.113 differs from version to version.

xattr is important to remove not allowed content also be careful with the name of you executable

app="yourapp.app"
identity="Developer ID Application: Yourname...."

echo "### removing unnecessary files"
rm -f "$app/Icon^M" #remove if exists
rm -r -f "$app/.idea" #remove if exists
xattr -cr "$app" #remove all unallowed files

echo "### signing libraries"
#codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/Libraries/exif.so"
#codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/libffmpeg.dylib"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/libnode.dylib"

echo "### signing frameworks"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/nwjs Framework"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/Helpers/crashpad_handler"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/timeBro Helper.app/Contents/MacOS/timeBro Helper"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/timeBro Helper.app/"
codesign --force --verify --sign "$identity" "$app/Contents/Versions/60.0.3112.113/nwjs Framework.framework/helpers/crashpad_handler"

echo "### sing osx folder"
codesign --force --verify --sign "$identity"  "$app/Contents/MacOS/yourapp" #be careful here should be the exact name of your executably

echo "### signing app"
codesign --force --verify --sign "$identity" "$app"

echo "### verifying signature"
codesign -vv -d "$app"

Unsealed contents present in the root directory of an embedded framework

3 Answers3