Signed app should allow JIT on correct helpers to not crash

After I signed my application, the blank screen is displayed when I launch it. Could you give me some advice to fix this problem?
This problem only occurs on the macOS 10.14(Mojave). This app run on other version of macOS are normal.
By the way, I'm using electron-packager to package my app. Using electron-osx-sign to sign the app.
electron: 1.7.9
electron-packager: 8.7.2
electron-osx-sign: 0.4.11

I sign my app with the following command:
electron-osx-sign "xxx.app" --platform=darwin --type=distribution --identity="Developer ID Application: xxx (xxxxx)" --keychain="xxx.keychain" --entitlements="entitlements.plist" --hardened-runtime

I'm attempt to distribute my app outside the Mac App Store. And I don't want to enable App Sandbox.
entitlements.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
  </dict>
</plist>

The final result:
① sign -> success
② launch -> blank screen
③ notarization -> success

Then I sign different version(v1.7.9 & v4.0.1) of electron sample application(electron-quick-start). When I launch these two applications, the problem with the blank screen still occurs.
P.S. This problem still only occurs on the macOS 10.14(Mojave).
electron: 1.7.9 / 4.0.1
electron-packager: 13.0.1
electron-osx-sign: 0.4.11

I package these two apps with the following command:
node release.js

release.js
var packager = require('electron-packager');
var config = require('./package.json');
var app_name = 'xxxxx';

packager({
    dir: './',
    out: './dist/osx',
    name: app_name,
    platform: 'darwin',
    arch: 'x64',
    icon: './Appicon.icns',

    'appBundleId': 'xx.xxx.app',
    'appVersion': config.version,
    'appCopyright': 'Copyright (c) xxxx All rights reserved.',
    appCategoryType: 'public.app-category.graphics-design',
    overwrite: true,
    asar: {unpackDir: 'testUnpack'},
    prune: true,
    ignore: 'unpacked|node_modules/(electron-packager|electron|\.bin)|release\.js',
    electronVersion: 'x.x.x'
}).then(function (appPaths) {
    console.log('\n' + appPaths + ' Done!\n');
}).catch(function (err) {
    if(err) {
        throw new Error(err);
    }
});

p.s.
① v1.7.9:
app_name -> 'sample(current_v1.7.9)'
electronVersion -> '1.7.9'
② v4.0.1:
app_name -> 'sample(latest_v4.0.1)'
electronVersion -> '4.0.1'
I sign these two apps with the following commands:
(1) export DEBUG=electron-osx-sign*
(2) electron-osx-sign "xxx.app" --platform=darwin --type=distribution --identity="Developer ID Application: xxx (xxxxx)" --keychain="xxx.keychain" --entitlements="entitlements.plist" --hardened-runtime > sample.log

entitlements.plist

It's the same as the above file(entitlements.plist)

sample1_7_9.log
  electron-osx-sign<EMAIL_ADDRESS>+0ms
  electron-osx-sign `identity` passed in arguments. +25ms
  electron-osx-sign Executing... security find-identity -v /Library/Keychains/xxx.keychain +1ms
  electron-osx-sign Identity:
 > Name: Developer ID Application: xxx (xxxxx)
 > Hash: 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE +68ms
  electron-osx-sign Found 1 identity. +0ms
  electron-osx-sign Pre-sign operation enabled for provisioning profile:
 * Disable by setting `pre-embed-previsioning-profile` to `false`. +1ms
  electron-osx-sign Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`:
 * Disable by setting `pre-auto-entitlements` to `false`. +0ms
  electron-osx-sign No `provisioning-profile` passed in arguments, will find in current working directory and in user library... +0ms
  electron-osx-sign No provisioning profile found, will not embed profile in app contents. +2ms
  electron-osx-sign Automating entitlement app group...
 > Info.plist: sample(current_v1.7.9).app/Contents/Info.plist
 > Entitlements: entitlements.plist +0ms
  electron-osx-sign Signing application...
 > Application: sample(current_v1.7.9).app
 > Platform: darwin
 > Entitlements: entitlements.plist
 > Child entitlements: /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist
 > Additional binaries: []
 > Identity: { name: 'Developer ID Application: xxx (xxxxx)',
  hash: '6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE' } +6ms
  electron-osx-sign Walking... sample(current_v1.7.9).app/Contents +2ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +20ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +3s
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib +401ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler +996ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework +341ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle +3s
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework +732ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa +735ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework +364ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt +362ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel +737ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework +735ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app/Contents/MacOS/sample(current_v1.7.9) Helper EH +350ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app/Contents/MacOS/sample(current_v1.7.9) Helper EH +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app +335ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app/Contents/MacOS/sample(current_v1.7.9) Helper NP +349ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app/Contents/MacOS/sample(current_v1.7.9) Helper NP +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app +334ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app/Contents/MacOS/sample(current_v1.7.9) Helper +340ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app/Contents/MacOS/sample(current_v1.7.9) Helper +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app +335ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements /usr/local/lib/node_modules/electron-osx-sign/default.entitlements.darwin.inherit.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app +340ms
  electron-osx-sign Executing... codesign --sign 6E53C45AD76F3B1BFDFCC3E39A22082C1847FEEE --force --keychain /Library/Keychains/xxx.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app +0ms
  electron-osx-sign Verifying... +357ms
  electron-osx-sign Verifying application bundle with codesign... +1ms
  electron-osx-sign Executing... codesign --verify --deep --strict --verbose=2 sample(current_v1.7.9).app +0ms
  electron-osx-sign Verifying Gatekeeper acceptance for darwin platform... +958ms
  electron-osx-sign Executing... spctl --assess --type execute --verbose --ignore-cache --no-cache sample(current_v1.7.9).app +0ms
  electron-osx-sign Verified. +828ms
  electron-osx-sign Displaying entitlements... +0ms
  electron-osx-sign Executing... codesign --display --entitlements :- sample(current_v1.7.9).app +0ms
  electron-osx-sign Entitlements:
 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
  </dict>
</plist>

 +40ms
  electron-osx-sign Application signed. +0ms
  electron-osx-sign Application signed: sample(current_v1.7.9).app +0ms
Application signed: sample(current_v1.7.9).app

sample4_0_1.log

This log file is basically the same as sample1_7_9.log except the app name

I couldn't release my application, because of this problem. My application signed with electron-osx-sign. The application window become blank when it run on macOS 10.14(Mojave). I signed the electron(ver.4.0.1) sample code but the same problem happened. By the way, these programs can be notarized successfully.
I don't know which step of my operations is wrong. Is it bug of electron-osx-sign?
@sethlu Could you help me solve this problem?

I couldn't release my application, because of this problem. My application signed with electron-osx-sign. The application window become blank when it run on macOS 10.14(Mojave). I signed the electron(ver.4.0.1) sample code but the same problem happened. By the way, these programs can be notarized successfully.
I don't know which step of my operations is wrong. Is it bug of electron-osx-sign?
@sethlu Could you help me solve this problem?

@androidW Thanks for posting this issue! I just managed to reproduce this and it seems to be something with the hardened runtime option 🤔... without hardened runtime, thus also without notarization, everything seems working just fine.
I may have some time next week to take a closer look at this. Since it may be a while before anyone find out a good solution to the hardened runtime issue, we may expect to get app notarization working at a little later time.

I was playing with the following entitlements but the window is still blank after codesigned with hardened runtime (not notarized):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
</dict>
</plist>

@sethlu Thanks for the reply! Hope to you can find a good solution. And sorry to take up your time.

Well I'll bump this at a higher priority 🚨

Ref: Recent announcements from Apple Developer Relations

We’re working with developers to create a safer Mac user experience through a process where all software, whether distributed on the App Store or outside of it, is signed or notarized by Apple. With the public release of macOS 10.14.5, we require that all developers creating a Developer ID certificate for the first time notarize their apps, and that all new and updated kernel extensions be notarized as well. This will help give users more confidence that the software they download and run, no matter where they get it from, is not malware by showing a more streamlined Gatekeeper interface. In addition, we’ve made the following enhancements to the notarization process.

Legacy code is fully supported, even if it contains unsigned binaries. While new software and updates require proper signatures in order to be notarized, you can upload your existing software as-is.
Apps with plugin ecosystems are better supported.
Stapler supports all types of bundles and plugins.
Xcode 10.2 adds secure timestamps and other code signing options required by the notary service.

I have found setting the "enetitlements-inherit" option along with the "entitlements" option as below allow my application to be signed successfully. The application is working correctly and can be notarized successfully.
app.entitlements
`

com.apple.security.cs.allow-jit

com.apple.security.cs.allow-unsigned-executable-memory

`
And call the API using the following:
sign({     app: 'myApp.app',     entitlements: "app.entitlements",      "hardened-runtime": true,      platform: "darwin",       type: "distribution" ,      "entitlements-inherit": "app.entitlements"   }, async function done (err) {     if (err) {       console.log(err);       return;     }     else{       console.log("Application signed");     }    })

@d-j-t Oh awesome! Thanks for posting your solution! I will give that a try too 😺

@d-j-t Just tested this out and it worked perfectly! I think I made a mistake with com.apple.security.inherit as it only inherits App Sandbox properties so these hardened-runtime entitlements need to restated again in the child entitlements file 👍
Also credits to @MarshallOfSound for bringing up that com.apple.security.cs.allow-unsigned-executable-memory alone should allow the JIT stuff. The snippet below should be the minimum required for both the app bundle entitlements and the child entitlements.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
</dict>
</plist>

@androidW Perhaps give this a try? Let us know if it works for you 😺 Afterwards we can update the docs on readme.

Excerpt from Apple documentation:

Allow Unsigned Executable Memory Entitlement
A Boolean value that indicates whether the app may create writable and executable memory without using the MAP_JIT flag.
Key: com.apple.security.cs.allow-unsigned-executable-memory

https://developer.apple.com/documentation/bundleresources/entitlements?language=objc

@d-j-t Thanks for your solution! I hope it can solve my problem.
@sethlu I will try it next week. After then I will give you the result. Thank you so much.

@sethlu I have been tried it. My application is signed successfully. And it is working correctly, but the notarization is failed.
Then I try to sign electron sample application(electron version: V1.7.9 and v4.0.1). The result is the same as my application. The blank window is not shown, but these two sample app failed to notarized.
I have set the "entitlements-inherit" option. And modified the entitlements.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
  </dict>
</plist>

I used two ways to sign these apps.
(1) I sign my app with the following command:
electron-osx-sign "xxx.app" --platform=darwin --type=distribution --identity="Developer ID Application: xxx (xxxxx)" --keychain="xxx.keychain" --entitlements="entitlements.plist" --entitlements-inherit="entitlements.plist" --hardened-runtime

(2) And call the API using the following:
var sign = require('electron-osx-sign');
sign({
    app: 'xxx.app',
    platform: "darwin",
    type: "distribution",
    identity: "Developer ID Application: xxx (xxxxx)",
    keychain: "xxx.keychain",
    entitlements: "entitlements.plist",
    "entitlements-inherit": "entitlements.plist",
    "hardened-runtime": true
    }, function done (err) {
        if (err) {
            console.log(err);
            return;
        } else{
            console.log("Application signed");
        }
    });

The notarization log file is as below:
{
  "logFormatVersion": 1,
  "jobId": "e4ef4594-d4a5-4b6d-890c-fa30296dd47b",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "sample_current_v1.7.9.zip",
  "uploadDate": "2019-04-26T01:34:54Z",
  "sha256": "2f4e87024db3626609a38349586db25c11b44753d852b284af16db5a20ae2b28",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v1.7.9.zip/sample(current_v1.7.9).app/Contents/MacOS/sample(current_v1.7.9)",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v1.7.9.zip/sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Electron Framework",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v1.7.9.zip/sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Squirrel",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v1.7.9.zip/sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework/ReactiveCocoa",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v1.7.9.zip/sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Mantle",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    }
  ]
}

@sethlu @d-j-t Do you know which steps were wrong?

@androidW I haven't personally tried notarizing an app 🤔 However, it may be helpful to have some codesigning logs for reference... Would you mind re-running the codesigning steps with export DEBUG=electron-osx-sign* and sharing the result (with sensitive info redacted)?
@d-j-t Have you met this issue before?

@sethlu The result as below:
MacMiniSrv2:20190507 root# export DEBUG=electron-osx-sign*
MacMiniSrv2:20190507 root# electron-osx-sign 'sample(current_v1.7.9).app' --platform=darwin --type=distribution --identity="Developer ID Application: MyDevID (XXX)" --keychain="/Library/Keychains/MyDevID.keychain" --entitlements="entitlements.plist" --entitlements-inherit="entitlements.plist" --hardened-runtime
  electron-osx-sign<EMAIL_ADDRESS>+0ms
  electron-osx-sign `identity` passed in arguments. +9ms
  electron-osx-sign Executing... security find-identity -v /Library/Keychains/MyDevID.keychain +0ms
  electron-osx-sign Identity:
 > Name: Developer ID Application: MyDevID (XXX)
 > Hash: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF +261ms
  electron-osx-sign Found 1 identity. +0ms
  electron-osx-sign Pre-sign operation enabled for provisioning profile:
 * Disable by setting `pre-embed-previsioning-profile` to `false`. +0ms
  electron-osx-sign Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`:
 * Disable by setting `pre-auto-entitlements` to `false`. +1ms
  electron-osx-sign No `provisioning-profile` passed in arguments, will find in current working directory and in user library... +0ms
  electron-osx-sign No provisioning profile found, will not embed profile in app contents. +2ms
  electron-osx-sign Automating entitlement app group...
 > Info.plist: sample(current_v1.7.9).app/Contents/Info.plist
 > Entitlements: entitlements.plist +0ms
  electron-osx-sign Signing application...
 > Application: sample(current_v1.7.9).app
 > Platform: darwin
 > Entitlements: entitlements.plist
 > Child entitlements: entitlements.plist
 > Additional binaries: []
 > Identity: { name: 'Developer ID Application: MyDevID (XXX)',
  hash: 'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF' } +6ms
  electron-osx-sign Walking... sample(current_v1.7.9).app/Contents +3ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +20ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +9s
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib +958ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libnode.dylib +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler +1s
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/crashpad_handler +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework +757ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Electron Framework.framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle +3s
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework +727ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa +729ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework +351ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/ReactiveCocoa.framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt +742ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel +731ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework +733ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/Squirrel.framework +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app/Contents/MacOS/sample(current_v1.7.9) Helper EH +732ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app/Contents/MacOS/sample(current_v1.7.9) Helper EH +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app +748ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper EH.app +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app/Contents/MacOS/sample(current_v1.7.9) Helper NP +749ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app/Contents/MacOS/sample(current_v1.7.9) Helper NP +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app +719ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper NP.app +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app/Contents/MacOS/sample(current_v1.7.9) Helper +720ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app/Contents/MacOS/sample(current_v1.7.9) Helper +1ms
  electron-osx-sign Signing... sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app +330ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app/Contents/Frameworks/sample(current_v1.7.9) Helper.app +0ms
  electron-osx-sign Signing... sample(current_v1.7.9).app +729ms
  electron-osx-sign Executing... codesign --sign FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF --force --keychain /Library/Keychains/MyDevID.keychain --options runtime --entitlements entitlements.plist sample(current_v1.7.9).app +0ms
  electron-osx-sign Verifying... +1s
  electron-osx-sign Verifying application bundle with codesign... +1ms
  electron-osx-sign Executing... codesign --verify --deep --strict --verbose=2 sample(current_v1.7.9).app +0ms
  electron-osx-sign Verifying Gatekeeper acceptance for darwin platform... +800ms
  electron-osx-sign Executing... spctl --assess --type execute --verbose --ignore-cache --no-cache sample(current_v1.7.9).app +0ms
  electron-osx-sign Verified. +1s
  electron-osx-sign Displaying entitlements... +0ms
  electron-osx-sign Executing... codesign --display --entitlements :- sample(current_v1.7.9).app +0ms
  electron-osx-sign Entitlements:
 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
  </dict>
</plist>

 +36ms
  electron-osx-sign Application signed. +0ms
  electron-osx-sign Application signed: sample(current_v1.7.9).app +1ms
Application signed: sample(current_v1.7.9).app

@androidW I'm not very sure 🤔 Can you run the following command with the correct path to the Mantle binary and display the output?
codesign -vvv --deep --strict path/to.app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle

Ref: https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution/resolving_common_notarization_issues?language=objc

@sethlu Sorry for the late reply. I'm ran the command. Then I get the output result as below.
MacMiniSrv2:20190507 root# codesign -vvv --deep --strict './sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle'
./sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle: valid on disk
./sample(current_v1.7.9).app/Contents/Frameworks/Mantle.framework/Versions/A/Mantle: satisfies its Designated Requirement
MacMiniSrv2:20190507 root#

It seem like the signature result is correct. Why the notarization is failed ?

I use electron-builder and the code-signing, notarization and app-launching work for me if I:

Update the build config to:

   "mac": {
      "identity": "Some Company, Inc. (XXXXX)",
      "entitlements": "build/entitlements.mac.plist",
      "entitlementsInherit": "build/entitlements.mac.plist"
    },

Create build/entitlements.mac.plist based on @MarshallOfSound and @sethlu's suggestions:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
  </dict>
</plist>

Follow the suggestion from https://github.com/electron-userland/electron-builder/issues/3383#issuecomment-431537520, in node_modules/electron-osx-sign/sign.js add the following line, since electron-builder hasn't provided a way to enable hardened-runtime option yet.:

args.push('--options', 'runtime')

Package info:
electron: 4.2.0
electron-builder: 20.39.0
electron-osx-sign: 0.4.11

Hope this helps!

I use electron-builder and the code-signing, notarization and app-launching work for me if I:
1. Update the build config to:

   "mac": {
      "identity": "Some Company, Inc. (XXXXX)",
      "hardenedRuntime": true,
      "entitlements": "build/entitlements.mac.plist",
      "entitlementsInherit": "build/entitlements.mac.plist"
    },

1. Create `build/entitlements.mac.plist` based on @MarshallOfSound and @sethlu's suggestions:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
  </dict>
</plist>

Package info:
electron: 4.2.0
electron-builder: 20.41.0
electron-osx-sign: 0.4.11

Hope this helps!

Using the exact same setup, my app crashes directly after launch, putting following error into Console.app from process tccd:
Prompting policy for hardened runtime: service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for ACC:{ID: com.myapp.app, PID[71862], auid: 501, euid: 501, binary path: '/Users/dev/Desktop/MyApp.app/Contents/MyApp'}, REQ: {ID: com.apple.appleeventsd, PID[51], auid: 55, euid: 55, binary path '/System/Library/CoreServices/appleeventsd'}
Adding the required entitlement to entitlements.mac.plist results in errors from cfprefsd and contextstored not able to write keys:
cfprefsd:
rejecting write of key _DKThrottledActivityLast_DKKnowledgeStorageLogging_DKKnowledgeStorageDidInsertEventsNotification:/app/usageActivityDate in { com.apple.contextstored, root, kCFPreferencesAnyHost, no container, managed: 0 } from process 109 because setting preferences outside an application's container requires user-preference-write or file-write-data sandbox access
rejecting write of key _DKThrottledActivityLast_DKKnowledgeStorageLogging_DKKnowledgeStorageDidInsertLocalEventsNotification:/app/usageActivityDate in { com.apple.contextstored, root, kCFPreferencesAnyHost, no container, managed: 0 } from process 109 because setting preferences outside an application's container requires user-preference-write or file-write-data sandbox access
contextstored:
Couldn't write value for key _DKThrottledActivityLast_DKKnowledgeStorageLogging_DKKnowledgeStorageDidInsertEventsNotification:/app/usageActivityDate in CFPrefsPlistSource<0x7f8d4d70b260> (Domain: com.apple.contextstored, User: kCFPreferencesCurrentUser, ByHost: No, Container: (null), Contents Need Refresh: Yes): setting preferences outside an application's container requires user-preference-write or file-write-data sandbox access
Couldn't write value for key _DKThrottledActivityLast_DKKnowledgeStorageLogging_DKKnowledgeStorageDidInsertLocalEventsNotification:/app/usageActivityDate in CFPrefsPlistSource<0x7f8d4d70b260> (Domain: com.apple.contextstored, User: kCFPreferencesCurrentUser, ByHost: No, Container: (null), Contents Need Refresh: Yes): setting preferences outside an application's container requires user-preference-write or file-write-data sandbox access

@chawei Thanks for your answer.
Because of some reasons, I couldn't sign my application directly.
So I try to use electron-builder pack electron sample code. Then other colleague help me sign the application.
The app launch is normally, but notarization still failed. I got the same result as using electron-packager to pack and use electron-osx-sign to sign.
I want to know if there is a problem with this sign method. Could you help me test this case?
Using electron-builder to pack the application without auto-sign, then use electron-osx-sign to sign the app manually.(When electron-builder packed, the .app file was in the /dist/mac/xxx.app by default)

electron: 4.2.0
electron-builder: 20.41.0
electron-osx-sign: 0.4.11

package.json:
{
  "name": "electron-quick-start",
  "version": "1.0.0",
  "description": "A minimal Electron application",
  "main": "main.js",
  "build": {
    "appId": "test",
    "productName": "sample_current_v420_newBuilder",
    "electronVersion": "4.2.0"
  },
  "scripts": {
    "start": "electron .",
    "build": "node release.js",
    "pack": "electron-builder --dir",
    "dist": "electron-builder"
  },
  "repository": "https://github.com/electron/electron-quick-start",
  "keywords": [
    "Electron",
    "quick",
    "start",
    "tutorial",
    "demo"
  ],
  "author": "GitHub",
  "license": "CC0-1.0",
  "devDependencies": {
    "electron": "^4.2.0",
    "electron-builder": "^20.41.0",
    "electron-packager": "^13.1.1"
  }
}

notarization log:
{
  "logFormatVersion": 1,
  "jobId": "245562d5-b6ae-4299-9e77-6cb364382929",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "sample_current_v420_newBuilder.zip",
  "uploadDate": "2019-05-23T01:03:52Z",
  "sha256": "27e74cc6d7d94d9823de3b5389296f50c958a3a03314842145f66eeaa95ee6a6",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v420_newBuilder.zip/sample_current_v420_newBuilder.app/Contents/MacOS/sample_current_v420_newBuilder",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v420_newBuilder.zip/sample_current_v420_newBuilder.app/Contents/Frameworks/Electron Framework.framework/Electron Framework",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v420_newBuilder.zip/sample_current_v420_newBuilder.app/Contents/Frameworks/Squirrel.framework/Squirrel",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v420_newBuilder.zip/sample_current_v420_newBuilder.app/Contents/Frameworks/ReactiveCocoa.framework/ReactiveCocoa",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "sample_current_v420_newBuilder.zip/sample_current_v420_newBuilder.app/Contents/Frameworks/Mantle.framework/Mantle",
      "message": "The signature of the binary is invalid.",
      "docUrl": null,
      "architecture": "x86_64"
    }
  ]
}

@androidW i think your issue has nothing to do with notarization and it's more of code signing issue. make sure you or your colleague has the valid certificate. search "The signature of the binary is invalid" in this article: https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution/resolving_common_notarization_issues. hope it helps.

@chawei The certificate is valid.
And I ran this command and the result shows that the signature is valid. (The result is the same as this)
The notarization log only shows that these 5 modules are signed incorrectly. I think other modules are signed successfully.
Do you know what caused  these 5 module signed failed?

@androidW unfortunately i've never experienced this before so it's hard to know why this might be with the quick glance.

Prompting policy for hardened runtime: service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for ACC:{ID: com.myapp.app, PID[71862], auid: 501, euid: 501, binary path: '/Users/dev/Desktop/MyApp.app/Contents/MyApp'}, REQ: {ID: com.apple.appleeventsd, PID[51], auid: 55, euid: 55, binary path '/System/Library/CoreServices/appleeventsd'}

@puresick I ran into the same issue as well when trying to enable hardened runtime for my app. Even after adding com.apple.security.automation.apple-events, I got the following error:
{"error":"Error: dlopen(/var/folders/t1/khxbwjns5237jl5vmq8ky69w0000gp/T/.org.iota.trinity.m2dYyh, 1): no suitable image found.  Did find:
	/var/folders/t1/khxbwjns5237jl5vmq8ky69w0000gp/T/.org.iota.trinity.m2dYyh: code signature in (/var/folders/t1/khxbwjns5237jl5vmq8ky69w0000gp/T/.org.iota.trinity.m2dYyh) not valid for use in process using Library Validation: mapped file has no cdhash, completely unsigned? Code has to be at least ad-hoc signed.
	/var/folders/t1/khxbwjns5237jl5vmq8ky69w0000gp/T/.org.iota.trinity.m2dYyh: stat() failed with errno=17
    at process.module.(anonymous function) [as dlopen] (ELECTRON_ASAR.js:160:31)
    at Object.Module._extensions..node (internal/modules/cjs/loader.js:722:18)
    at Object.module.(anonymous function) [as .node] (ELECTRON_ASAR.js:169:18)
    at Module.load (internal/modules/cjs/loader.js:602:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:541:12)
    at Function.Module._load (internal/modules/cjs/loader.js:533:3)
    at Module.require (internal/modules/cjs/loader.js:640:17)
    at require (internal/modules/cjs/helpers.js:20:18)
    at Object.<anonymous> (/Volumes/Trinity/Trinity.app/Contents/Resources/app.asar/node_modules/keytar/lib/keytar.js:1:169)
    at Object.<anonymous> (/Volumes/Trinity/Trinity.app/Contents/Resources/app.asar/node_modules/keytar/lib/keytar.js:61:3)"}

Adding the com.apple.security.cs.disable-library-validation entitlement fixed the issue for me, but I'm not entirely sure why

This tutorial resolved all my problems (and yours I guess) : https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/
If you sign it manually or if you try to enable hardened runtime on OSX >= 10.14 after the build it will make your app crash.
This is why you have to do it directly when building your application (the tutorial shows it all).

I followed the tutorial and the main app process runs fine. However, the browser windows never open because they are crashing.
Exception Type:        EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes:       0x0000000000000001, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Illegal instruction: 4
Termination Reason:    Namespace SIGNAL, Code 0x4
Terminating Process:   exc handler [47472]

Application Specific Information:
dyld: launch, running initializers
/usr/lib/libSystem.B.dylib
Could not set sandbox profile data: Operation not permitted (1)

Application Specific Signatures:
SYSCALL_SET_PROFILE

Not seeing a lot of search results for this error. My app is heavy with native node modules.
I've experimented with many different entitlements... now trying to add in the kitchen sink:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.files.user-selected.read-only</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.network.server</key>
<true/>
<key>com.apple.security.device.usb</key>
<true/>
<key>com.apple.security.print</key>
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
<key>com.apple.security.automation.apple-events</key>
<true/>
</dict>
</plist>

My issue was stemming from both sandbox and hardening being active in the build. I am working on offering my app outside the App Store, which is why I'm exploring notarization. Because of this, I assumed that because my app is already sandboxed, I should try to add hardening... but it seems that they are mutually exclusive at the moment. Further, reading about both of these (sandbox & hardening) at https://lapcatsoftware.com/articles/hardened-runtime-sandboxing.html makes me feel like I can continue to offer a sandboxed-only version in the App Store, and a hardened-only version outside the App Store. Electron-builder doesn't make this easy, and perhaps I need to open another ticket there, but I'll quickly describe the setup so I can build MAS (sandboxed-only) and MAC builds (hardened-only) side by side.
package.json scripts:
"package-mac": "npm run build && build --mac zip",
"package-mas": "npm run build && build --mac mas mas-dev --config.afterSign=build/do-nothing.js --config.mac.hardenedRuntime=false",

It's not ideal to set afterSign to "do-nothing.js" but... =null ("null"), =undefined ("undefined") and just plain = ('') results in strings.
package.json build:
"mac": {
      "category": "public.app-category.productivity",
      "target": [
        "mas",
        "mas-dev",
        "zip"
      ],
      "hardenedRuntime": true,
      "entitlements": "build/entitlements-lll.plist",
      "entitlementsInherit": "build/entitlements-lll.plist",
      "gatekeeperAssess": false
    },
    "afterSign": "build/notarize.js",
    "mas": {
      "provisioningProfile": "build/embeddedyesmas.provisionprofile",
      "entitlements": "build/entitlements-sandbox.plist",
      "entitlementsInherit": "build/entitlements-inherit.plist"
    },

entitlements-lll.plist (these 3, plus my normal entitlements for app-specific behavior)
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>

entitlements-sandbox.plist (this 1 for sandboxing, plus my normal entitlements for app-specific behavior)
<key>com.apple.security.app-sandbox</key>
<true/>

entitlements-inherit.plist (just the default, only two, that's it)
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>

I hope this helps someone get both sandboxing and hardening setup with their builds. I'm eager to simplify this setup because overriding like this is a pain.

My issue was stemming from both sandbox and hardening being active in the build. I am working on offering my app outside the App Store, which is why I'm exploring notarization. Because of this, I assumed that because my app is already sandboxed, I should try to add hardening... but it seems that they are mutually exclusive at the moment. Further, reading about both of these (sandbox & hardening) at https://lapcatsoftware.com/articles/hardened-runtime-sandboxing.html makes me feel like I can continue to offer a sandboxed-only version in the App Store, and a hardened-only version outside the App Store. Electron-builder doesn't make this easy, and perhaps I need to open another ticket there, but I'll quickly describe the setup that allows me to build MAS (sandboxed-only) and MAC builds (hardened-only) side by side.
package.json scripts:
"package-mac": "npm run build && build --mac zip",
"package-mas": "npm run build && build --mac mas mas-dev --config.afterSign=build/do-nothing.js --config.mac.hardenedRuntime=false",

It's not ideal to set afterSign to "do-nothing.js" but... =null ("null"), =undefined ("undefined") and just plain = ('') results in strings.
package.json build:
"mac": {
      "category": "public.app-category.productivity",
      "target": [
        "mas",
        "mas-dev",
        "zip"
      ],
      "hardenedRuntime": true,
      "entitlements": "build/entitlements-lll.plist",
      "entitlementsInherit": "build/entitlements-lll.plist",
      "gatekeeperAssess": false
    },
    "afterSign": "build/notarize.js",
    "mas": {
      "provisioningProfile": "build/embeddedyesmas.provisionprofile",
      "entitlements": "build/entitlements-sandbox.plist",
      "entitlementsInherit": "build/entitlements-inherit.plist"
    },

entitlements-lll.plist (these 3, plus my normal entitlements for app-specific behavior)
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>

entitlements-sandbox.plist (this 1 for sandboxing, plus my normal entitlements for app-specific behavior)
<key>com.apple.security.app-sandbox</key>
<true/>

entitlements-inherit.plist (just the default, only two, that's it)
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>

I hope this helps someone get both sandboxing and hardening setup with their builds. I'm eager to simplify this setup because overriding like this is a pain.

Hi Semirej, I also landed in same situation where I need both sandbox and hardening. And yes they both are working well in their respective space but not together.
Hope, we can get some support for the same soon. Kindly update if find any progress for it at<EMAIL_ADDRESS>Happy Coding!!

I'm facing a similar issue. App to be distributed outside of App Store.
I think I tried all the different 'solutions' mentioned here, but nothing seems to work.
I'm running Xcode 10.1 on High Sierra on my dev machine. Could this be the problem?

@semireg Do you mean that the Mac App Store App no need to hardened and notarization?

This was made much harder to debug for me by running into this bug:
https://github.com/electron/electron/issues/15958
I wrongly assumed that the error log sometimes just doesn't get saved for whatever reason, but actually everything was working fine.

I experienced this issue on macOS 10.15.1, too.
The solution outlined above in https://github.com/electron/electron-osx-sign/issues/188#issuecomment-483778579 fixed it! Thanks!

Experiencing this issue today. Current workaround is to double-down on entitlements as described in https://github.com/electron/electron-osx-sign/issues/188#issuecomment-486913113. With that, I was able to sign with a hardened runtime and notarize successfully.
macOS: 10.15.3 Catalina
XCode: 11.3.1
electron-osx-sign: 0.4.15

This is still an issue, since Apple requires your to have both hardened runtime and app-sandbox activated to distribute a app through the Mac App Store. See also https://github.com/electron/electron/issues/22656

Zsign technical support:
Apple signature tool iPA supporting ios15 and ios16
Support the removal of dylib dynamic library
Support Windows Mobile mac
It can help solve the problems that IOS cannot be installed and verified
https://urlzs.com/44zCx

@MarshallOfSound JFYI because it could potentially be another known issue:

Given a MAS build that's been signed with an Apple Development certificate (this is needed to test a sandboxed app locally)
When I launch the packaged app on MacOS Big Sur
Then the app crashes unless I add the com.apple.security.cs.allow-unsigned-executable-memory entitlement to the MAS child entitlements file

Looks like guys from RocketChat faced a similar issue but for a production App Store build: https://github.com/RocketChat/Rocket.Chat.Electron/issues/2373
and solved it by exactly adding the com.apple.security.cs.allow-unsigned-executable-memory entitlements for the helpers (see https://github.com/RocketChat/Rocket.Chat.Electron/compare/3.8.1...3.8.2#diff-d462b051b8a3b379afd1a698c397be39e1caa758c8e0a23632540d9ac1d03b93L15)


auto-gptq is required for using the gptq backend

GPTQ backend does not work on my end. This fixes that. Now it loads. Can't get it to work on a model though. The routine seems to get some config.json from huggingface website that does not exist.
What is this "GPTQ" backend anyway?

Loading backend gptq install ON
Backend loaded successfully
Loading model : models\gptq\ggml-mpt-7b-base.bin
Traceback (most recent call last):
File "Q:\llm\GPT4All\env\Lib\site-packages\huggingface_hub\utils_errors.py", line 259, in hf_raise_for_status
response.raise_for_status()
File "Q:\llm\GPT4All\env\Lib\site-packages\requests\models.py", line 1021, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: Loading backend gptq install ON
Backend loaded successfully
Loading model : models\gptq\ggml-mpt-7b-base.bin
Traceback (most recent call last):
File "Q:\llm\GPT4All\env\Lib\site-packages\huggingface_hub\utils_errors.py", line 259, in hf_raise_for_status
response.raise_for_status()
File "Q:\llm\GPT4All\env\Lib\site-packages\requests\models.py", line 1021, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://huggingface.co/ggml-mpt-7b-base.bin/resolve/main/config.json

thanks for this but the requirements should be placed in the binding folder.
I added this to requirements.txt of the gptq binding.


[Backend] Admin Box Approval Process

Backend issue for https://github.com/ctc-uci/find-your-anchor-frontend/issues/19
Add route to get boxes from database. You can update the tables in the database as you see fit.

/cib jml-admin-dash

Branch 8-jml-admin-dash created!


Added shadow database url to prisma

Summary
In some databases such as https://neon.tech its required to add a Shadow Database URL in Prisma for the migration to work.
This PR adds a DATABASE_SHADOW_URL to the .env.example file and uses it in the prisma schema file

[x] My code follows the code style of this project and passes {style_guide_run_command}.
[ ] My change requires a change to the documentation.
[ ] I have updated the documentation accordingly.
[X] My change has adequate Unit Test coverage.

Thanks @1CAMOU 💯


Highlighting for numbers with types in C++

For example, 1ll, 1l, 1u, 1ull, 1e5 are not highlighted, but they should be.
The same for .1 and 1. (the other part omitted).
And hex numbers with letters: 0x3f, 0x3F.

You can solve this issue by proposing a PR. Just google a new Regular expression that matches any number including HEX and others proposed above. You need to change this regular expression to the one that matches all.
The reason why it doesn't work now is because the old regex doesn't matches for the above mentioned numbers. So changing the new regular expression will solve it. Be cautious anything that matchs this regex will be treated a number literal. So make sure it doesn't matches for any falses.

I tried Google but found nothing useful, so I wrote one:
\b((0[xX][0-9a-fA-F]+|0[xX][0-9a-fA-F][0-9a-fA-F']*[0-9a-fA-F]|[1-9][0-9]*|[1-9][0-9']*[0-9]|0[0-7]*|0[0-7']*[0-7]|0[bB][01]+|0[bB][01][01']*[01])([uU]?[lL]{0,2}|[lL]{0,2}[uU]?)|((([0-9]+|[0-9][0-9']*[0-9])[eE][+-]?([0-9]+|[0-9][0-9']*[0-9])|([0-9]+|[0-9][0-9']*[0-9])\.([eE][+-]?([0-9]+|[0-9][0-9']*[0-9]))?|([0-9]+|[0-9][0-9']*[0-9])?\.([0-9]+|[0-9][0-9']*[0-9])([eE][+-]?([0-9]+|[0-9][0-9']*[0-9]))?|0[xX](([0-9a-fA-F]+|[0-9a-fA-F][0-9a-fA-F']*[0-9a-fA-F])\.?|([0-9a-fA-F]+|[0-9a-fA-F][0-9a-fA-F']*[0-9a-fA-F])?\.([0-9a-fA-F]+|[0-9a-fA-F][0-9a-fA-F']*[0-9a-fA-F]))[pP][+-]?([0-9]+|[0-9][0-9']*[0-9]))[fFlL]?))\b
I think this should cover everything in https://en.cppreference.com/w/cpp/language/integer_literal and https://en.cppreference.com/w/cpp/language/floating_literal.
But there is a problem: Floating-point . and separator ' won't be considered as part of the number due to \b at the begin and the end. Not using \b is a bad idea. How to solve this problem?

digit-sequence: (?:\d+(?:'\d+)*)
exponent: (?:e[+-]?(?:\d+(?:'\d+)*))
hexds: (?:[0-9a-f]+(?:'[0-9a-f]+)*)
hexexp: (?:p[+-]?(?:\d+(?:'\d+)*))

floating:
	1. (?:(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*)))
	2. (?:(?:\d+(?:'\d+)*)\.(?:e[+-]?(?:\d+(?:'\d+)*))?)
	3. (?:(?:\d+(?:'\d+)*)?\.(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*))?)
	4. (?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)\.?(?:p[+-]?(?:\d+(?:'\d+)*)))
	5. (?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)?\.(?:[0-9a-f]+(?:'[0-9a-f]+)*)(?:p[+-]?(?:\d+(?:'\d+)*)))
	suffix: [lf]?

	all: (?:(?:(?:(?:\d+(?:'\d+)*)?\.(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*))?)|(?:(?:\d+(?:'\d+)*)\.(?:e[+-]?(?:\d+(?:'\d+)*))?)|(?:(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*)))|(?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)?\.(?:[0-9a-f]+(?:'[0-9a-f]+)*)(?:p[+-]?(?:\d+(?:'\d+)*)))|(?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)\.?(?:p[+-]?(?:\d+(?:'\d+)*))))[lf]?)

integer:
	1. (?:[1-9]\d*(?:'\d+)*)
	2. (?:0[0-7]*(?:'[0-7]+)*)
	3. (?:0x[0-9a-f]+(?:'[0-9a-f]+)*)
	4. (?:0b[01]+(?:'[01]+)*)
	suffix: (?:u?l{0,2}|l{0,2}u?)

	all: (?:(?:(?:[1-9]\d*(?:'\d+)*)|(?:0[0-7]*(?:'[0-7]+)*)|(?:0x[0-9a-f]+(?:'[0-9a-f]+)*)|(?:0b[01]+(?:'[01]+)*))(?:u?l{0,2}|l{0,2}u?))

all: \b(?i)(?:(?:(?:(?:(?:\d+(?:'\d+)*)?\.(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*))?)|(?:(?:\d+(?:'\d+)*)\.(?:e[+-]?(?:\d+(?:'\d+)*))?)|(?:(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*)))|(?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)?\.(?:[0-9a-f]+(?:'[0-9a-f]+)*)(?:p[+-]?(?:\d+(?:'\d+)*)))|(?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)\.?(?:p[+-]?(?:\d+(?:'\d+)*))))[lf]?)|(?:(?:(?:[1-9]\d*(?:'\d+)*)|(?:0[0-7]*(?:'[0-7]+)*)|(?:0x[0-9a-f]+(?:'[0-9a-f]+)*)|(?:0b[01]+(?:'[01]+)*))(?:u?l{0,2}|l{0,2}u?)))\b

I think this should work, and all problems above are solved.

Yes, You need to use Raw String literals to preserve spaces and newlines. Like this : `R"(..regex here..)";

Use (?<=\b| |^) and (?=\b| |$) instead of \b is a work-around.

I don't have much knowledge of regex but it seems too big of expression! If there is any better solution, @Megaxela should confirm. If there is no other better solution, we should accept this as only solution

The expression is \b(?i)(?:(?:(?:(?:(?:\d+(?:'\d+)*)?\.(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*))?)|(?:(?:\d+(?:'\d+)*)\.(?:e[+-]?(?:\d+(?:'\d+)*))?)|(?:(?:\d+(?:'\d+)*)(?:e[+-]?(?:\d+(?:'\d+)*)))|(?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)?\.(?:[0-9a-f]+(?:'[0-9a-f]+)*)(?:p[+-]?(?:\d+(?:'\d+)*)))|(?:0x(?:[0-9a-f]+(?:'[0-9a-f]+)*)\.?(?:p[+-]?(?:\d+(?:'\d+)*))))[lf]?)|(?:(?:(?:[1-9]\d*(?:'\d+)*)|(?:0[0-7]*(?:'[0-7]+)*)|(?:0x[0-9a-f]+(?:'[0-9a-f]+)*)|(?:0b[01]+(?:'[01]+)*))(?:u?l{0,2}|l{0,2}u?)))\b, others are my drafts.

Isn't there a way to reduce this expression to something shorter?

Isn't there a way to reduce this expression to something shorter?

Ignore C++14 and C++17 will make it much shorter.

Isn't there a way to reduce this expression to something shorter?

Ignore C++14 and C++17 will make it much shorter.

I think we should support C++17 as well regardless of the length of this regex. Let @Megaxela decide if he prefers to put such big regex for C++17 language highlighting.

I guess it's fine to use such big expressions. Due to complex C++ syntax it's pretty hard to write nice looking code for most of expressions.