MacOS signing binaries inside JARs/archives

[alwaysbemark]

Hey Mike/the Conveyor team!

We are evaluating Conveyor and at the moment, jpackage a Spring Boot app (essentially a JarLauncher and BOOT-INF with the dependencies). Some of our dependencies bundle binaries themselves, for example, JNA: java-native-access/jna#1621 .

We've run into issues with our signing and notarisation flow where, for some reason, Apple started to complain about binaries inside JARs when notarising whereas it never used to before. The errors are similar to what's on the JNA ticket.

Wondering whether Conveyor has a mechanism to deal with this - are binaries/libraries within JARs or archives signed by Conveyor?
On that note and in parallel to the feature that allows notarization using an external script (which we'll have to use) - is there similar functionality for signing as well using an external script or service?

Thank you in advance!

[mikehearn]

Hi!

Yes, Conveyor solves both problems. Please see here:

https://conveyor.hydraulic.dev/15.0/configs/jvm/#native-code

By default it signs native code inside JARs. Alternatively it can extract them and move them to a place on java.library.path which has some advantages, but requires that your code tries loading the library first, before trying to unpack. JNA is configured automatically so you should be able to turn library extraction on and get the benefits.

This feature is also supported when combined with external signing scripts:

https://conveyor.hydraulic.dev/15.0/configs/mac/#appmacsignscriptsbinary

You can try it out for free to make sure it's compatible with your setup. If your app is proprietary, you'll only be asked to subscribe once the update site URL points somewhere other than localhost. So you can experiment with building packages and getting them signed without needing anything other than a download.

[alwaysbemark]

Thanks Mike, will give this a whirl!