Hi guys, trying to build my app for the Mac App st...

# compose-desktop

[Anders Carlsen]

Hi guys, trying to build my app for the Mac App store - but I am getting a jpackage error:

productbuild: error: Cannot write product to "/Users/<user>/projects/<projectfolder>/build/compose/binaries/main-release/pkg/app-1.0.0.pkg". (Could not find appropriate signing identity for "3rd Party Mac Developer Application: <name> <teamid>" in keychain at "/Users/<user>/Library/Keychains/login.keychain-db". An installer signing identity (not an application signing identity) is required for signing flat-style products

As I understand it your “3rd Party Mac Developer Application *” certificate is used to sign app files but the installer (pkg) needs to be signed by “”3rd Party Mac Developer Installer *” certificate. I can only define one certificate in build.gradle.kts with signing.identity.set. How do I define the installer certificate to be used for the pkg step?

If I check the intermediate files they seem to be properly signed by the Application certificate.

[Chris Athanas]

I am also attempting to do the same, publish a .pkg to TestFlight.

To answer your immediate problem, you are using the “fully qualified” signing identity, but all you need to use is the Name portion, not the fully qualified name. So, just use your “Name” here instead.

The problem I’m now facing is dealing with libraries. Everything works fine locally. Since there are no instructions on how to upload a .pkg to the AppStore step-by-step for MacOS (that I can find anywhere), I am hacking through it.

I was eventually able to get the .pkg built, signed and uploaded via Transporter and put into Testflight. But when I loaded the App from TestFlight, none of the libraries worked (Ktor, VLCplayer)

I was hacking around trying a bunch of things and got this to work a couple times, but now it’s broken again, but I am unable to reproduce it now… I will continue to work thru my steps to get a reproducible case.

Given there is no documentation on how to actually do this, I’m now wondering if this is even currently possible (ie: to sign and upload a compose-desktop MacOS app to TestFlight and eventually AppStore distribution.)

Has anyone actually accomplished this yet, or am I on the bleeding edge here again?

Here’s the permalink to my current attempt:
https://github.com/realityexpander/CloudCoverUSA2

Have you had any more success?

[Chris Athanas]

Update: I updated to use

compose-plugin = "1.6.10-dev1584"

and I am now able to create the correct signed MacOS App with the proper

minimumSystemVersion = "12.0"

package and upload via Transporter to the AppStore TestFlight.

The App is available in TestFlight, and when I download and install the App, the UI appears and runs fine.

I have some ktor network calls at startup and these are not being fired.

I integrated the VLC player, and when I try to open the player I get the following errors Any hints here? The errors only appear when I attempt to use a VLC player, which is a java library.

It seems like the libraries are not being signed? Is there any suggestions on this?

all my code is at: https://github.com/realityexpander/CloudCoverUSA2

[Chris Athanas]

I checked Console.app and I’m seeing these errors:

Any ideas about whats going wrong?

[Chris Athanas]

I updated the entitlements.plist and uploaded a new .pkg and now my network calls from the ktor-client are working!


But still, any attempt to play a movie with the VLCJ library with “malicious software” warning.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<http://www.apple.com/DTDs/PropertyList-1.0.dtd>">
<plist version="1.0">
<dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.cs.debugger</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
    <key>com.apple.application-identifier</key>
    <string>XXXXXXXXXX.com.realityexpander.cloudcoverusa2</string>
    <key>com.apple.developer.team-identifier</key>
    <string>XXXXXXXXXX</string>
    <!-- Add additional entitlements here, for example for network or hardware access. -->
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
</dict>
</plist>

Is there a special step needed to add the VLCJ library? The Ktor library loaded fine…

[Chris Athanas]

I see that you can load libraries at runtime, but the instructions on this are very incomplete… Is there any examples of loading libraries at runtime from a file? I can’t find anything on this in the docs.

My next step is to start scouring github to see if anyone has solved this problem yet, or I’m out on the bleeding edge on this!

[Anders Carlsen]

you need to sign the native files that I suspect the VLCJ package may extract (the tmp file referenced in the error dialog)
I had a similar problem, I extracted the jnilib files (which in my case where extracted on startup) and put them in a resources/macos folder in my desktop module, then put this in my nativeDistributions block:

appResourcesRootDir.set(project.layout.projectDirectory.dir("resources"))

the tricky part is getting the getting them loaded so they are used, in my example using jni I had to put this at start of main function:

val resources = File(System.getProperty("compose.application.resources.dir"))
System.setProperty("jna.library.path", resources.absolutePath)

don’t know what it is for VLCJ or if support loading deps like this..

I think there is another option to repackage the library jar (or whatever format it is) and pre-sign the files that are extracted at runtime..

[Chris Athanas]

Thanks for the quick feedback!

I’m primarily an Android/Web dev, using compose to make iOS apps and now attempting to create desktop apps. So please forgive my ignorance, as I’m not familiar with some of the techniques you described, specifically:

1. Are the files being extracted to the temporary folder the ones that I need to copy and sign? I temporarily have access to these files as the app is showing the error messages.
2. How do I sign these files? Is there a special tool needed to do this? I only see signing of `.dmg`’s and .pkg ’s, not individual files.
3. Given that works, are you saying I should place these signed files into a resources directory, and then call System.loadLibrary("vlcj") ? Or System.load("/resources/libvlcj.jar")?
4. Do you know of any example projects that are set up to create MacOS apps uploaded to TestFlight? That include java swing libraries?
The VideoPlayer sample that i’m using is coming from the compose-desktop example code, yes the experimental folder!

I’m assuming at this point that this may not be possible yet, or no one has actually tried it, as it’s partially documented and looks like an exercise left for the reader… (“it’s theoretically possible, but no one has done it yet?“)

[Anders Carlsen]

1. Yes, MacOS will not let you use unsigned files, hence the error you see
2. You have to use the macos codesign tool, something like: codesign -s “<your keystore cert name>” -v -f <file>
3. I don’t know, you should probably ask developers of the sdk
4. This repo (not mine) was used for inspiration in relation to solving signing issue: https://github.com/prof18/feed-flow - its an app thats available on the mac app store

[Chris Athanas]

Thanks for the quick reply!

I checked out that feed-flow project, and now I’m seeing loading java libraries requires much deeper gradle scripting skill than I currently have.

It seems that you have to disable the default tasks and configure the entire project, which is beyond my scope of capabilities, as it requires much deeper knowledge of gradle than I have ability to acquire at this moment, as my primary is Android, Web and iOS… Gradle is a total headache of strange error messages and requires deep-fu to get it right.

I don’t see any swing libraries used in his project.

I think I have wait to see if a better example appears, or a way to implement video directly in compose-desktop natively.

I previously had good success using a webview to display video using compose-desktop. It seemed a little heavy-handed to just display a video, which is why I attempted this route to use the swing VideoPlayer library.

It seems like no one has done a tutorial on how to package this library within the desktop application for distribution on MacOS yet, so this shall remain a mystery until a gradle wizard takes on the challenge! I am not that wizard!

[Anders Carlsen]

I am no expert, but I didn’t have to do any gradle magic to make it happen, other than what I already mentioned about adding resource dir to nativeDistributions block (if speaking strictly about the error message shown)
I assume you already configured gradle to sign the app correctly (or else it wouldn’t even upload to Testflight I think..

[Chris Athanas]

Yes, it’s all signed properly. I see the libraries are loading, but the error is related to the libraries are not signed properly, and it’s not clear how to do this with how these libraries work.

In the mean time, I have accidentally discovered…

I recently published the iOS version of my Compose KMP app “Cloud Cover USA 2,” and Apple is now making it also available as a MacOS desktop app! So, the native movie player works just like the iOS App running on a phone or iPad. No need for Java swing libraries or loading JCEF browsers… the standard KMP libraries made for iOS will work fine out of the box.

So this looks like an alternative solution for deploying Compose-desktop apps to the AppStore. Instead of targeting MacOS, you just target iOS, and you will automatically be able to run on Mac desktop.

Hope this helps!