MacOS not being trusted because DLL not being signed

[igalfsg]

Describe the bug

I am trying to deploy my Multiplatform Application (I have it on Linux and Windows Working), but when it comes to MacOS I can't get the code signing to work.
The app does show up in the PC and if I run it without verification signature it works perfectly but when I try to open it with code verification I get the following:

To Reproduce

I am following https://docs.avaloniaui.net/docs/deployment/macOS for the creation of my GitHub Action and I have the following Build Setup (I have added the '--deep' to the code signing commands since I saw online that that could help fix the issue but it doesn't):

    runs-on: macos-latest
    env:
      APP_NAME: ./SSHManWeb/EZCMS.Desktop/bin/Release/EZCMS.app
      Release_Path: ./SSHManWeb/EZCMS.Desktop/bin/Release
      PUBLISH_OUTPUT_DIRECTORY: ./SSHManWeb/EZCMS.Desktop/bin/Release/net8.0/osx-arm64/publish/
      INFO_PLIST: ./SSHManWeb/EZCMS.Desktop/Info.plist
      ICON_FILE: ./SSHManWeb/EZCMS.Desktop/keytos.icns
      ICON_FILENAME: keytos.icns
      ENTITLEMENTS: ./SSHManWeb/EZCMS.Desktop/EZCMSEntitlments.entitlements
      SIGNING_IDENTITY: "my id"
      ZIP_NAME: EZCMS.zip
      BUNDLE_ID: com.keytos.ezcms
    steps:
- name: Build macOS App
        run: |
          dotnet publish ./SSHManWeb/EZCMS.Desktop/EZCMS.Desktop.csproj -r osx-arm64 --configuration Release -p:UseAppHost=true -p:PublishReadyToRun=true -p:Version=${{ github.event.inputs.client_version }} --self-contained true

          if [ -d "${{ env.APP_NAME }}" ]; then
              rm -rf "${{ env.APP_NAME }}"
          fi

          mkdir -p "${{ env.APP_NAME }}/Contents/MacOS"
          mkdir -p "${{ env.APP_NAME }}/Contents/Resources"
          pwd
          cp "${{ env.INFO_PLIST }}" "${{ env.APP_NAME }}/Contents/Info.plist"
          cp "${{ env.ICON_FILE }}" "${{ env.APP_NAME }}/Contents/Resources/${{ env.ICON_FILENAME }}"
          cp -a "${{ env.PUBLISH_OUTPUT_DIRECTORY }}" "${{ env.APP_NAME }}/Contents/MacOS"

      - name: Sign the App
        run: |
          find "${{ env.APP_NAME }}/Contents/MacOS/" -type f | while read -r fname; do
              if [[ -f $fname ]]; then
                  echo "[INFO] Signing $fname"
                  codesign --force --timestamp --options=runtime --entitlements "${{ env.ENTITLEMENTS }}" --deep --sign  "${{ env.SIGNING_IDENTITY }}" "$fname"
              fi
          done
          codesign --force --timestamp --options=runtime --deep  --entitlements "${{ env.ENTITLEMENTS }}" --sign "${{ env.SIGNING_IDENTITY }}" "${{ env.APP_NAME }}" 
          codesign --verify --verbose=4 "${{ env.APP_NAME }}"
      - name: Notarize the App
        env:
          APPLE_ID: myID
          APP_PASSWORD: ${{ secrets.MAC_DEV_PASSWORD }}
        run: |
          ditto -c -k --sequesterRsrc --keepParent "${{ env.APP_NAME }}" "${{ env.ZIP_NAME }}"
          xcrun notarytool  submit  "${{ env.ZIP_NAME }}" --apple-id  "${{ env.APPLE_ID }}" --password "${{ secrets.MAC_DEV_PASSWORD }}" --team-id  HVPRU6Y9WE --wait

      - name: Staple Notarization Ticket
        run: |
          xcrun stapler staple "${{ env.APP_NAME }}"

I did some extra troubleshooting, and codesign --verify --verbose=2 EZCMS.app shows that one of the DLLs is not signed:

codesign --verify --verbose=2 EZCMS.app
EZCMS.app: code object is not signed at all
In subcomponent: /Users/igalflegmann/Downloads/ezcms-macos/EZCMS.app/Contents/MacOS/System.Xml.Linq.dll

I also checked the stapled Notarization and it seems to be fine:

xcrun stapler validate EZCMS.app

Processing: /Users/igalflegmann/Downloads/ezcms-macos/EZCMS.app
The validate action worked!

But then when I run a more in depth check it still gives me an error:

spctl -a -vv EZCMS.app           
EZCMS.app: rejected
source=no usable signature
igalflegmann@Igals-Mac-Studio ezcms-macos % spctl -a -vvv --assess --type execute EZCMS.app

EZCMS.app: rejected
source=no usable signature

I am out of ideas on what else to check to keep troubleshooting, any guidance is appreciated.

Expected behavior

No response

Avalonia version

11.2.0

OS

macOS

Edit Feb/01/2025

I followed @maxkatz6 suggestion of adding the PublishSingleFile and it helped but it was still giving weird signing errors for the icon not being signed etc. I got tired of running GitHub Actions for each change and I ran it on my Mac by running the following script (I basically moved the actions to bash)

echo "[INFO] Building macOS app..."
dotnet publish ./SSHManWeb/EZCMS.Desktop/EZCMS.Desktop.csproj -r osx-arm64 --configuration Release -p:GenerateDocumentationFile=false -p:IncludeNativeLibrariesForSelfExtract=false -p:UseAppHost=true -p:PublishReadyToRun=true -p:PublishSingleFile=true -p:Version=$CLIENT_VERSION --self-contained true

# Create macOS App bundle
echo "[INFO] Creating app bundle..."
if [ -d "$APP_NAME" ]; then
    rm -rf "$APP_NAME"
fi

mkdir -p "$APP_NAME/Contents/MacOS"
mkdir -p "$APP_NAME/Contents/Resources"

cp "$INFO_PLIST" "$APP_NAME/Contents/Info.plist"
cp "$ICON_FILE" "$APP_NAME/Contents/Resources/$ICON_FILENAME"
cp -a "$PUBLISH_OUTPUT_DIRECTORY" "$APP_NAME/Contents/MacOS"

# Sign the app
echo "[INFO] Signing the app..."
find "$APP_NAME/Contents/MacOS/" -type f | while read -r fname; do
    if [[ -f $fname ]]; then
        echo "[INFO] Signing $fname"
        codesign --force --timestamp --options=runtime --entitlements "$ENTITLEMENTS" --deep --sign "$SIGNING_IDENTITY" "$fname"
    fi
done

echo "[INFO] Signing app bundle..."
codesign --force --timestamp --options=runtime --entitlements "$ENTITLEMENTS" --sign "$SIGNING_IDENTITY" "$APP_NAME"
codesign --verify --verbose=4 "$APP_NAME"
codesign --verify --deep --strict --verbose=2 "$APP_NAME"

ditto -c -k --sequesterRsrc --keepParent "$APP_NAME" "$ZIP_NAME"
xcrun notarytool  submit  "$ZIP_NAME" --apple-id  "[email protected]" --password $NotarizePassword --team-id  HVPRU6Y9WE --wait

xcrun stapler staple "$APP_NAME"

spctl -a -vvv --assess --type execute "$APP_NAME"

and it magically works (while the same steps in GitHub Actions doesn't).

[maxkatz6]

It's rather interesting that Apple accepted your app during notarizing, but then codesign --verify still fails. Never saw it.

[maxkatz6]

shows that one of the DLLs is not signed

I don't have an answer why this specific dll is not signed.
But I have another recommendation which is commonly preferred when deploying macOS apps: use PublishSingleFile build parameter (see https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file/overview?tabs=cli).

Normally, developer don't care about publishing a single file, when app is bundled anyway. But in case of MacOS signing and sandboxing (which is optional), single file publish makes whole process much easier. Also allowing to merge x64 and arm64 outputs into one universal.
Note, you should not enable IncludeNativeLibrariesForSelfExtract. Native libraries, dylib files, should not be merged, and they should be signed individually.

[maxkatz6]

Another suspicious moment, --deep parameter is not necessary, when you are signing each file in a loop manually. In fact, it would be a preferred option by Apple.

[igalfsg]

Thanks I added the single file flag and it got me closer (I also did a PR on the documentation so people don't run into the same issue). For some reason I tried running it locally and it works vs when running the deployment in GitHub Actions, I guess I will have to look into it further on why it is failing on GitHub Actions.