MacOS应用公证失败：jpackage打包JRE的版权文件未签名

环境 #

• Java 21.0.4+8-LTS-274
• MacOS Sequoia 15.1.1 (24B91)

打包脚本 #

使用jpackage打包应用：

jpackage \
--dest /Users/alanwhite/git/drumscore/DrumScore/bundles \
--app-version "${APP_VERSION}" \
--copyright 'Copyright (c) 2024 Alan R. White' \
--name 'DrumScoreEditor' \
--vendor 'drumscore.scot' \
--input /Users/alanwhite/git/drumscore/DrumScore/autobuild/target/build \
--main-jar "DrumScoreEditor-${APP_VERSION}.jar" \
--main-class org.whiteware.DrumScoreEditor \
--java-options '--add-opens java.desktop/com.apple.eawt.event=ALL-UNNAMED' \
--file-associations /Users/alanwhite/git/drumscore/DrumScore/autobuild/filetypes.txt \
--resource-dir /Users/alanwhite/git/drumscore/DrumScore/package/macosx \
--mac-package-name 'Drum Score Editor' \
--mac-package-signing-prefix 'org.whiteware.DrumScoreEditor' \
--mac-sign \
--mac-signing-key-user-name 'Alan White (XXXXXXXX)' \
--add-modules java.base,java.desktop,java.datatransfer,java.prefs,java.xml,java.logging

公证失败日志 #

执行xcrun notarytool submit后报错：

{
      "severity": "error",
      "code": null,
      "path": "DrumScoreEditor_macOS_arm64_3.2.1.dmg/DrumScoreEditor.app/Contents/runtime/Contents/MacOS/libjli.dylib",
      "message": "The signature of the binary is invalid.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735",
      "architecture": "arm64"
    }

签名检查结果 #

用codesign检查运行时文件：

codesign -vvv --strict runtime/Contents/MacOS/libjli.dylib
runtime/Contents/MacOS/libjli.dylib: a sealed resource is missing or invalid
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.datatransfer/COPYRIGHT
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.datatransfer/LICENSE
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.desktop/COPYRIGHT
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.desktop/LICENSE
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.logging/COPYRIGHT
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.logging/LICENSE
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.prefs/COPYRIGHT
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.prefs/LICENSE
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.xml/COPYRIGHT
file modified: /Volumes/DrumScoreEditor/DrumScoreEditor.app/Contents/runtime/Contents/Home/legal/java.xml/LICENSE

单独检查这些legal目录下的文件：

codesign -vvv --strict runtime/Contents/Home/legal/java.datatransfer/COPYRIGHT
runtime/Contents/Home/legal/java.datatransfer/COPYRIGHT: code object is not signed at all

问题背景 #

上周打包公证流程完全正常，且未更换JDK版本。手动对这些文件签名不符合苹果公证规范，请问最佳解决方式是什么？是jpackage应该处理这些文件的签名，还是这些文件应由JDK提供商签名？

解决方案 #

1. 调整jpackage签名策略，跳过运行时文件重签名 #

JRE运行时本身已由JDK厂商签名，jpackage默认的全量重签名会破坏原有签名，导致密封资源验证失败。修改打包脚本，指定仅签名应用自身代码：

jpackage \
# 保留原有所有参数...
--mac-sign \
--mac-signing-key-user-name 'Alan White (XXXXXXXX)' \
--mac-signing-executable "codesign --deep --force --sign 'Alan White (XXXXXXXX)' --exclude Contents/runtime"

注意--exclude的路径需匹配应用包内的JRE目录。

2. 用jlink预构建自定义JRE #

通过jlink生成仅包含所需模块的未签名JRE，再由jpackage统一签名，避免原有签名冲突：

jlink \
--module-path $JAVA_HOME/jmods \
--add-modules java.base,java.desktop,java.datatransfer,java.prefs,java.xml,java.logging \
--output custom-jre

在jpackage脚本中指定这个自定义JRE：

jpackage \
# 保留原有所有参数...
--runtime-image /path/to/custom-jre

3. 同步工具版本兼容性 #

MacOS Sequoia更新后可能调整了公证规则，更新Xcode命令行工具确保签名工具与系统兼容：

xcode-select --install

4. 禁止修改JRE目录文件 #

确保打包流程中没有脚本或工具修改JRE目录下的任何文件（包括legal目录的COPYRIGHT/LICENSE），这类文件是JRE签名的一部分，任何修改都会导致签名失效。

内容的提问来源于stack exchange，提问作者Hamish258