OSX应用崩溃：代码签名无效，跨系统版本运行异常求助

This is a common compatibility hiccup with older OS X releases like 10.10, which has stricter or slightly different code signing validation rules compared to newer versions. Let’s break down the likely causes and actionable fixes:

Possible Root Causes #

• OS X 10.10 is far more sensitive to signature integrity breaches—if you modified binary paths after signing, it’ll flag the signature as invalid immediately (10.11+ is more lenient here).
• Newer signing algorithms (like SHA-256 only) aren’t fully supported on 10.10; you need backward-compatible hashing to pass validation.
• Incorrect @loader_path resolution or non-standard app bundle structure that 10.10’s validation rejects.
• Your Lazarus/FPC-compiled app might target an SDK version too high for 10.10, leading to hidden compatibility issues that trigger signature errors.

Step-by-Step Fixes #

1. Fix Your Signing Order (Critical!) #

Always adjust dependency paths before signing. Any changes to binaries after signing will break the signature hash, and 10.10’s validation catches this way more aggressively than 10.11+:

• First use install_name_tool to update all library paths.
• Then sign the C++ library, followed by the main app.

2. Use Backward-Compatible Signing Algorithms #

OS X 10.10 requires both SHA-1 and SHA-256 hashes for valid signatures. Explicitly specify both when signing your library and app:

# Sign the C++ library first
codesign -s "Developer ID Application: Your Full Name" --timestamp --digest-algorithm=sha1,sha256 /path/to/your-library.dylib

# Then sign the app (or sign embedded frameworks first, then the main app)
codesign -s "Developer ID Application: Your Full Name" --timestamp --digest-algorithm=sha1,sha256 YourApp.app

3. Validate @loader_path and Bundle Structure #

Ensure your library lives in the standard Contents/Frameworks directory of your app bundle, and the @loader_path reference is correct:

• For an app binary at YourApp.app/Contents/MacOS/YourApp, the path to a library in Frameworks should be @loader_path/../Frameworks/your-library.dylib.
• Double-check the modified path with otool -L YourApp.app/Contents/MacOS/YourApp to confirm it’s set correctly.

4. Get Detailed Error Messages on 10.10 #

On the problematic 10.10 system, run these commands to pinpoint exactly what’s wrong:

# Check basic signature validity
codesign -vvv --deep YourApp.app

# Check Gatekeeper validation (this mimics the system's launch checks)
spctl -a -t exec -vv YourApp.app

These will tell you if the invalid signature is from the app binary, the C++ library, or a path resolution issue.

5. Adjust Lazarus/FPC Compilation Settings #

Make sure your app is compiled for 10.10 compatibility:

• In Lazarus, go to Project > Project Options > Compiler Options > Config and Target.
• Set the Target OS version to 10.10 or lower, and ensure the SDK path points to a version that supports 10.10.

6. Avoid --deep (If Possible) #

While --deep is convenient, it’s safer to sign dependencies individually first, then the main app. This ensures each component’s signature is valid:

# Sign the library inside the app bundle
codesign -s "Developer ID Application: Your Full Name" --timestamp --digest-algorithm=sha1,sha256 YourApp.app/Contents/Frameworks/your-library.dylib

# Sign the main app
codesign -s "Developer ID Application: Your Full Name" --timestamp --digest-algorithm=sha1,sha256 YourApp.app

Final Notes #

• Always include the --timestamp flag when signing—it ensures your signature stays valid even after your Developer ID certificate expires, which is crucial for older OS versions.
• Never modify any binary files (app or libraries) after signing—this breaks the signature hash instantly.

内容的提问来源于stack exchange，提问作者simonescu