MacOS - App is signed, but getting "The application "App.app" can't be opened"

[Mehdi-Hp]

Describe the bug

I'm building for MacOS aarch64, everything seems to work fine. You can see the last lines of build command's log below, which seems to be successful. But when I try to run the app, I get the following alert error:

• If I run codesign --force --deep --sign H1ZJCH8WC4 /Applications/App.app, Then it works and I can open the App!
• It was already working, like yesterday. It just got to this state and can't figure out what's wrong.
• I made a new project with pnpm create tauri-app --beta and couldn't reproduce my problem. Then, I replaced my files into the new project, And same problem.

I wonder If there's any other way to debug this beside moving my files into a brand new project one-by-one and hit build over and over.

Update: Got one step further. It works if I remove "entitlements": "info.plist" from bundle.macOS. Here's the content of info.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
	<dict>
		<key>CFBundleDocumentTypes</key>
		<array>
			<dict>
				<key>CFBundleTypeExtensions</key>
				<array>
					<string>myapp</string>
				</array>
				<key>CFBundleTypeIconFile</key>
				<string>icons/document.icns</string>
				<key>CFBundleTypeName</key>
				<string>App Custom File</string>
				<key>CFBundleTypeRole</key>
				<string>Viewer</string>
				<key>LSHandlerRank</key>
				<string>Owner</string>
				<key>LSTypeIsPackage</key>
				<string>YES</string>
			</dict>
		</array>
	</dict>
</plist>

Full tauri info output

[✔] Environment
    - OS: Mac OS 14.4.1 X64
    ✔ Xcode Command Line Tools: installed
    ✔ rustc: 1.78.0 (9b00956e5 2024-04-29) (Homebrew)
    ✔ cargo: 1.78.0
    ✔ rustup: 1.27.1 (54dd3d00f 2024-04-24)
    ✔ Rust toolchain: stable-aarch64-apple-darwin (overridden by '/.../rust-toolchain.toml')
    - node: 22.1.0
    - pnpm: 9.1.0
    - npm: 10.7.0

[-] Packages
    - tauri [RUST]: 2.0.0-beta.17
    - tauri-build [RUST]: 2.0.0-beta.14
    - wry [RUST]: 0.39.3
    - tao [RUST]: 0.27.0
    - tauri-cli [RUST]: 2.0.0-beta.11
    - @tauri-apps/api : not installed!
    - @tauri-apps/cli [NPM]: 2.0.0-beta.11

[-] App
    - build-type: bundle
    - CSP: unset
    - frontendDist: ../skin/dist
    - devUrl: http://localhost:1420/
    - framework: Vue.js
    - bundler: Vite

Stack trace

Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/probe2.ll
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/probe3.ll
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/probe7.ll
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/stderr
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/output
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/root-output
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/invoked.timestamp
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app/Contents/MacOS/App
    Info using entitlements file at info.plist
    Signing /Users/.../target/release/bundle/macos/App.app
    Info using entitlements file at info.plist
    Warn skipping app notarization, no APPLE_ID & APPLE_PASSWORD & APPLE_TEAM_ID or APPLE_API_KEY & APPLE_API_ISSUER & APPLE_API_KEY_PATH environment variables found
    Bundling App_0.0.2_aarch64.dmg (/Users/.../target/release/bundle/dmg/App_0.0.2_aarch64.dmg)
    Running bundle_dmg.sh
    Signing with identity "Apple Development: Created via API (H1ZJCH8WC4)"
    Info Signing app bundle...
    Signing /Users/.../target/release/bundle/dmg/App_0.0.2_aarch64.dmg
    Info using entitlements file at info.plist
    Bundling /Users/.../target/release/bundle/macos/App.app.tar.gz (/Users/.../target/release/bundle/macos/App.app.tar.gz)
    Cleaning /Users/.../target/release/bundle/macos/App.app
    Finished 1 bundle at:
        /Users/.../target/release/bundle/dmg/App_0.0.2_aarch64.dmg
        /Users/.../target/release/bundle/macos/App.app.tar.gz (updater)

Password:
Deriving a key from the password and decrypting the secret key... done
    Finished 1 updater signature at:
        /Users/.../target/release/bundle/macos/App.app.tar.gz.sig

[Mehdi-Hp]

Fixed when I removed "entitlements": "info.plist" from bundle.macOS. Tauri is still including info.plist automatically. Though, this is still a bug. I'm not sure if I should close this issue.

[ollyde]

Also facing this issue, but we can't remove entitlements as we have somethings we need there in both files.

[Mehdi-Hp]

@ollyde The default value of entitlements is indeed info.plist. I'm not sure what the underlying bug is, but I've removed it in tauri config, and it's still using my entitlements file.

[FabianLars]

Info.plist is not an entitlements file, but more like a list of general app info, so it's pretty much expected that using it as an entitlements file will cause problems. The main problem is basically related to what you wrote yourself:

If I run codesign --force --deep --sign H1ZJCH8WC4 /Applications/App.app, Then it works and I can open the App!

Tauri's cli will automatically include entitlements here, so if you specify Info.plist as one, it will run

codesign --entitlements Info.plist --force --deep --sign H1ZJCH8WC4 /Applications/App.app

and codesign seems to not properly validate the entitlements files here and just mindlessly applies them.

So, OP's issue is wontfix though i guess we should document this somewhere - i think we never mention the Info.plist file anywhere right now...

For @ollyde: Can you share the error logs and the contents of the relevant files?

[jafioti]

@FabianLars I'm facing this same problem too, it seems like if I don't include the explicit "entitlements": "info.plist" in the tauri conf, it builds, signs and notarizes without the key line "Info using entitlements file at info.plist", which builds, installs, and opens, but since the permissions weren't included, we cannot access the microphone.

Here's the info.plist file we use:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>NSMicrophoneUsageDescription</key>
	<string>Request microphone access for voice input</string>
</dict>
</plist>

When I do include the "entitlements": "info.plist" line, it does print "Info using entitlements file at info.plist" at signing time, but when I go to open the app once installed, I get the "The application can't be opend" error.

What is the recommended way to request microphone permissions? Is it even a plist file or another way?

btw I'm using tauri v2.0.0-beta.16

[FabianLars]

Try renaming the file to Info.plist (uppercase i ) and do not add info.plist to the entitlements config (because like mentioned above, info.plist is not an entitlements file). This should work == This is what worked for everyone else so far - If it doesn't work for you i think the problem may be something else.

[jafioti]

@FabianLars Thanks for the response. I did that and it builds, but I never get the permission pop up and can't access the microphone. I've removed the notarization from the process, and it still fails, so I suspect the issue is with the signing. When it signs, I don't see the printout for using the plist file. Is there supposed to be a log print for it if it uses Info.plist?

[FabianLars]

Is there supposed to be a log print for it if it uses Info.plist?

No, but if you navigate into the .app dir it should be copied into it.

[jafioti]

@FabianLars Yes I see the correct microphone key copied into the .app directory Info.plist. However when I go to record audio it doesn't request to use the microphone. Is there a correct way to request to access the microphone, or different resources?

For example, this is what we do to record:

let device = cpal::default_host()
    .devices()
    .unwrap()
    .find(|d| d.name().unwrap() == "MacBook Pro Microphone")
    .unwrap();
let config = device.default_input_config().unwrap();
let sample_rate = config.sample_rate().0;
let channels = config.channels();

let clip = Arc::new(Mutex::new(Some(vec![])));
let clip_2 = clip.clone();

let stream = device
    .build_input_stream(
        &config.into(),
        move |data, _| write_input_data(data, &clip_2),
        move |err| eprintln!("an error occurred on stream: {err}"),
        None,
    )
    .unwrap();

stream.play().unwrap();

[jafioti]

I'm not sure if it's possible / recommended to get audio from rust, or if it needs to be done on the frontend side. I'm seeing a lot of people doing it on frontend with no people doing it on backend.

[jafioti]

Ok I worked out the issue. The solution was found here: https://github.com/tauri-apps/tauri/issues/8314#issuecomment-1829864033

You basically need a seperate entitlements file with the following:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.device.microphone</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
  </dict>
</plist>

and need to reference that file in your tauri conf