title: Signing code for OS X application bundle
body: <p>I am porting a .NET application to OS X using the Mono Framework. The application works fine, and we have everything done except for packaging. I am packaging a standalone Mono build inside the bundle to avoid dependencies, and using this tool for the job: <a href="https://github.com/OutOfOrder/MonoKickstart" rel="nofollow">https://github.com/OutOfOrder/MonoKickstart</a></p>
  
  <p>The bundle structure we are using is like this:</p>
  
  <pre><code>OurApp.app
    \-Contents
        +-Info.plist
        +-MacOS
        |   +-osx   - native libraries for osx
        |   +-mono  - mono config files
        |   \ ...  - the OS X kickstart binaries, the .exe file, C# .dlls
        \-Resources/
            \-icon.icns
  </code></pre>
  
  <p>The bundle runs fine when OS X's Gatekeeper functionality is set off, but when trying to sign it to get it run always, I run into problems...</p>
  
  <pre><code>$ codesign -s "3rd Party Mac Developer Application: Our Certificate" --force --deep --verbose OurApp.app
  OurApp.app: bundle format unrecognized, invalid, or unsuitable
  In subcomponent: OurApp.app/Contents/MacOS/mono/4.0
  </code></pre>
  
  <p>All right, I'll remove the mono directory temporarily just to see if it proceeds then:</p>
  
  <pre><code>$ codesign -s "3rd Party Mac Developer Application: Our Certificate" --force --deep --verbose OurApp.app
  OurApp.app: signed bundle with Mach-O universal (i386) [org.ourcompany.ourapp]
  </code></pre>
  
  <p>Success! Or so do I think, but when I'll try to run the app, it still says it's still blocked by Gatekeeper. And when I run</p>
  
  <pre><code>spctl -a -v OurApp.app
  OurApp.app/: rejected
  </code></pre>
  
  <p>So what gives? It says it signed the bundle, and using the --deep parameter, it should've signed all the libraries and such, if I understood right. What should I do to make this work?</p>
  
  <p>Update:</p>
  
  <p>Tried to sign the files one by one with this. </p>
  
  <pre><code> codesign -s "3rd Party Mac Developer Application: Our Certificate" --force --verbose OurAppExecutable.bin
  </code></pre>
  
  <p>But it refused to do it, because of the "subcomponents" (Even if I'm not using --deep).</p>
  
  <p>I finally got it to sign it by moving everything else but the actual binary file to Resources folder, and then signing the binary file, and then the app bundle.</p>
  
  <p>But yet, it says:</p>
  
  <pre><code>spctl -a -v OurApp.app
  OurApp.app/: rejected
  source=No Matching Rule
  </code></pre>
  
  <p>Any further insights?</p>