macOS Catalina 10.15. Any solution?

diego2rodrigues

I am unable to use the software on macOS Catalina 10.15. Any solution?

joshtynjala

the software

Which software are you referring to? What happens when you try to use it? Do you see an error message?

Shantanu007

I have upgraded to Catalina just now and Adobe air has stopped working. I downloaded Adobe air for Mac from adobe's site.

Other people are also experiencing this problem.

https://community.adobe.com/t5/Air/Adobe-Air-error-message-macOSX-Catalina/td-p/10683302

Edit: even the Adobe air uninstaller and Adobe air updater (two apps that get installed with Adobe air) shows this problem

hugo

I also have an AIR desktop App and only knew issues today when I read your post and this would happen soon or latter.
On my case it's embedded runtime, so I would say that this is an isolated issue with AIR.
Since Adobe is not maintaining AIR anymore and Harman is focus on Android for at least, let's say, one year, your options are very clear:

Move to embedded runtime (your best opition on my opinion);
Harman release the fix and you will have to start paying;
Change technology (I doubtful that you choose this one, for obvious reasons).

joshtynjala

Have you tried building your AIR app with captive runtime?

It may work better in Catalina than the shared runtime does.

Shantanu007

joshtynjala I am downloading Apache flex sdk for vscode as3mxml. But that thing requires Adobe air to install. I don't know why they made it in Adobe air moreover it needs Adobe flash browser because someone decided that download button on their website must be made in swf.

hugo

As I mention.
I use captive runtime for many, many years with users from Windows XP to 10 (both 32 and 64 bits) and several versions of macOS (including now Catalina).
No issues at all on my side.

Using captive runtime it's an isolated desktop app.

HaimSh

I think harman released 64bit build tools.

joshtynjala

If you follow these instructions, you can install the Apache Flex SDK without using the AIR installer app:

https://feathersui.com/learn/as3-starling/sdk/build-binary-distribution.html

(The instructions are for the Feathers SDK, but they work for the Flex SDK too)

You can get a "binary distribution" of the Flex SDK from here:

http://flex.apache.org/download-binaries.html

wak932

if anyone is still struggling with Catalina and Air, it'll no doubt be because of the new requirement to notarise the app.
This is dead useful and got me through it...
https://www.molleindustria.org/blog/notarizing-your-flashair-applications-for-macos/

hugo

Great stuff.
A few lines that I copy - laugh - past:
"obsolete as soon as Apple comes up with some new bullshit.
not just the command line tools but the whole 10GB of stuff.
This requires an elaborate mating ritual between
workaround for a security restriction that Apple itself created
the 10GB of mysterious stuff you downloaded.
As a punishment for not developing your software using handsome Xcode
You fucked up, you underestimated the blob
If you don’t get any message, don’t worry, the Terminal is a “tough love” kind of guy and it will not congratulate you for doing things right
Like a bad partner, Apple won’t directly tell you what you did wrong. To find out, you have to go back to the terminal
have fun interpreting the machine generated log
You still have to staple the app, whatever that means"

wak932

I know right? - I wish all guides were written with that world-weary dev flavour. It so perfectly reflects my own experiences...

Something I would add as well.. if you are using plugins like @tuarua 's webview (got to be the same guy - right?)
You'll need an entitlements list more like this..

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>com.apple.security.cs.allow-jit</key>
   <true/>
   <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
   <true/>
   <key>com.apple.security.device.audio-input</key>
   <true/>
   <key>com.apple.security.cs.disable-executable-page-protection</key>
   <true/>
   <key>com.apple.security.cs.disable-library-validation</key>
   <true/>
   <key>com.apple.security.cs.allow-dyld-environment-variables</key>
   <true/>
</dict>
</plist>

But remember kids... you can't just make that as a textfile - you have to do it in xcode (it adds some checksum or sumtink to the file).
(My app also uses microphone - hence that in the permissions too)

tuarua

wak932 Something I would add as well.. if you are using plugins like @tuarua 's webview (got to be the same guy - right?)
You'll need an entitlements list more like this..

I don't believe that's a fair assertion.
I've successfully notarised a macOS app containing the WebView and I have the following:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.app-sandbox</key>
	<true/>
	<key>com.apple.security.network.client</key>
	<true/>
	<key>com.apple.security.network.server</key>
	<true/>
	<key>com.apple.security.files.user-selected.read-write</key>
	<true/>
	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
	<true/>
</dict>
</plist>

com.apple.security.cs.allow-unsigned-executable-memory is required by AIR and not the ANE.
The rest are standard, it's a WebView so it needs network access outside the Sandbox (a macOS app with a WebView built with Xcode requires the same)

Eg why are you using this?

com.apple.security.cs.allow-dyld-environment-variables
A Boolean value that indicates whether the app may be affected by dynamic linker environment variables, which you can use to inject code into your app’s process.

If you are using the below it suggests you are not signing all the contents in the app, ie including extensions

com.apple.security.cs.disable-library-validation
A Boolean value that indicates whether the app may load arbitrary plug-ins or frameworks, without requiring code signing.

I am finishing off a bash script which will automate converting a captive AIR app into a notarised pkg including any extensions.
So I will include that in the repo at some point.

zwetan

wak932 But remember kids... you can't just make that as a textfile - you have to do it in xcode (it adds some checksum or sumtink to the file).

plutil

plutil: [command_option] [other_options] file...
The file '-' means stdin
Command options are (-lint is the default):
 -help                         show this message and exit
 -lint                         check the property list files for syntax errors
 -convert fmt                  rewrite property list files in format
                               fmt is one of: xml1 binary1 json
 -insert keypath -type value   insert a value into the property list before writing it out
                               keypath is a key-value coding key path, with one extension:
                               a numerical path component applied to an array will act on the object at that index in the array
                               or insert it into the array if the numerical path component is the last one in the key path
                               type is one of: bool, integer, float, date, string, data, xml, json
                               -bool: YES if passed "YES" or "true", otherwise NO
                               -integer: any valid 64 bit integer
                               -float: any valid 64 bit float
                               -string: UTF8 encoded string
                               -date: a date in XML property list format, not supported if outputting JSON
                               -data: a base-64 encoded string
                               -xml: an XML property list, useful for inserting compound values
                               -json: a JSON fragment, useful for inserting compound values
                               value YES, NO, a number, a date, or a base-64 encoded blob of data
 -replace keypath -type value  same as -insert, but it will overwrite an existing value
 -remove keypath               removes the value at 'keypath' from the property list before writing it out
 -extract keypath fmt          outputs the value at 'keypath' in the property list as a new plist of type 'fmt'
                               fmt is one of: xml1 binary1 json
 -p                            print property list in a human-readable fashion
                               (not for machine parsing! this 'format' is not stable)
There are some additional optional arguments that apply to the -convert, -insert, -remove, -replace, and -extract verbs:
 -s                            be silent on success
 -o path                       specify alternate file path name for result;
                               the -o option is used with -convert, and is only
                               useful with one file argument (last file overwrites);
                               the path '-' means stdout
 -e extension                  specify alternate extension for converted files
 -r                            if writing JSON, output in human-readable form
 --                            specifies that all further arguments are file names

see How to Convert plist Files to XML or Binary in Mac OS X for basic usage

eg.
plutil -convert xml1 ExampleBinary.plist
and
plutil -convert binary1 Example.plist

wak932

tuarua Hi, nice to get some more detail, thanks. Those permissions are particular to my app but it was unclear to me which ones were needed to make it work because of the webview and what was due to other aspects. Just wanted to flag to folks that the permissions were a big issue.

I, of course, have now hit the wall of the binaries not being signed (as you've point out "--deep" doesn't mean what I think it means)

think I should be able muddle through with the stuff you've posted for psyone, just wanted to say thanks!

psyone

Hi!

I can't notarize my app because I got this:

{
  "logFormatVersion": 1,
  "jobId": "82527696-eb4a-4a54-9abf-facd715ced40",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "player.app.zip",
  "uploadDate": "2020-02-07T11:11:44Z",
  "sha256": "c5f9aeaa542a13e308cfbe11366b2827bc112ce7052ad6149489a537c395aaed",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "player.app.zip/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/WebKit.dylib",
      "message": "The binary is not signed.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "player.app.zip/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/WebKit.dylib",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "player.app.zip/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/A2712Enabler",
      "message": "The binary is not signed.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "player.app.zip/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/A2712Enabler",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "player.app.zip/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/A2712Enabler",
      "message": "The executable does not have the hardened runtime enabled.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "player.app.zip/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Flash Player.plugin/Contents/MacOS/FlashPlayer-10.6",
      "message": "The binary is not signed.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "player.app.zip/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Flash Player.plugin/Contents/MacOS/FlashPlayer-10.6",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    }
  ]
}

here is my entitlements.plist file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.cs.allow-jit</key>
	<true/>
	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
	<true/>
</dict>
</plist>

used this tutorial:

https://www.molleindustria.org/blog/notarizing-your-flashair-applications-for-macos/

I'm really appriciate if somebody can help me, because I'm lost.
I think use the right Developer ID Application:

signing.command:

#!/bin/bash
pushd `dirname $0`

PS3='Please enter which application want to sign: '
options=("editor" "editor-demo" "player" "manager")
select opt in "${options[@]}"
do
    case $opt in
        "editor")
            echo "$opt"
		break
            ;;
        "editor-demo")
            echo "$opt"
		break
            ;;
        "player")
            echo "$opt"
		break
            ;;
        "manager")
            echo "$opt"
		break
            ;;
        *) echo "invalid option $REPLY";;
    esac
done
xattr -cr '../bin/'$opt'.app'
echo "signing $opt"
codesign --force --options runtime --deep --sign 'Developer ID Application: Varadi Gabor (XXXXXXXXXX)' --entitlements 'entitlements.plist' '../bin/'$opt'.app'
echo "verifying $opt"
codesign --verify --verbose=4 ../bin/$opt'.app'

popd

notarizing.command:


#!/bin/bash
pushd $(dirname $0)

PS3='Please enter which application want to notarize: '
options=("editor" "editor-demo" "player" "manager")
select opt in "${options[@]}"; do
    case $opt in
    "editor")
        echo "$opt"
        package="hu.devinflow.dynamic.dungeons.editor"
        break
        ;;
    "editor-demo")
        echo "$opt"
        package="hu.devinflow.dynamic.dungeons.editor.demo"
        break
        ;;
    "player")
        echo "$opt"
        package="hu.devinflow.dynamic.dungeons.player"
        break
        ;;
    "manager")
        package="hu.devinflow.dynamic.dungeons.manager"
        echo "$opt"
        break
        ;;
    *) echo "invalid option $REPLY" ;;
    esac
done
echo "compress $package"
ditto -ck --rsrc --sequesterRsrc "../bin/$opt.app" "../bin/$opt.app.zip"
echo "notarizing $package"
xcrun altool -t osx -f '../bin/'$opt'.app.zip' --primary-bundle-id $package --notarize-app --username varadi83gabor@gmail.com -itc_provider "VaradiGaborXXXXXXXXXX"
popd

verify_notarization.command:

#!/bin/bash
read -p "Enter id for more information: "  id
xcrun altool --notarization-info $id -u varadi83gabor@gmail.com

joshtynjala

Here's the codesign command that I use for one of my AIR apps that has successfully passed notarization.

codesign -f -v -s "Developer ID Application: blah blah" --deep MyApp.app

My app is different because it doesn't need any entitlements, but the errors you are getting don't seem to be related to entitlements.

To check that everything is signed correctly, I run the following command:

spctl --assess --verbose --type execute MyApp.app

joshtynjala

Check out this explanation on StackOverflow about using ditto to zip an iOS app for submission. I wonder if you should tweak your command to do the same thing with the --keepParent option for your macOS app?

https://stackoverflow.com/a/2473201/10768

psyone

I modified the signing.sh:

#!/bin/bash
pushd `dirname $0`

PS3='Please enter which application want to sign: '
options=("editor" "editor-demo" "player" "manager")
select opt in "${options[@]}"
do
    case $opt in
        "editor")
            echo "$opt"
		break
            ;;
        "editor-demo")
            echo "$opt"
		break
            ;;
        "player")
            echo "$opt"
		break
            ;;
        "manager")
            echo "$opt"
		break
            ;;
        *) echo "invalid option $REPLY";;
    esac
done
xattr -cr '../bin/'$opt'.app'
echo "signing $opt"
codesign -f -v -s "Developer ID Application: XXXXXXXXXX" --deep "../bin/"$opt".app"
echo "verifying $opt"
spctl --assess --verbose --type execute "../bin/"$opt".app"

popd

and here is the output:


1) editor
2) editor-demo
3) player //this is selected
4) manager
Please enter which application want to sign: 3
player
signing player
../bin/player.app: replacing existing signature
../bin/player.app: signed app bundle with Mach-O thin (x86_64) [hu.devinflow.dynamic.dungeons.player]
verifying player
../bin/player.app: rejected
source=Unnotarized Developer ID

I think it is not a the expected result because:

../bin/player.app: rejected
source=Unnotarized Developer ID

psyone

When I compile the captive runtime app, I use temporary self-signed certificate.
I know good it is the way how I need to compile my app, and after sign with the Developer ID Application?