Notarize Xamarin MAC application

Roshil

We have an existing MAC application developed using Xamarin.MAC and we are distributing the DMG file for the application to user. when we open the application in catalina OS, it is showing some securtiy exceptions. So we found that we need to notarize the application before distributing it to users.We are code signing the application using "application Developer ID". So before apply the application for notarization ,we tried to add true in the release section of the .cs project. Then application is not running in the Release mode when we make the UseHardenedRuntime key and EnableCodeSigning key to true.
Can any one know why the applicaiton is not running when we set true to both UseHardenedRuntime and EnableCodeSigning key?

Is there any other ways to set UseHardenedRuntime in Xamarin application?

ChrisHamons

I would look into the crash logs for your application for details on why it isn't working.

You can generally find those in the "Console" application in one of the Reports folders.

Graycodder

I too face the same issue I get the crash log like this

Process: Sample [6952]
Path: /Applications/WBidMax.app/Contents/MacOS/WBidMax
Identifier: com.xx.xxxx
Version: 6.49.2.0 (1)
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: XXXXX [6952]
User ID: 501

Date/Time: 2019-10-18 13:02:25.128 +0530
OS Version: Mac OS X 10.15 (19A602)
Report Version: 12
Bridge OS Version: 4.0 (17P572)
Anonymous UUID: 8F80B35C-7FCB-E1B1-1E8B-E514CDB240EF

Sleep/Wake UUID: 47F734ED-3E41-4E29-9A85-85CCF9DECB97

Time Awake Since Boot: 9500 seconds
Time Since Wake: 4100 seconds

System Integrity Protection: enabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY

Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [6952]

JohnConners

What hardened runtime entitlements have you enabled as detailed here?

https://developer.apple.com/documentation/security/hardened_runtime_entitlements

You definitely need com.apple.security.cs.allow-jit for a Xamarin.Mac application. One thing I noticed is that libmono-native.dylib (included in MonoBundle) is signed by Xamarin. If you don't re-sign that with your own cert then you'll need to add com.apple.security.cs.disable-library-validation too.

In addition on my app I've added com.apple.security.cs.allow-dyld-environment-variables which seems to be required when using SQLite. Simplest option is to add all of them to your entitlements and if that works, remove them one at a time to find out the ones you really need.

Note that if you include third party frameworks like Sparkle, you'll need to re-sign them with --options runtime yourself, but when you submit it to Apple's notarization service you'll be told if you need to do that should it fail.