title: Code sign Java app for OS X Gatekeeper
body: <p>I am trying to distribute a Java application to OS X users. I am not using the Mac store - it is to be distributed through my own website. Whatever I try, OS X's Gatekeeper rejects the app.</p>
  
  <p>Here's my method:</p>
  
  <p>(1) Build the app as usual, get a JAR file</p>
  
  <p>(2) Use <code>appbundler</code> as described here: <a href="https://docs.oracle.com/javase/7/docs/technotes/guides/jweb/packagingAppsForMac.html" rel="noreferrer">https://docs.oracle.com/javase/7/docs/technotes/guides/jweb/packagingAppsForMac.html</a>. This creates a .app around my JAR which runs nicely, and contains the JVM in the <code>MyApp.app/Contents/PlugIns</code> directory.</p>
  
  <p>(3) Sign the app with my Developer certificate:</p>
  
  <p><code>codesign -s 'Developer ID Application: MyCompany Ltd' --deep MyApp.app</code></p>
  
  <p>...process completes successfully</p>
  
  <p>(4) Verify that the .app will adhere to Gatekeeper's iron-fist laws:</p>
  
  <p><code>spctl --assess --verbose=4 --type execute MyApp.app</code></p>
  
  <p>...and the result I get back is:</p>
  
  <pre><code>MyApp.app: a sealed resource is missing or invalid
  </code></pre>
  
  <p>Doesn't seem very verbose to me! What could I be doing wrong? Or how can I get more information?</p>
  
  <p>SO/Google searches around 'a sealed resource...' refer to signing frameworks (which I don't have) or suggest signing with the <code>--force</code> option (which I tried but doesn't work).</p>