Codesign: What are unsealed contents?

Question

I have just upgraded to XCode 6 and tried to build my Developer ID signed Mac app. However, I now get the following codesign error:

unsealed contents present         


        

Answer 1

I have hit this twice now, so I am adding the causes, since codesign is very opaque and generally refuses to tell you what the problematic resource is.

On one occasion, I had an unsigned binary executable. Each executable and framework needs to be individually signed before singing the bundle as a whole.

Then I hit another case. I sign my code as part of the publish process, re-signing each executable and framework. But Xcode also signs the bundle as well, and it turns out that was leaving cruft behind in _CodeSignature folders. So now, before signing each of the executables and frameworks and then the bundle, I pre-remove Xcode's generated _CodeSignature folders with something like:

find MyApp.app -name _CodeSignature -type d -exec rm -rf {} +

Hopefully this hard-won information will save someone some time one day.