Sierra: Are Zips Still Possible?

Currently, when I download my code signed app on Sierra it crashes on load because it can’t find the XojoFramework.

Dyld Error Message: Library not loaded: @executable_path/../Frameworks/XojoFramework.framework/Versions/A/XojoFramework Referenced from: /Volumes/VOLUME/*/OfficeTime.app/Contents/MacOS/OfficeTime Reason: image not found

I assume this is because downloaded zips launched from the download folder are given a random path an Xojo uses absolute paths somewhere.

Must I switch to DMGs?

As you see Xojo uses relative path with @executable_path inside.

[quote=285817:@Stephen Dodd]Currently, when I download my code signed app on Sierra it crashes on load because it can’t find the XojoFramework.

Dyld Error Message: Library not loaded: @executable_path/../Frameworks/XojoFramework.framework/Versions/A/XojoFramework Referenced from: /Volumes/VOLUME/*/OfficeTime.app/Contents/MacOS/OfficeTime Reason: image not found

I assume this is because downloaded zips launched from the download folder are given a random path an Xojo uses absolute paths somewhere.

Must I switch to DMGs?[/quote]
Considering the “referenced from” path is not the downloads folder, I’d suggest moving your app to the desktop or Applications folder.

You may also want to consider a signed zip though. Apple’s using that with a .xip extension.

No!
macOS Sierra only extracts .xip’s which are signed by Apple.
If you’re going to sign a .xip with your Developer ID, it won’t be extracted on macOS Sierra.

Applications created by the Xojo compiler reference the Xojo framework via a relative path. App path randomization works on the scope of the entire application, which should include the framework. Could you send me one of the zip files you’re testing with?

Go to www.officetime.net and click download on Sierra. If you open it from the Downloads folder, it barfs

Sadly DMG & Apple Installer are the safest way for Sierra. I have no idea why Apple decided that XIP will only be accepted if it’s signed by Apple.

No, not necessarily… but if you’d like to give it a try - maybe this helps: Xojo Post Build Script Example 4u: CodeSign and DMG creation

There’s at least one undisclosed security issue with XIPs. I can’t find an archive link to this, but it was in an email from Apple employee Garth Cummings on the apple-cdsa mailing list:

Well, if I can’t use Zip because it won’t launch and I can’t use .xip, then I would assume DMGs to be the only remaining option. (Other than, ack, installers)

And if you’re moving it to the Desktop (or Applications) folder after extracting?

The “pain” Apple is creating in macOS Sierra is that an .app extracted from a downloaded .zip has to be (manually) moved (in order not to get translocated). So a .zip still works - but :slight_smile:

Yeah. But asking a user to move to the application folder before double clicking is about as effective as asking your cat to fetch. :wink:

If your DMG offers a hint to the user as to what they’re supposed to do (like the Xojo DMG and so many others do) I suspect you’ll have much more success.

We use DMGCanvas because they have a fairly good command-line utility with it… and they just added signing for Sierra, so it has become a no-brainer.

Yeah. Hinted DMGs will work. Asking a user to move a zip won’t.

This is now my new DMG look

What is supposed not to work on Sierra with the currently available version of OfficeTime?

OMG the app wants to show me daily tips. Haven seen those on the Mac for a long long time. Other than that the app starts fine - even from the downloads folder.

Why is o.m.g censored? This is silly.

DMG has become a de facto standard. I now distribute my apps direct on signed DMG and they work quite reliably under Sierra.

The only regret is that Apple did not come up with some sort of autoplay akin to what exists for DVDs.

Isn’t Safari doing that automatically (by default) when one download DMG, zip, rar, etc. files ?

That’s the first option I turn off on Safari: ( ) Open “safe” files after downloading

But yes, by default it’s turned on.

Then it may depend if the DMG is “internet-enabled” or not.

hdiutil internet-enable -yes /path/to/your/image.dmg

See also this Thread on StackOverflow.
Or read the hdiutil man page.

So if you’re looking for a replacement of .zip (just put the .app in a .dmg, without creating fancy backgrounds, alias to /Applications and some info about copying the .app), then an internet-enabled .dmg may work well.

DMG Canvas is also supported from within App Wrapper, so with one click it can do it’s business and then output a signed DMG file.