Hi,

I am including Sparkle Framework in my app.During signing of the app using V2 signature, I need to sign the Sparkle Framework as well. I am using the following command to sign Sparkle Framework.
codesign --verbose --force --sign "Developer ID Application: Company Name" AppName.app/Contents/Frameworks/Sparkle.framework/Versions/A

When I verify the signature, it looks fine and valid. However, when I download the app from a web server and double click on the first time, I am getting an "Unidentified Developer" Message on Mac 10.9.5. On checking the code sign details, I see the error:
"bundle format is ambiguous (could be app or framework) In Subcomponent: <Path to Sparkle.Framework"

On previous versions of Mac OS, it is mostly fine though the error has appeared in a couple of instances.

Has anybody else faced this problem? Please let me know what all I need to sign for Sparkle framework to get rid of this error.

Thanks
Vikas

For me the issue was related to the folder structure of Sparkle.framework inside of my app and that there are only two things allowed at the root of a framework folder (which is a new requirement from apple):

• Versions directory
• symlinks (i.e. to stuff in your Versions directory)

As part of my build process the Sparkle framework was copied but the symlinks were not maintained, they we expanded so that the former symlinks where now actual copies of the folders/files.

So I would suggest looking in your app's frameworks folder and then in Sparkle.framework and make sure everything is symlinked properly. Here is how it looks for me:

Headers -> Versions/A/Headers
Resources -> Versions/A/Resources
Sparkle -> Versions/A/Sparkle

Current -> A

Yes, you must sign on 10.9 to create V2 signatures.

Thanks for the replies.
I verified that after Build, the app has the symlinks maintained but after uploading to a web server and downloading, the symlinks became actual copies. However, in machines older than 10.9.5, the code sign is still valid but 10.9.5 and above is complaining.

I am signing from 10.9 itself, so there is no problem there.

I will have to figure out how to maintain the same structure with symlinks after downloading as our app Installer is a simple drag-drop installer.

I use DropDMG (http://c-command.com/dropdmg/) to create a nice installer (it also compresses the files like a zip would). It has a GUI or you can enable the command line tools so that you can integrate it into a build script.

Thanks. Will try it out.

I'm having the same problem, Sparkle being signed on 10.10 with the same symlinks and it's complaining when downloaded from the web.

Replacing A with Current in my signing script solved the problem for me.

LOCATION="${BUILT_PRODUCTS_DIR}"/"${FRAMEWORKS_FOLDER_PATH}"
IDENTITY="My ID" codesign --verbose --force --sign "$IDENTITY" "$LOCATION/Sparkle.framework/Versions/Current"

Switching to ditto fixed this for me:

$ ditto -c -k --sequesterRsrc --keepParent AppName.app AppName.zip

I had this problem randomly and it turned out that moving my project around from machine to machine via USB caused a corruption in the Sparkle framework at some point.

My simple fix was to delete the framework from the project folder and simply paste it back in. After that it all worked fine with regard to downloading from a server. I must stress, delete the original framework file first, it took me about an hour to figure this out as pasting it in over the original didn't seem to work I've no idea why!