ricky wowo
New Member
OBS for mac has a signed package, which is great. It means that someone in your project (Hugh Bailey) already has a developer account, and it helps immensely confirming that the software shipped from the author and hasn't been modified. Unfortunately though, once you install the application, you find the application bundle itself which has been installed on your filesystem is not signed, and this causes issues for admins deploying obs on behalf of users who do not have admin rights.
OBS uses certain 'accessibity features' when you're recording the screen, and users get a prompt asking if they'd like to allow this, for privacy/security reasons. To allow this (which fully features OBS), you need admin credentials. If you do not have admin credentials, you have two options:
1. Find the person that holds the admin account keys and ask them to manually enable accessibility features for OBS
2. Use a MDM to deploy a Privacy Preferences Policy Control Payload <-- This requires the .app bundle to be signed.
You can read more about what's changed for MacOS Mojave/some reasons behind the changes here: https://carlashley.com/2018/09/28/tcc-round-up/
I was able to work around this in my environment by personally signing OBS with my own developer certificate, and then re-distributing OBS studio. This won't help other admins however, and it's work I'll have to continue every time we distribute updates.
If you can't have Xcode sign the app bundle, can I please ask you add the following macOS commands to your build workflow before it gets built in a .pkg? This will sign the application bundle for distribution. You may need to fiddle with supplying a specific keychain with the developer cert to the CI environment, and you may/may not need sudo.
codesigning_identity='string to identify developer cert in keychain';# Mine is '3rd Party Mac Developer Application: Firstname Lastname (##########)'
path_to_app_bundle="/Applications/OBS.app";# you may need to change this depending on where the app bundle lives
sudo codesign -s "${codesigning_identity}" "${path_to_app_bundle}/Contents/Frameworks/Sparkle.framework/"
sudo codesign -s "${codesigning_identity}" "${path_to_app_bundle}/Contents/Frameworks/Chromium Embedded Framework.framework/"
sudo codesign -s "${codesigning_identity}" "${path_to_app_bundle}"
I'm trying to reproduce the accessibility popup to grab a screenshot of but it should be enough of an explanation I hope.
OBS uses certain 'accessibity features' when you're recording the screen, and users get a prompt asking if they'd like to allow this, for privacy/security reasons. To allow this (which fully features OBS), you need admin credentials. If you do not have admin credentials, you have two options:
1. Find the person that holds the admin account keys and ask them to manually enable accessibility features for OBS
2. Use a MDM to deploy a Privacy Preferences Policy Control Payload <-- This requires the .app bundle to be signed.
You can read more about what's changed for MacOS Mojave/some reasons behind the changes here: https://carlashley.com/2018/09/28/tcc-round-up/
I was able to work around this in my environment by personally signing OBS with my own developer certificate, and then re-distributing OBS studio. This won't help other admins however, and it's work I'll have to continue every time we distribute updates.
If you can't have Xcode sign the app bundle, can I please ask you add the following macOS commands to your build workflow before it gets built in a .pkg? This will sign the application bundle for distribution. You may need to fiddle with supplying a specific keychain with the developer cert to the CI environment, and you may/may not need sudo.
codesigning_identity='string to identify developer cert in keychain';# Mine is '3rd Party Mac Developer Application: Firstname Lastname (##########)'
path_to_app_bundle="/Applications/OBS.app";# you may need to change this depending on where the app bundle lives
sudo codesign -s "${codesigning_identity}" "${path_to_app_bundle}/Contents/Frameworks/Sparkle.framework/"
sudo codesign -s "${codesigning_identity}" "${path_to_app_bundle}/Contents/Frameworks/Chromium Embedded Framework.framework/"
sudo codesign -s "${codesigning_identity}" "${path_to_app_bundle}"
I'm trying to reproduce the accessibility popup to grab a screenshot of but it should be enough of an explanation I hope.