Mac App Store Submission Guide

Since v0.34.0, Electron allows submitting packaged apps to the Mac App Store (MAS). This guide provides information on: how to submit your app and the limitations of the MAS build.

Note: Submitting an app to Mac App Store requires enrolling Apple Developer Program, which costs money.

Mac App Store Submission Guide

Since v0.34.0, Electron allows submitting packaged apps to the Mac App Store (MAS). This guide provides information on: how to submit your app and the limitations of the MAS build.

Note: Submitting an app to Mac App Store requires enrolling Apple Developer Program, which costs money.

How to Submit Your App

The following steps introduce a simple way to submit your app to Mac App Store. However, these steps do not ensure your app will be approved by Apple; you still need to read Apple's Submitting Your App guide on how to meet the Mac App Store requirements.

How to Submit Your App

The following steps introduce a simple way to submit your app to Mac App Store. However, these steps do not ensure your app will be approved by Apple; you still need to read Apple's Submitting Your App guide on how to meet the Mac App Store requirements.

Get Certificate

To submit your app to the Mac App Store, you first must get a certificate from Apple. You can follow these existing guides on web.

Get Certificate

To submit your app to the Mac App Store, you first must get a certificate from Apple. You can follow these existing guides on web.

Get Team ID

Before signing your app, you need to know the Team ID of your account. To locate your Team ID, Sign in to Apple Developer Center, and click Membership in the sidebar. Your Team ID appears in the Membership Information section under the team name.

Get Team ID

Before signing your app, you need to know the Team ID of your account. To locate your Team ID, Sign in to Apple Developer Center, and click Membership in the sidebar. Your Team ID appears in the Membership Information section under the team name.

Sign Your App

After finishing the preparation work, you can package your app by following Application Distribution, and then proceed to signing your app.

First, you have to add a ElectronTeamID key to your app's Info.plist, which has your Team ID as value:

<plist version="1.0">
  <dict>
    ...
    <key>ElectronTeamID</key>
    <string>TEAM_ID</string>
  </dict>
  </plist>

Then, you need to prepare three entitlements files.

child.plist:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
    <dict>
      <key>com.apple.security.app-sandbox</key>
      <true/>
      <key>com.apple.security.inherit</key>
      <true/>
    </dict>
  </plist>

parent.plist:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
    <dict>
      <key>com.apple.security.app-sandbox</key>
      <true/>
      <key>com.apple.security.application-groups</key>
      <string>TEAM_ID.your.bundle.id</string>
    </dict>
  </plist>

loginhelper.plist:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
    <dict>
      <key>com.apple.security.app-sandbox</key>
      <true/>
    </dict>
  </plist>

You have to replace TEAM_ID with your Team ID, and replace your.bundle.id with the Bundle ID of your app.

And then sign your app with the following script:

#!/bin/bash
  
  # Name of your app.
  APP="YourApp"
  # The path of your app to sign.
  APP_PATH="/path/to/YourApp.app"
  # The path to the location you want to put the signed package.
  RESULT_PATH="~/Desktop/$APP.pkg"
  # The name of certificates you requested.
  APP_KEY="3rd Party Mac Developer Application: Company Name (APPIDENTITY)"
  INSTALLER_KEY="3rd Party Mac Developer Installer: Company Name (APPIDENTITY)"
  # The path of your plist files.
  CHILD_PLIST="/path/to/child.plist"
  PARENT_PLIST="/path/to/parent.plist"
  LOGINHELPER_PLIST="/path/to/loginhelper.plist"
  
  FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"
  
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libnode.dylib"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/Contents/MacOS/$APP Helper EH"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/Contents/MacOS/$APP Helper NP"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/"
  codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/Contents/MacOS/$APP Login Helper"
  codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
  codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"
  
  productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

If you are new to app sandboxing under macOS, you should also read through Apple's Enabling App Sandbox to have a basic idea, then add keys for the permissions needed by your app to the entitlements files.

Apart from manually signing your app, you can also choose to use the electron-osx-sign module to do the job.

Sign Your App

After finishing the preparation work, you can package your app by following Application Distribution, and then proceed to signing your app.

First, you have to add a ElectronTeamID key to your app's Info.plist, which has your Team ID as value:

<plist version="1.0">
  <dict>
    ...
    <key>ElectronTeamID</key>
    <string>TEAM_ID</string>
  </dict>
  </plist>

Then, you need to prepare three entitlements files.

child.plist:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
    <dict>
      <key>com.apple.security.app-sandbox</key>
      <true/>
      <key>com.apple.security.inherit</key>
      <true/>
    </dict>
  </plist>

parent.plist:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
    <dict>
      <key>com.apple.security.app-sandbox</key>
      <true/>
      <key>com.apple.security.application-groups</key>
      <string>TEAM_ID.your.bundle.id</string>
    </dict>
  </plist>

loginhelper.plist:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
    <dict>
      <key>com.apple.security.app-sandbox</key>
      <true/>
    </dict>
  </plist>

You have to replace TEAM_ID with your Team ID, and replace your.bundle.id with the Bundle ID of your app.

And then sign your app with the following script:

#!/bin/bash
  
  # Name of your app.
  APP="YourApp"
  # The path of your app to sign.
  APP_PATH="/path/to/YourApp.app"
  # The path to the location you want to put the signed package.
  RESULT_PATH="~/Desktop/$APP.pkg"
  # The name of certificates you requested.
  APP_KEY="3rd Party Mac Developer Application: Company Name (APPIDENTITY)"
  INSTALLER_KEY="3rd Party Mac Developer Installer: Company Name (APPIDENTITY)"
  # The path of your plist files.
  CHILD_PLIST="/path/to/child.plist"
  PARENT_PLIST="/path/to/parent.plist"
  LOGINHELPER_PLIST="/path/to/loginhelper.plist"
  
  FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"
  
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libnode.dylib"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/Contents/MacOS/$APP Helper EH"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/Contents/MacOS/$APP Helper NP"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/"
  codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/Contents/MacOS/$APP Login Helper"
  codesign -s "$APP_KEY" -f --entitlements "$LOGINHELPER_PLIST" "$APP_PATH/Contents/Library/LoginItems/$APP Login Helper.app/"
  codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
  codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"
  
  productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"

If you are new to app sandboxing under macOS, you should also read through Apple's Enabling App Sandbox to have a basic idea, then add keys for the permissions needed by your app to the entitlements files.

Apart from manually signing your app, you can also choose to use the electron-osx-sign module to do the job.

Sign Native Modules

Native modules used in your app also need to be signed. If using electron-osx-sign, be sure to include the path to the built binaries in the argument list:

electron-osx-sign YourApp.app YourApp.app/Contents/Resources/app/node_modules/nativemodule/build/release/nativemodule

Also note that native modules may have intermediate files produced which should not be included (as they would also need to be signed). If you use electron-packager before version 8.1.0, add --ignore=.+\.o$ to your build step to ignore these files. Versions 8.1.0 and later ignores those files by default.

Sign Native Modules

Native modules used in your app also need to be signed. If using electron-osx-sign, be sure to include the path to the built binaries in the argument list:

electron-osx-sign YourApp.app YourApp.app/Contents/Resources/app/node_modules/nativemodule/build/release/nativemodule

Also note that native modules may have intermediate files produced which should not be included (as they would also need to be signed). If you use electron-packager before version 8.1.0, add --ignore=.+\.o$ to your build step to ignore these files. Versions 8.1.0 and later ignores those files by default.

Upload Your App

After signing your app, you can use Application Loader to upload it to iTunes Connect for processing, making sure you have created a record before uploading.

Upload Your App

After signing your app, you can use Application Loader to upload it to iTunes Connect for processing, making sure you have created a record before uploading.

Submit Your App for Review

After these steps, you can submit your app for review.

Submit Your App for Review

After these steps, you can submit your app for review.

Limitations of MAS Build

In order to satisfy all requirements for app sandboxing, the following modules have been disabled in the MAS build:

crashReporter
autoUpdater

and the following behaviors have been changed:

Video capture may not work for some machines.
Certain accessibility features may not work.
Apps will not be aware of DNS changes.

Also, due to the usage of app sandboxing, the resources which can be accessed by the app are strictly limited; you can read App Sandboxing for more information.

Limitations of MAS Build

In order to satisfy all requirements for app sandboxing, the following modules have been disabled in the MAS build:

crashReporter
autoUpdater

and the following behaviors have been changed:

Video capture may not work for some machines.
Certain accessibility features may not work.
Apps will not be aware of DNS changes.

Also, due to the usage of app sandboxing, the resources which can be accessed by the app are strictly limited; you can read App Sandboxing for more information.

Additional Entitlements

Depending on which Electron APIs your app uses, you may need to add additional entitlements to your parent.plist file to be able to use these APIs from your app's Mac App Store build.

Additional Entitlements

Depending on which Electron APIs your app uses, you may need to add additional entitlements to your parent.plist file to be able to use these APIs from your app's Mac App Store build.

Network Access

Enable outgoing network connections to allow your app to connect to a server:

<key>com.apple.security.network.client</key>
  <true/>

Enable incoming network connections to allow your app to open a network listening socket:

<key>com.apple.security.network.server</key>
  <true/>

See the Enabling Network Access documentation for more details.

Network Access

Enable outgoing network connections to allow your app to connect to a server:

<key>com.apple.security.network.client</key>
  <true/>

Enable incoming network connections to allow your app to open a network listening socket:

<key>com.apple.security.network.server</key>
  <true/>

See the Enabling Network Access documentation for more details.

dialog.showOpenDialog

<key>com.apple.security.files.user-selected.read-only</key>
  <true/>

See the Enabling User-Selected File Access documentation for more details.

dialog.showOpenDialog

<key>com.apple.security.files.user-selected.read-only</key>
  <true/>

See the Enabling User-Selected File Access documentation for more details.

dialog.showSaveDialog

<key>com.apple.security.files.user-selected.read-write</key>
  <true/>

See the Enabling User-Selected File Access documentation for more details.

dialog.showSaveDialog

<key>com.apple.security.files.user-selected.read-write</key>
  <true/>

See the Enabling User-Selected File Access documentation for more details.

Known issues

`shell.openItem(filePath)`

This will fail when the app is signed for distribution in the Mac App Store. Subscribe to #9005 for updates.

`shell.openItem(filePath)`

This will fail when the app is signed for distribution in the Mac App Store. Subscribe to #9005 for updates.

Workaround

shell.openExternal('file://' + filePath) will open the file in the default application as long as the extension is associated with an installed app.

Workaround

shell.openExternal('file://' + filePath) will open the file in the default application as long as the extension is associated with an installed app.

Cryptographic Algorithms Used by Electron

Depending on the country and region you are located, Mac App Store may require documenting the cryptographic algorithms used in your app, and even ask you to submit a copy of U.S. Encryption Registration (ERN) approval.

Electron uses following cryptographic algorithms:

AES - NIST SP 800-38A, NIST SP 800-38D, RFC 3394
HMAC - FIPS 198-1
ECDSA - ANS X9.62–2005
ECDH - ANS X9.63–2001
HKDF - NIST SP 800-56C
PBKDF2 - RFC 2898
RSA - RFC 3447
SHA - FIPS 180-4
Blowfish - https://www.schneier.com/cryptography/blowfish/
CAST - RFC 2144, RFC 2612
DES - FIPS 46-3
DH - RFC 2631
DSA - ANSI X9.30
EC - SEC 1
IDEA - "On the Design and Security of Block Ciphers" book by X. Lai
MD2 - RFC 1319
MD4 - RFC 6150
MD5 - RFC 1321
MDC2 - ISO/IEC 10118-2
RC2 - RFC 2268
RC4 - RFC 4345
RC5 - http://people.csail.mit.edu/rivest/Rivest-rc5rev.pdf
RIPEMD - ISO/IEC 10118-3

On how to get the ERN approval, you can reference the article: How to legally submit an app to Apple’s App Store when it uses encryption (or how to obtain an ERN).

Cryptographic Algorithms Used by Electron

Depending on the country and region you are located, Mac App Store may require documenting the cryptographic algorithms used in your app, and even ask you to submit a copy of U.S. Encryption Registration (ERN) approval.

Electron uses following cryptographic algorithms:

AES - NIST SP 800-38A, NIST SP 800-38D, RFC 3394
HMAC - FIPS 198-1
ECDSA - ANS X9.62–2005
ECDH - ANS X9.63–2001
HKDF - NIST SP 800-56C
PBKDF2 - RFC 2898
RSA - RFC 3447
SHA - FIPS 180-4
Blowfish - https://www.schneier.com/cryptography/blowfish/
CAST - RFC 2144, RFC 2612
DES - FIPS 46-3
DH - RFC 2631
DSA - ANSI X9.30
EC - SEC 1
IDEA - "On the Design and Security of Block Ciphers" book by X. Lai
MD2 - RFC 1319
MD4 - RFC 6150
MD5 - RFC 1321
MDC2 - ISO/IEC 10118-2
RC2 - RFC 2268
RC4 - RFC 4345
RC5 - http://people.csail.mit.edu/rivest/Rivest-rc5rev.pdf
RIPEMD - ISO/IEC 10118-3

On how to get the ERN approval, you can reference the article: How to legally submit an app to Apple’s App Store when it uses encryption (or how to obtain an ERN).

Electron Documentation

Docs / Guides / Mac App Store Submission Guide electron@master (b3edfd)

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN

EN