Native code for Mac in distribution jar is unsigned

[thomas-metz-ix]

In the distribution jar, the files

org/xerial/snappy/native/Mac/aarch64/libsnappyjava.dylib,
org/xerial/snappy/native/Mac/x86/libsnappyjava.jnilib,
and
org/xerial/snappy/native/Mac/x86_64/libsnappyjava.dylib,

are currently not properly signed with an Apple Developer ID.

While aarch64/libsnappyjava.dylib according to the signcode command (signcode -vvvvvv aarch64/libsnappyjava.dylib) does have a signature in principle, it is rejected by Apple's notarization mechanism when the jar is included as a dependency:

    { 
      "severity": "error",
      "code": null,
      "path": "[...]/lib/snappy-java-1.1.10.5.jar/org/xerial/snappy/native/Mac/aarch64/libsnappyjava.dylib",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
      "architecture": "arm64"
    },

The files x86/libsnappyjava.jnilib and x86_64/libsnappyjava.dylib do not have a signature at all and are rejected as well:

    { 
      "severity": "error",
      "code": null,
      "path": "[...]/lib/snappy-java-1.1.10.5.jar/org/xerial/snappy/native/Mac/x86_64/libsnappyjava.dylib",
      "message": "The binary is not signed.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
      "architecture": "x86_64"
    },

The signatures have been faulty/lacking at least since 1.1.10.5 up to the current release.

BTW: If anyone encounters this problem, a workaround is to unpack the jar, sign the files yourself, repack and sign the jar as well. For me, it worked best to use jar xf and jar cf for this. See also https://developer.apple.com/forums/thread/764017