What's going on when my app says: Application is damaged and can't be opened. You should move it to the Trash

Question

I wrote an app, compiled and signed on my machine. It works for the other developers on my team, but for two different people, one using OS X Mavericks and one using Yosemite, it shows this message:

I was able to reproduce the error on a fresh Yosemite install. When that happened, this is what I seen in the logs:

30/03/2015 22:43:26.266 SpotlightNetHelper[256]: [SLSUGGESTIONS] Location managed failed with error Error Domain=kCLErrorDomain Code=0 "The operation couldn’t be completed. (kCLErrorDomain error 0.)"
30/03/2015 22:43:27.250 CoreServicesUIAgent[263]: Error -60005 creating authorization
30/03/2015 22:43:27.357 CoreServicesUIAgent[263]: Error SecAssessmentCreate: The operation couldn’t be completed. (OSStatus error -67054.)
30/03/2015 22:43:31.687 com.apple.xpc.launchd[1]: (com.apple.xpc.launchd.oneshot.0x10000006.Screensaver Ninja[434]) Service exited due to signal: Killed: 9

Looking around it seems the signature might be an issue, but I could verify it successful (I think):

$ codesign -dvvv --deep /Applications/Screensaver\ Ninja.app
Executable=/Applications/Screensaver Ninja.app/Contents/MacOS/Screensaver Ninja
Identifier=com.carouselapps.Screensaver-Ninja
Format=bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=3338 flags=0x0(none) hashes=159+3 location=embedded
Hash type=sha1 size=20
CDHash=c6c5fc1072a7e495969c3223f0950ceb53e246a7
Signature size=8533
Authority=Developer ID Application: Carousel Apps Ltd (XHT4M2DATL)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=30 Mar 2015 18:29:31
Info.plist entries=23
TeamIdentifier=XHT4M2DATL
Sealed Resources version=2 rules=12 files=35
Nested=Frameworks/libswiftObjectiveC.dylib
Nested=Frameworks/Sparkle.framework
Nested=Frameworks/Paddle.framework
Nested=Frameworks/HockeySDK.framework
Nested=Frameworks/libswiftCore.dylib
Nested=Frameworks/libswiftDispatch.dylib
Nested=Frameworks/libswiftFoundation.dylib
Nested=Frameworks/libswiftCoreGraphics.dylib
Nested=Frameworks/libswiftSecurity.dylib
Nested=Frameworks/libswiftDarwin.dylib
Nested=Frameworks/libswiftQuartzCore.dylib
Nested=Frameworks/libswiftAppKit.dylib
Internal requirements count=2 size=896

Any ideas what might be going on?

The app can be found on https://s3.amazonaws.com/screensaver-ninja/macosx/ScreensaverNinja-1.0-alpha-1.dmg

Answer 1

The problem was frameworks were being corrupted by their headers being removed due to this option: RemoveHeadersOnCopy.

After removing that option from my frameworks, this error went away. This helped:

$ codesign -dvvv --deep --verify /Applications/Screensaver\ Ninja.app
--prepared:/Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/.
--prepared:/Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/.
/Applications/Screensaver Ninja.app: a sealed resource is missing or invalid
In subcomponent: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/CrashReporter.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportSignalInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportMachineInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportBinaryImageInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportExceptionInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportMachExceptionInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReport.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportSymbolInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportSystemInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReporter.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashNamespace.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportProcessorInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportProcessInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportTextFormatter.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReporterConfig.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportRegisterInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportStackFrameInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportThreadInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportFormatter.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashReportApplicationInfo.h
file missing: /Applications/Screensaver Ninja.app/Contents/Frameworks/HockeySDK.framework/Versions/Current/Frameworks/CrashReporter.framework/Versions/Current/Headers/PLCrashFeatureConfig.h

I also needed to follow the steps explained in https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html to have a properly signed .app file.