Mac App Store Configuration

Configuration options for building Mac App Store (MAS) packages

The top-level mas key contains options for building MAS (Mac Application Store) target. This configuration inherits all macOS options.

Basic Example

{
  "mas": {
    "entitlements": "build/entitlements.mas.plist",
    "entitlementsInherit": "build/entitlements.mas.inherit.plist",
    "hardenedRuntime": false,
    "type": "distribution"
  }
}

Mac App Store Requirements

When building for the Mac App Store, you need to:

1. Use appropriate entitlements files for MAS
2. Sign with a Mac App Store distribution certificate
3. Disable hardened runtime (MAS has its own sandboxing)
4. Follow Apple’s App Store guidelines

Configuration Options

MAS-Specific Entitlements

entitlements · string

The path to entitlements file for signing the app.

build/entitlements.mas.plist will be used if exists (it is a recommended way to set).

Be aware that your app may crash if the right entitlements are not set like com.apple.security.cs.allow-jit for example on arm64 builds with Electron 20+.

See this folder in osx-sign’s repository for examples.

See Signing and Notarizing macOS Builds for more information.

entitlementsInherit · string

The path to child entitlements which inherit the security settings for signing frameworks and bundles of a distribution.

build/entitlements.mas.inherit.plist will be used if exists (it is a recommended way to set).

See this folder in osx-sign’s repository for examples.

binaries · string[]

Paths of any extra binaries that need to be signed.

Inherited Options

The MAS configuration inherits all options from macOS configuration, including:

• category - Application category
• icon - Application icon
• identity - Code signing identity (use Mac App Store certificate)
• type - Distribution or development
• bundleVersion - CFBundleVersion
• bundleShortVersion - CFBundleShortVersionString
• minimumSystemVersion - Minimum macOS version
• provisioningProfile - Provisioning profile path
• And all other macOS options

Some macOS options behave differently for MAS builds:

• hardenedRuntime should typically be false for MAS
• notarize is not applicable for MAS
• requirements is not applicable for MAS

Example Entitlements

mas.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
      <string>TEAM_ID.your.bundle.id</string>
    </array>
  </dict>
</plist>

mas.inherit.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.inherit</key>
    <true/>
  </dict>
</plist>

Testing MAS Builds

You can build a development MAS build for testing using the mas-dev target:

{
  "mac": {
    "target": ["mas-dev"]
  }
}

Or via command line:

electron-builder --mac mas-dev

Resources

• Apple’s App Sandbox Guide
• Electron Mac App Store Submission Guide
• Code Signing Guide