All Apps and Add-ons

slim package includes dot_underscore files and appinspect fails because of them

czervos
Explorer

I am developing my splunk app on a mac OS X system.

As a result the static directory contains along with the app*.png files the corresponding ._app*.png files.

When I slim package my app the tar.gz archive contains the dot_underscore files and as a result the appinspect fails the package with

A default value of 25 for max-messages will be used.
Splunk app packaging standards These checks validate that a Splunk app has been 
correctly packaged, and can be provided safely for package validation. 
    Check that the extracted Splunk App does not contain any directories or 
    files that start with a ., or directories that start with __MACOSX. 
        FAILURE: A prohibited file or directory was found in the 
            extracted Splunk App: static/._appIcon.png 
        FAILURE: A prohibited file or directory was found in the 
            extracted Splunk App: static/._appIcon_2x.png 
        FAILURE: A prohibited file or directory was found in the 
            extracted Splunk App: static/._appIcon_2x_fullname.png 
        FAILURE: A prohibited file or directory was found in the 
            extracted Splunk App: static/._appLogo.png 

I tried removing the dot underscore files prior to packaging the app by issuing

dot_clean  appname/static/

but when I repackage the app the new resulting archive still includes them. Has anyone else run into this problem and if yes how did you get around it?

TIA

0 Karma
1 Solution

delink
Communicator

I would highly recommend the advice on this site.

http://drmuey.com/?do=page&id=15

COPYFILE_DISABLE=true should always be in your environment when packaging tarballs on macOS.

View solution in original post

delink
Communicator

I would highly recommend the advice on this site.

http://drmuey.com/?do=page&id=15

COPYFILE_DISABLE=true should always be in your environment when packaging tarballs on macOS.

Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...