Search results for

codesign

3,110 results found

Post

Replies

Boosts

Views

Activity

Flutter build fails on iOS physical device in Android Studio, works in Xcode
Hello, I'm encountering an issue when trying to build and launch a Flutter app on a physical iOS device using Android Studio. Here is the full log: `Launching lib/main.dart on (iPhone Name) in debug mode... Automatically signing iOS for device deployment using specified development team in Xcode project: (Project ID) Running Xcode build... Xcode build done. 19.7s Failed to build iOS app Could not build the precompiled application for the device. Error (Xcode): Target debug_unpack_ios failed: Exception: Failed to codesign (Project Names)/build/ios/Debug-iphoneos/Flutter.framework/Flutter with identity (identity ID). Error launching application on (iPhone Name).` This only happens when using Android Studio. When I build the same project using Xcode, it runs fine on the same device. Background: I accidentally deleted all Apple accounts from Xcode recently. In Keychain Access, I had three identical certificates; I deleted the older two and kept the newest one. I suspect this may be related to provisionin
2
0
114
Jun ’25
Creating codesigned AppleScript apps
In the past it was relatively easy to download from the developer portal both the app signing and installer signing certs so that I could sign AppleScripts from Script Editor when exporting them and when building packages in Jamf Composer. I went to set that up today and it seems things have changed in the last few years since I've had to set this up. I've been unable to sort this out and would love some help. I'm looking for a tutorial on doing this that walks someone step-by-step through the process for obtaining the certs (yes, I have dev account) and setting them up in keychain and then making use of them. Thanks!
1
0
86
Jun ’25
Reply to Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Fortunately this crash does not appear related to a code signing issue. Execution of Thread 6 branched to an address which just so happened to reside within the GPU Carveout memory region. The GPU Carveout memory region does not contain executable code, nor do those pages have an associated code signature. Hence the CODESIGNING termination reason. But it is better to think of this crash as a segmentation fault (EXC_BAD_ACCESS / SIGSEGV). Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNU
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’25
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING App was being idle and then the user brought an application to foreground, on being app transition observed app crash. 2025-04-23 19:16:26.795985 +0530 launchd exited with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING, ran for 1801880ms default Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNUSED SPACE AT END Termination Reason: CODESIGNING 2 Invalid Page Attached
1
0
110
Jun ’25
Integrating CryptoTokenKit with productsign
Hi all, I'm using a CryptoTokenKit (CTK) extension to perform code signing without having the private key stored on my laptop. The extension currently only supports the rsaSignatureDigestPKCS1v15SHA256 algorithm: func tokenSession(_ session: TKTokenSession, supports operation: TKTokenOperation, keyObjectID: TKToken.ObjectID, algorithm: TKTokenKeyAlgorithm) -> Bool { return algorithm.isAlgorithm(SecKeyAlgorithm.rsaSignatureDigestPKCS1v15SHA256) } This setup works perfectly with codesign, and signing completes without any issues. However, when I try to use productsign, the system correctly detects and delegates signing to my CTK extension, but it seems to always request rsaSignatureDigestPKCS1v15SHA1 instead: productsign --timestamp --sign unsigned.pkg signed.pkg productsign: using timestamp authority for signature productsign: signing product with identity Developer ID Installer: () from keychain (null) ... Error Domain=NSOSStatusErrorDomain Code=-50 algid:sign:RSA:digest-PKCS1v15:SHA1: algorithm
7
0
520
Jun ’25
Reply to Cross process URL bookmark
I have a bunch of links to XPC info in my XPC Resources post. In general, I recommend that you split this problem in three: Implement XPC communication in general. Start XPC communication to a named XPC endpoint. Install the launchd job. For the first part, use the loopback approach described in TN3113 Testing and Debugging XPC Code With an Anonymous Listener. IMPORTANT While that technote assumes NSXPCConnection, this approach also works with low-level C API. It’s not yet supported by the low-level Swift API (r. 113356759). For the second part, I generally create a launchd agent and install it using launchctl. I’m not actually sure that’s the best option, but it’s one I’m familiar with. The agent property list would look something like this: % plutil -p com.example.MyProduct.MyAgent.plist { BundleProgram => /path/to/my/agent Label => com.example.MyProduct.MyAgent MachServices => { com.example.MyProduct.MyEndpointName => 1 } } One potential source of confusion here is the difference between the la
Jun ’25
a required plist file or resource is malformed
I am facing this error on every flutter project build. Although it runs ok. The error happens on the codesign command What do I need to fix ? I have validated that every *.plist file is ok using plutil -lint ERROR MESSAGE /usr/bin/codesign --force --sign MY_SHA_CODE --verbose /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib)` exited with status 0. The command's output was: /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib: a required plist file or resource is malformed Info.plist CFBundleDevelopmentRegion $(DEVELOPMENT_LANGUAGE) CFBundleDisplayName Flutter Application 1 CFBundleExecutable $(EXECUTABLE_NAME) CFBundleIdentifier $(PRODUCT_BUNDLE_IDENTIFIER) CFBundleInfoDictionaryVersion 6.0 CFBundleName flutter_application_1 CFBundlePackageType APPL CFBundleShortVersionString $(FLUTTER_BUILD_NAME) CFBundleSignature ???? CFBundleVersion $(FLUTTER_BUILD_NUMB
4
0
187
May ’25
JIT entitlement for command line tool
My command line tool with a JIT entitlement is failing to run on Sequoia. 2025-05-26 14:17:09.758 E taskgated-helper[91764:3ab7036] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing DecisionRuleTool because no eligible provisioning profiles found 2025-05-26 14:17:09.758 Df amfid[576:3ab6d6b] /Users/jim/DecisionRuleTool not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 No matching profile found UserInfo={NSURL=file:///Users/jim/DecisionRuleTool, NSLocalizedDescription=No matching profile found} 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] (AppleMobileFileIntegrity) AMFI: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] mac_vnode_check_signature: /Users/jim/DecisionRuleTool: code signature validation failed fatally: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] proc 91763: load code signature error 4 for file DecisionRuleTool 2025-05-26 14:17:09.759 Df kernel[0:3ab7032] (AppleSystemPolicy) ASP: Security p
1
0
92
May ’25
Reply to JIT entitlement for command line tool
You are heading down the wrong path here. The JIT entitlement (com.apple.security.cs.allow-jit) is unrestricted: It doesn’t need to be authorised by a provisioning profile [1]. Thus the advice in Signing a daemon with a restricted entitlement doesn’t apply. Anyone can claim this entitlement in any code. Note For more about how provisioning profiles authorise entitlement claims, see TN3125 Inside Code Signing: Provisioning Profiles. The issue here is that your tool is trying to claim other entitlements that are restricted, namely, com.apple.application-identifier and com.apple.developer.team-identifier. If you remove those, your code will run. Consider this: % codesign -s Apple Development: Quinn Quinn (7XFU7D52S4) -f -o runtime Test785697 Test785697: replacing existing signature % codesign -d -vvv --entitlements - Test785697 … CodeDirectory v=20500 size=694 flags=0x10000(runtime) … … Authority=Apple Development: Quinn Quinn (7XFU7D52S4) … no entitlements … % ./Test785697 Hello Cruel World! M
May ’25
Reply to Run SampleEndpointApp but got Automatic signing failed
I’m glad you got it working. By way of explanation, com.apple.developer.system-extension.install is a restricted entitlement, meaning that: It must be authorised by a provisioning profile. It’s not managed, that is, you don’t need to apply to Apple to use it. Anyone can enable it from Xcode or the Developer website. In the sample the app target includes the System Extension capability in the Signing & Capabilities editor. That causes Xcode to: Sign the app to claim the entitlement. Embed a provisioning profile that authorises that claim. In my command to re-sign the app I have this: % codesign … --preserve-metadata=identifier,entitlements,flags,runtime … which should preserve the entitlement claim that Xcode added. I’m not sure why it wasn’t working in your case. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: App & System Services SubTopic: Core OS Tags:
May ’25
Reply to Binary Signing Error
Just to be clear, frameworks don’t need a provisioning profile. The purpose of a profile is to authorise the execution of code. You can’t execute a framework directly — it’s always run as part of a process that was started from some executable — and thus there’s never a need for it to have a profile. Or entitlements for that matter. We talk about this in gory detail in TN3125 Inside Code Signing: Provisioning Profiles. As to what’s going wrong here, it’s hard to say without more details. Let’s start at the end and work backwards. My understanding is that you’re hitting this error when you attempt to submit (or validate) an App Store submission using the Xcode organiser. Is that right? If so, is that for your iOS app? If so, please run through the Distribute App > Custom > App Store > Export workflow. That should succeed and produce a .ipa. Unpack the .ipa file (it’s a zip archive under the covers) and then look at the built app. What do you get back from the following? % codesign -d -vvv --e
Topic: Code Signing SubTopic: General Tags:
May ’25
Notarization service says signature invalid, but codesign says it's fine
I'm trying to get an app notarized, which fails with this error: The signature of the binary is invalid. However, locally checking the signature does succeed: $ codesign -vvv --deep --strict TheApp.app […] TheApp.app: valid on disk TheApp.app: satisfies its Designated Requirement Performing this check on every single item in the app's MacOS folder also succeeds. Context: embedded prebuilt binaries Now, the app has something unusual about it: it embeds prebuilt binaries, arranged in various nested folders. So, the app bundle's MacOS folder actually contains another folder with a whole tree of executables and libraries: Removing these (before building) does fix the notarization issue, but obviously I'd like to keep them in. I did my best to properly sign these items: At build time, they're copied into the product by a Copy Files phase (but not signed), then signed by a script phase That signing uses the same signing identity as the running Xcode build, and enables the hardened runtime The app builds an
8
0
152
May ’25
Reply to "Command CodeSign failed with a nonzero exit code" I got this error
My issue was different than the others above and I've run into it a couple times over the years. During CI automation we run fastlane and ran into this mysterious Command CodeSign failed with a nonzero exit code. Both times the fix was to manually start up Xcode start building and then there would be a CodeSign pop up asking for credentials. It only occurs when setting up a new machine.
May ’25
Reply to Run SampleEndpointApp but got Automatic signing failed
Hi Eskimo, Thanks for you step by step introductions. I executed the same operations but still got error: Begin installing the extension 🔄 Failed to install the extension ❌ Missing entitlement com.apple.developer.system-extension.install `security cms -D -i SampleEndpointApp.app/Contents/embedded.provisionprofile | plutil -p -` { AppIDName => XC com example apple-samplecode SampleEndpointAppRKJVFVKFG3 ApplicationIdentifierPrefix => [ 0 => RKJVFVKFG3 ] ... Entitlements => { com.apple.application-identifier => RKJVFVKFG3.com.example.apple-samplecode.SampleEndpointAppRKJVFVKFG3 com.apple.developer.system-extension.install => 1 com.apple.developer.team-identifier => RKJVFVKFG3 keychain-access-groups => [ 0 => RKJVFVKFG3.* ] } ExpirationDate => 2026-05-21 17:00:08 +0000 IsXcodeManaged => 0 Name => SampleEndpointAppUI Platform => [ 0 => OSX ] PPQCheck => 0 ProvisionedDevices => [ 0 => 00008132-000121E822F8801C 1 => 00006030-000279A822D9001C ] TeamIdentifier =&g
Topic: App & System Services SubTopic: Core OS Tags:
May ’25