“eskimo”

Hmmmm, that wasn’t the answer I was expecting. It seems like you have two goals here: Check the app before you submit it to App Store Connect. If App Store Complains about an app you submitted, quickly diagnose the issue. Is that right? If so, the best tool for the pre-submission check is indeed the Xcode organiser’s Validate App option. You can also automate this using the --validate-app subcommand in altool. The nice thing about Validate App is that it runs a mini version of the same validation that’s done internally by App Store Connect [1], and thus it’s a solid predictor of success or failure. The best path forward for your second point is much less clear cut. I probably wouldn’t drop down to the SecCode API for this. You can achieve much the same results using the codesign tool, and that’s an easier and more flexible option for this sort of work. As a basic check I’d do this: % codesign -v --deep -strict -vvv /path/to/your.app You can also do this: % codesign -d --extract-certificates /path/to/your.app

Unfortunately I can’t help you with this, for reasons that I’m not going to discuss. Sorry. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

I’m not sure what you’re actually asking here, so rather than guess I’m gonna drop in the core code of one of the test frameworks that I created. This parses DNS messages out of a TCP stream, where is DNS message starts with a two-byte length in network byte order. Sadly, I never created a line-based framer, and I’m unlikely to ever do that because these days I typically do this work outside of the networking stack, relying on Swift async functions for the I/O side of things. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com func handleInput(framer instance: NWProtocolFramer.Instance) -> Int { while true { var payloadLength: Int = 0 var success = instance.parseInput(minimumIncompleteLength: 2, maximumLength: 2) { buffer, _ in guard let buffer = buffer, buffer.count >= 2 else { return 0 } let length16 = buffer.reduce(0) { soFar, next in (soFar << 8) | UInt16(next) } payloadLength = Int(length16) // We return 0 here

Creating role accounts on macOS has always been a tricky issue. A key problem is that there are multiple layers of abstraction and many of the underlying layers have supported APIs. For example, the Open Directory framework is a supported way to read and write user records. However, that’s only part of the story. Using these APIs to achieve a high-level goal, like creating a role account, is tricky, to the point where I’m not sure it’s something you’d want to attempt. You might find that things work today but fail on older, or worse yet newer, systems. Given that, what your really need is a high-level ‘create a role account’ API. Sadly, we don’t have that. The best we have is the sysadminctl tool and its -roleAccount option. That’s not ideal — command-line tools aren’t really APIs — but it’s probably your best option as things currently stand. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

AFAIK Apple hasn’t announced any plans in this space and, given that, it’s not something we can discuss here on the forums. See tip 3 is Quinn’s Top Ten DevForums Tips for more my general thoughts about that. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='850031021, devjun, /thread/850031, /profile/devjun'] I filed this as FB24760235 [/quote] Thanks. That’s the right path for this issue. [quote='850031021, devjun, /thread/850031, /profile/devjun'] Is UDP ASSOCIATE support planned for the system SOCKS5 client … ? [/quote] I can’t talk about The Future™ — see tip 3 in Quinn’s Top Ten DevForums Tips — but the fact that your bug hasn’t been bounced back is a promising sign (-: [quote='850031021, devjun, /thread/850031, /profile/devjun'] how can an app find out that a connection went direct? [/quote] This should be reflected in the usedProxy property of the connection establishment report. [quote='850031021, devjun, /thread/850031, /profile/devjun'] shouldn't a connection that can't honor the configured proxy fail rather than bypass it? [/quote] Not in general. It’s traditional for proxies to be deployed in environments where the network itself blocks the connection, and thus this isn’t a concern. But… Did you try setting the allowFailover property to false

This seems like a variant of the issue being discussed on this thread. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='908323022, Etresoft, /thread/849841?answerId=908323022#908323022, /profile/Etresoft'] And that's the extent of its documentation. [/quote] Indeed. Specifically, look at the slide shown at 21:32. AFAICT the schema illustrated by that slide is what’s actually implemented. Clearly we should have proper documentation for this and I encourage you to file a bug requesting that. Please post your bug number, just for the record. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='908171022, marucello, /thread/849002?answerId=908171022#908171022, /profile/marucello'] Would you recommend that I next repeat the same test from my normal local Documents project location on macOS 26.7.1 … ? [/quote] Yeah, that seems like a good next step. This is such a weird problem. Hopefully it’ll come back when you retest with the Documents directory, because I don’t think there will be any way to work out what’s being going wrong otherwise. Oh, and if you do manage to reproduce this, immediately trigger a sysdiagnose log and save that log somewhere. Depending on how this pans out that log may or may not be useful, but it’s good to grab one just in case. For more info about sysdiagnose logs, see Bug Reporting > Profiles and Logs. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Thanks for the clarification. I’m pretty sure I have answers for at least some of your questions, but I want to ask one more question before that… You want to run this check on the Mac, right? That is, you want to run code on a specific Mac that checks that the /Library/Developer/CommandLineTools stuff installed on that Mac is valid? I’m asking because such a check can take advantage of macOS machinery that’s not available, say, if you were trying to run the check on some Linux server. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='908224022, kimdev, /thread/849625?answerId=908224022#908224022, /profile/kimdev'] Which [things] would be most useful to distinguish a signing-input defect from a local trust-evaluation failure? [/quote] What are you actually trying to achieve here? Because, for example, the approach you’d use to verify the code signature of a product before shipping it would be very different than, say, the approach you’d use in an endpoint security product. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='908176022, shivam4044, /thread/844097?answerId=908176022#908176022, /profile/shivam4044'] we have also raised [FB25067480] for with the necessary logs [/quote] Thanks. We agree that this is the same issue as FB24637565 and have (internally) marked it as a dup of that. As to the current state of FB24637565, I can’t offer any timeline for a fix, other than to say that: It’s not fixed in any released or seeded system. As always, I encourage you to test on beta seeds as we make them available. Based on my understanding of the underlying cause, I don’t see any viable workaround here. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Good point. Thanks for sharing. And I have my own tip to share on this front (-: For watchOS, you can actually fetch symbols from Apple. See Acquiring operating system symbol information for info on how to do this. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

[quote='908251022, vm_install_notes, /thread/849369?answerId=908251022#908251022, /profile/vm_install_notes'] specifically a sandbox-exec-based profile around the command runner [/quote] Yeah, I thought that might be the case. We don’t support custom sandboxes like this, for the reasons I described here. The nature of doing unsupported stuff is that you might encounter hard-to-explain problems. Sadly, that’s just how it is. You can continue down that path and try to work out what went wrong by yourself, but my advice is that you change your approach. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

There are lots of questions here that I can’t answer because: iOS’s power management policy is largely considered an implementation detail. It has changed in the past and it’ll likely change in the future. And the actual behaviour is very complex, varying radically based on the specific circumstances of a given device. There’s no single set of best practices here. The best approach is likely going to depend on the specifics of your app. Moreover, it may require tweaking as you gain real world experience. I have a bunch of general advice on this topic in Moving to Fewer, Larger Transfers. I recommend you read that and then come back here with your remaining questions, keeping in mind the caveats I’ve outlined above. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com