Search results for

codesign

3,113 results found

Post

Replies

Boosts

Views

Activity

Reply to Sequoia 'local network' permission failure from launch agent
There are a bunch of factors that could lead to this problem but, after doing a bunch of testing here in my office, I suspect that this is a bug in local network privacy )-: To start, I’m testing on macOS 15.3.2 (24D81), in a VM, restoring from a clean snapshot between each test. I have a test tool that connects either via Network framework or BSD Sockets. The code is pasted in at the end of this email. Note This relies on the helpers in Calling BSD Sockets from Swift. The tool is signed with an Apple Development signing identity: % codesign -d -vv Test778457 … Authority=Apple Development: Quinn Quinn (7XFU7D52S4) … Note This is different from your case, because Homebrew uses ad-hoc signing. I was hoping that signing the code might help. It does not. I have a launchd property list that runs my shell script: % plutil -p com.example.Test778457.plist { Label => com.example.Test778457 ProgramArguments => [ 0 => /Users/quinn/Test778457.sh ] } And a shell script that runs my tool: % cat Test778457
Mar ’25
Reply to AppStore submission for Ruby/Glimmer app on MacOS without Xcode
Yes, sorry that I wasn't clear - The error did occur when attempting to open the app with TestFlight (the dialog box opened twice with the same message, BTW.) Plus, PATHmanager.app is neither installed under /Applications, nor ~/Applications. If there's something else I can do to get it installed, I'm all ears. :-) I'll post the output of your suggested commands from the extracted .pkg file that was uploaded using Transporter (hopefully that helps?): Signature dump for app bundle /tmp λ codesign -d -vvv PATHmanager.app/ Executable=/private/tmp/PATHmanager.app/Contents/MacOS/PATHmanager Identifier=com.chipcastle.pathmanager Format=app bundle with Mach-O thin (arm64) CodeDirectory v=20500 size=223206 flags=0x10000(runtime) hashes=6964+7 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=a7e912f449ef085b27467d282bfeca980b8e4d9c CandidateCDHashFull sha256=a7e912f449ef085b27467d282bfeca980b8e4d9c9063d3b31bb34aaa15383e7d Hash choices=sha256 CMSDigest=a7e912f449ef085b27467d282bfeca980b8e4d9c9
Topic: Code Signing SubTopic: General
Mar ’25
Reply to AppStore submission for Ruby/Glimmer app on MacOS without Xcode
[quote='831709022, chipcastle, /thread/774923?answerId=831709022#831709022, /profile/chipcastle'] I was able to get it submitted to TestFlight, but am now getting a slightly different error for the dylib than before: [/quote] So, you’re seeing this when launching the app that you installed using TestFlight? If so, reproduce the problem and then dump the signature of your app and its embedded dynamic library. So, this: % codesign -d -vvv /Applications/PATHmanager.app and this: % codesign -d -vvv /Applications/PATHmanager.app/Contents/Frameworks/libui.dylib They should be the same, that is, both signed by Apple Mac OS Application Signing. Is that what you see? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General
Mar ’25
Sequoia 'local network' permission failure from launch agent
I'm trying to invoke a 3rd party command line tool from a launch agent to connect to a server on my LAN. It seems impossible. I have a little shell script that does what I need, and it works fine invoked in Terminal.app. The first time I run it that way I get permission prompts and I agree to them all. Subsequent invocations work. Now I put a launch agent in ~/Library/Launch Agents. It does nothing more than invoke my shell script at some specific time daily. launchd launches it, but it fails to access the LAN, with a 'no route to host' error message. The command line tool I'm trying to use is not a macOS-provided one, but one from MacPorts/HomeBrew (I tried both). It doesn't even matter which tool I'm using, I tried a very simple case of just using nc/netcat. If I use the macOS-provided nc, then I can access my LAN. If I install nc from MacPorts /HomeBrew, that nc cannot access my LAN. This I've reproed on a literally brand new Mac, then updated to newest Sequoia (15.3.2), then done all I've described above.
14
0
349
Mar ’25
Reply to AppStore submission for Ruby/Glimmer app on MacOS without Xcode
I was able to get it submitted to TestFlight, but am now getting a slightly different error for the dylib than before: “libui.dylib” Not Opened Apple could not verify “libui.dylib” is free of malware that may harm your Mac or compromise your privacy. The dylib is located under Contents/Frameworks, so I'm not sure what else there is to be done. Bundle contents λ xar -xf ~/code/ruby/PATHmanager.pkg /tmp λ lsbom com.chipcastle.pathmanager.pkg/Bom . 0 0/0 ./PATHmanager.app 40755 0/0 ./PATHmanager.app/Contents 40755 0/0 ./PATHmanager.app/Contents/Frameworks 40755 0/0 ./PATHmanager.app/Contents/Frameworks/libui.dylib 100644 0/0 925632 2654273729 ./PATHmanager.app/Contents/Info.plist 100644 0/0 1415 196399421 ./PATHmanager.app/Contents/MacOS 40755 0/0 ./PATHmanager.app/Contents/MacOS/PATHmanager 100755 0/0 28765680 1121196294 ./PATHmanager.app/Contents/PkgInfo 100644 0/0 8 742937289 ./PATHmanager.app/Contents/Resources 40755 0/0 ./PATHmanager.app/Contents/Resources/AppIcon.icns 100644 0/0 56310 2265036908 ./PATHmana
Topic: Code Signing SubTopic: General
Mar ’25
Reply to Multiple Executables in a Single Bundle Fails to Launch Others After Codesign
Quinn! Thank you for your efforts and details. Your posts on this forum have been a lifesaver for those of us new to the world of Apple development/deployment. Current Entitlements Each of our executables require the same entitlements: com.apple.security.app-sandbox com.apple.security.cs.disable-library-validation com.apple.security.files.user-selected.read-write com.apple.security.network.client com.apple.security.network.server From the research into the articles you posted, it seems like these are all safe to inherit but I could be wrong about that! And if it's all going to TestFlight then I suppose it's restricted? The lib validation is disabled because we include a plugin ecosystem through Qt. I've tried adding the com.apple.security.inherit in our entitlements but am still seeing the same issue. Here's the entitlements for the exec_b (and exec_a) > codesign -d --entitlements - exec_b Executable=/Users/foo/src/SomeApp.app/Contents/MacOS/exec_b [Dict] [Key] com.apple.security.app-sandbox [Valu
Topic: Code Signing SubTopic: General Tags:
Mar ’25
Invalid binary for tvOS app which integrates an xcframework
We're building an SDK (let's call it MyFramework) which is distributed as an .xcframework for developers to integrate it into their own apps. Recently, we've added tvOS support by adding it as a supported destination for the SDK. Essentially, the SDK became a cross-platform framework and easy to be adopted in both iOS and tvOS apps. The .xcframework is generated fine, all builds correctly. We've tested the SDK integrated in test apps. We've also submitted an iOS archive app to the AppStore connect, just to make sure all is well with the AppStore submission. However, when I tried submitting a tvOS archive app (that integrates the same SDK) to the AppStore connect, the build was marked as invalid binary and we've got the following error message: ITMS-90562: Invalid Bundle - One of the nested bundles is built for a platform which is different from the main bundle platform. Please make sure that all bundles have correct platform specification. First, I thought that any of the modules of the framework was not corr
0
0
130
Mar ’25
Reply to AppStore submission for Ruby/Glimmer app on MacOS without Xcode
It’s better to reply as a reply, rather than in the comments; see Quinn’s Top Ten DevForums Tips for this and other titbits. Here's the link Thanks. I downloaded that and extracted your app: % xar -xf PATHmanager.pkg % cpio -i < com.chipcastle.pathmanager.pkg/Payload 58111 blocks I then dumped its code signature: % codesign -d -vvv --entitlements - PATHmanager.app Executable=/Users/quinn/Desktop/test/PATHmanager.app/Contents/MacOS/PATHmanager Identifier=com.chipcastle.pathmanager Format=app bundle with Mach-O thin (arm64) CodeDirectory v=20500 size=223078 flags=0x10000(runtime) hashes=6964+3 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=ed5d7d18f524cae6db2b57b2682ebfa61572510b CandidateCDHashFull sha256=ed5d7d18f524cae6db2b57b2682ebfa61572510b56d6a26c037c8cc003f1f1d3 Hash choices=sha256 CMSDigest=ed5d7d18f524cae6db2b57b2682ebfa61572510b56d6a26c037c8cc003f1f1d3 CMSDigestType=2 CDHash=ed5d7d18f524cae6db2b57b2682ebfa61572510b Signature size=9115 Authority=Apple Distribution: Chip
Topic: Code Signing SubTopic: General
Mar ’25
Reply to Persistent “com.apple.security.get-task-allow” entitlement after signing¬arizing
/usr/libexec/PlistBuddy -c Add :com.apple.security.get-task-allow bool true /tmp/my-app-debug-entitlements.plist /usr/libexec/PlistBuddy -c Add :com.apple.security.cs.disable-library-validation bool true /tmp/my-app-debug-entitlements.plist codesign --timestamp --options runtime --sign Developer ID Application: *** (***) --entitlements /tmp/my-app-debug-entitlements.plist --force /path/to/my-debug-binary I had no problems with the notarization process of the binary I signed this way. As you said, I will not distribute my application in this way. I will only distribute this binary to users I want to debug. Thanks.
Mar ’25
Multiple Executables in a Single Bundle Fails to Launch Others After Codesign
We have a rather complex network of dependencies for our application stack and, from it, we create multiple unique executables that are placed into the Contents/MacOS directory of our bundle. MyApp.app `- Contents/ `- Frameworks/... `- MacOS/ `- exec_a `- exec_b `- Resources/... Both executables require the same dependencies (and use the same shared .dylib files built as targets in the same project) so it makes sense for them to be in the same place rather than in their own .app folder as I understand it. Qt Libs -> core_lib.dylib -> gui_lib.dylib -> exec_a `-> exec_b etc. We've confirmed build artifacts are correct and the rpath/dependencies are all clean. When in development, all executables run as expected and we can command exec_a (the executable we're listing in the primary Info.plist) to launch exec_b at any time. Once the bundle is signed, however, we cannot get exec_b to launch in any capacity. Even lldb dies right away because it can't attach to anything. We assume this is something in th
8
0
187
Mar ’25
Reply to DNS Proxy network extension doesn't start even after saving preferences successfully
I suspect that the sysextd crash is a known issue that seems to be caused by a race condition in the code (r. 99777199). The nesessionmanager crash is more likely to be caused by the properties in your sysex. The crashing thread looks like this: 5 Foundation 0x191f5c120 -[NSString initWithFormat:] + 52 6 nesessionmanager 0x100138ac0 -[NESMProviderManager createSystemExtensionErrorWithCode:extensionInfo:] + 440 7 nesessionmanager 0x100139558 -[NESMProviderManager createLaunchdPlistEntriesFromExtensionBundle:extensionInfo:error:] + 2464 8 nesessionmanager 0x1001399d8 __84-[NESMProviderManager listener:validateExtension:atTemporaryBundleURL:replyHandler:]_block_invoke + 212 NE is trying to validate your sysex, that’s failed, and it’s crashed trying to generate the error O-: Both of these are obviously bugs in our OS — these subsystems should fail rather than crash — and I encourage you to file bug reports about them. Include a sysdiagnose log and a copy of your built app (the broken one, not the fixed one). Plea
Mar ’25
IdentityLookup deferQueryRequestToNetwork error 3 despite valid AASA and extension setup
I'm seeking help troubleshooting a persistent com.apple.IdentityLookup.error.messagefilter Code=3 error when my Message Filter Extension tries to defer to network. I’ve exhausted Apple documentation and forum posts, and Apple Support has asked me to escalate this via the forums to reach engineering. ✅ My Setup: Xcode: 16.2 macOS: Sequoia 15.3.1 (Apple Silicon Mac mini) Device: iPhone 14 Pro iOS: 18.3.2 (Developer Mode enabled) Tested via: TestFlight install on real device 📦 App Structure: Main App Target (minimal hello world logic) Message Filter Extension Target Messages Extension Target Message Reporting Extension Target Notifications Extension Target ✅ Capabilities & Configurations Main App Capabilities: App Groups: group.com.example.shared Network Extensions: Content Filter Associated Domains: messagefilter:my-api.example.com applinks:my-api.example.com Message Filter Capabilities: App Groups: same as main app Network Extensions: Content Filter Associated Domains: same as above 📄 Info.plist Config M
2
0
146
Mar ’25
Reply to Regarding Qt application Code signing on MACOS
Gosh, there are two separate issues tangled up here: Code signing Override TLS server trust evaluation IMO they are completely separable. Let me start with code signing. If you distribute your product widely, it must be signed: If you’re targeting the Mac App Store, you can only submit a signed app. If you’re distributing directly, you product must be signed and notarised to pass Gatekeeper. If you’re not using Xcode then see the following docs for specific advice on how to sign your product: Creating distribution-signed code for macOS Packaging Mac software for distribution Regarding TLS server trust evaluation, that’s not really related to your code signing. You wrote: [quote='777675021, Atanu, /thread/777675, /profile/Atanu'] Upon investigating this online, we got to know there has to be codesigning (both app bundle and the dmg file ) along with notarization of the .dmg file in order to access keychain of [macOS] [/quote] That’s not entirely correct. It’s true the signing your app and your disk im
Topic: Code Signing SubTopic: General
Mar ’25