Search results for

“codesign”

3,223 results found

Post

Replies

Boosts

Views

Activity

Reply to Xcode 11, Command CodeSign failed with a nonzero exit code
I changed the build products location from the default to project relative. This caused the Command CodeSign failed with a nonzero exit code. When I changed the build products location back to the Derived Data folder (default location for Xcode) the build had no errors. I tried to delete the build products from the new location but it did to matter. I had to use the Xcode default or it broke my project. I am using Xcode26 beta.
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Jun ’25
XPC connection consistently invalidated on app upgrade
Hi, Our project is a MacOS SwiftUI GUI application that bundles a System Network Extension, signed with a Developer ID certificate for distribution outside of the app store. The system network extension is used to write a packet tunnel provider. The signing of the app & network extension is handled by XCode (v16.0.0), we do not run codesign ourselves. We have no issues with XPC or the system network extension during normal usage, nor when the application is installed on a user's device for the first time. The problem only arises when the user upgrades the application. I have experienced this issue myself, as have our users. It's been reported on Apple Silicon macbooks running at least macOS 15.3.2. Much like the SimpleFirewall example (which we used as a reference), we use XPC for basic communication of state between the app and NE. These XPC connections stop working when the user installs a new version of the app, with OS logs from the process indicating that the connection is immediately invali
Topic: App & System Services SubTopic: Networking Tags:
5
0
423
Jun ’25
Testing MAS build locally?
I'm trying to create a package for the Mac App Store using Electron 6.1.9 and Electron builder 21.2.0. I sign the package with 3rd Party Mac Developer Application and 3rd Party Mac Developer Installer certificates and an am using a proper provisioning profile. It appears to work fine, the build is successful. But I cannot start the resulting app. It crashes immediately with this error: Exception Type: EXCCRASH (Code Signature Invalid) Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Note: EXCCORPSE_NOTIFY Termination Reason: Namespace CODESIGNING, Code 0x1 I also tried to a create VM running MacOS Catalina and install and run the app there. The result is the same. My question is how do I make sure that the MAS package is OK? How to test this package? Tools like codesign, pkgutil etc all print the expected output, the signature appears to be fine. Yet I'm still getting invalid signature error.
Topic: App Store Distribution & Marketing SubTopic: General Tags:
3
0
2.0k
Jan ’22
no valid aps-environment entitlement string found for application
Error in application:didFailToRegisterForRemoteNotificationsWithError: no valid aps-environment entitlement string found for application have tried out the below commands % codesign -d --entitlements - /path/to/your.app % security cms -D -i /path/to/your.app/embedded.mobileprovision and it seems both are working fine, Im currently developing react native app with expo and firebase for notifications this works fine when im running it via installing the app from testflight, but the issue occurs when i test in testflight or while the apple team reviewing my app My entitlements file aps-environment production
Topic: Code Signing SubTopic: Entitlements Tags:
2
0
198
Jun ’25
Flutter build fails on iOS physical device in Android Studio, works in Xcode
Hello, I'm encountering an issue when trying to build and launch a Flutter app on a physical iOS device using Android Studio. Here is the full log: `Launching lib/main.dart on （iPhone Name） in debug mode... Automatically signing iOS for device deployment using specified development team in Xcode project: （Project ID） Running Xcode build... Xcode build done. 19.7s Failed to build iOS app Could not build the precompiled application for the device. Error (Xcode): Target debug_unpack_ios failed: Exception: Failed to codesign （Project Names）/build/ios/Debug-iphoneos/Flutter.framework/Flutter with identity （identity ID）. Error launching application on （iPhone Name）.` This only happens when using Android Studio. When I build the same project using Xcode, it runs fine on the same device. Background: I accidentally deleted all Apple accounts from Xcode recently. In Keychain Access, I had three identical certificates; I deleted the older two and kept the newest one. I suspect this may be related to provisionin
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
2
0
155
Jun ’25
Creating codesigned AppleScript apps
In the past it was relatively easy to download from the developer portal both the app signing and installer signing certs so that I could sign AppleScripts from Script Editor when exporting them and when building packages in Jamf Composer. I went to set that up today and it seems things have changed in the last few years since I've had to set this up. I've been unable to sort this out and would love some help. I'm looking for a tutorial on doing this that walks someone step-by-step through the process for obtaining the certs (yes, I have dev account) and setting them up in keychain and then making use of them. Thanks!
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
1
0
181
Jun ’25
Reply to Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Fortunately this crash does not appear related to a code signing issue. Execution of Thread 6 branched to an address which just so happened to reside within the GPU Carveout memory region. The GPU Carveout memory region does not contain executable code, nor do those pages have an associated code signature. Hence the CODESIGNING termination reason. But it is better to think of this crash as a segmentation fault (EXC_BAD_ACCESS / SIGSEGV). Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNU
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’25
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING App was being idle and then the user brought an application to foreground, on being app transition observed app crash. 2025-04-23 19:16:26.795985 +0530 launchd exited with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING, ran for 1801880ms default Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNUSED SPACE AT END Termination Reason: CODESIGNING 2 Invalid Page Attached
Topic: App & System Services SubTopic: Core OS Tags:
1
0
164
Jun ’25
Integrating CryptoTokenKit with productsign
Hi all, I'm using a CryptoTokenKit (CTK) extension to perform code signing without having the private key stored on my laptop. The extension currently only supports the rsaSignatureDigestPKCS1v15SHA256 algorithm: func tokenSession(_ session: TKTokenSession, supports operation: TKTokenOperation, keyObjectID: TKToken.ObjectID, algorithm: TKTokenKeyAlgorithm) -> Bool { return algorithm.isAlgorithm(SecKeyAlgorithm.rsaSignatureDigestPKCS1v15SHA256) } This setup works perfectly with codesign, and signing completes without any issues. However, when I try to use productsign, the system correctly detects and delegates signing to my CTK extension, but it seems to always request rsaSignatureDigestPKCS1v15SHA1 instead: productsign --timestamp --sign unsigned.pkg signed.pkg productsign: using timestamp authority for signature productsign: signing product with identity Developer ID Installer: () from keychain (null) ... Error Domain=NSOSStatusErrorDomain Code=-50 algid:sign:RSA:digest-PKCS1v15:SHA1: algorithm
Topic: Privacy & Security SubTopic: General Tags:
7
0
627
Jun ’25
Reply to Cross process URL bookmark
I have a bunch of links to XPC info in my XPC Resources post. In general, I recommend that you split this problem in three: Implement XPC communication in general. Start XPC communication to a named XPC endpoint. Install the launchd job. For the first part, use the loopback approach described in TN3113 Testing and Debugging XPC Code With an Anonymous Listener. IMPORTANT While that technote assumes NSXPCConnection, this approach also works with low-level C API. It’s not yet supported by the low-level Swift API (r. 113356759). For the second part, I generally create a launchd agent and install it using launchctl. I’m not actually sure that’s the best option, but it’s one I’m familiar with. The agent property list would look something like this: % plutil -p com.example.MyProduct.MyAgent.plist { BundleProgram => /path/to/my/agent Label => com.example.MyProduct.MyAgent MachServices => { com.example.MyProduct.MyEndpointName => 1 } } One potential source of confusion here is the difference between the la
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
Jun ’25
a required plist file or resource is malformed
I am facing this error on every flutter project build. Although it runs ok. The error happens on the codesign command What do I need to fix ? I have validated that every *.plist file is ok using plutil -lint ERROR MESSAGE /usr/bin/codesign --force --sign MY_SHA_CODE --verbose /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib)` exited with status 0. The command's output was: /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib: a required plist file or resource is malformed Info.plist CFBundleDevelopmentRegion $(DEVELOPMENT_LANGUAGE) CFBundleDisplayName Flutter Application 1 CFBundleExecutable $(EXECUTABLE_NAME) CFBundleIdentifier $(PRODUCT_BUNDLE_IDENTIFIER) CFBundleInfoDictionaryVersion 6.0 CFBundleName flutter_application_1 CFBundlePackageType APPL CFBundleShortVersionString $(FLUTTER_BUILD_NAME) CFBundleSignature ???? CFBundleVersion $(FLUTTER_BUILD_NUMB
Topic: Code Signing SubTopic: General Tags:
4
0
244
May ’25
JIT entitlement for command line tool
My command line tool with a JIT entitlement is failing to run on Sequoia. 2025-05-26 14:17:09.758 E taskgated-helper[91764:3ab7036] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing DecisionRuleTool because no eligible provisioning profiles found 2025-05-26 14:17:09.758 Df amfid[576:3ab6d6b] /Users/jim/DecisionRuleTool not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 No matching profile found UserInfo={NSURL=file:///Users/jim/DecisionRuleTool, NSLocalizedDescription=No matching profile found} 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] (AppleMobileFileIntegrity) AMFI: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] mac_vnode_check_signature: /Users/jim/DecisionRuleTool: code signature validation failed fatally: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] proc 91763: load code signature error 4 for file DecisionRuleTool 2025-05-26 14:17:09.759 Df kernel[0:3ab7032] (AppleSystemPolicy) ASP: Security p
Topic: Code Signing SubTopic: Entitlements
1
0
137
May ’25
Reply to JIT entitlement for command line tool
You are heading down the wrong path here. The JIT entitlement (com.apple.security.cs.allow-jit) is unrestricted: It doesn’t need to be authorised by a provisioning profile [1]. Thus the advice in Signing a daemon with a restricted entitlement doesn’t apply. Anyone can claim this entitlement in any code. Note For more about how provisioning profiles authorise entitlement claims, see TN3125 Inside Code Signing: Provisioning Profiles. The issue here is that your tool is trying to claim other entitlements that are restricted, namely, com.apple.application-identifier and com.apple.developer.team-identifier. If you remove those, your code will run. Consider this: % codesign -s Apple Development: Quinn Quinn (7XFU7D52S4) -f -o runtime Test785697 Test785697: replacing existing signature % codesign -d -vvv --entitlements - Test785697 … CodeDirectory v=20500 size=694 flags=0x10000(runtime) … … Authority=Apple Development: Quinn Quinn (7XFU7D52S4) … no entitlements … % ./Test785697 Hello Cruel World! M
Topic: Code Signing SubTopic: Entitlements
May ’25
Reply to Run SampleEndpointApp but got Automatic signing failed
I’m glad you got it working. By way of explanation, com.apple.developer.system-extension.install is a restricted entitlement, meaning that: It must be authorised by a provisioning profile. It’s not managed, that is, you don’t need to apply to Apple to use it. Anyone can enable it from Xcode or the Developer website. In the sample the app target includes the System Extension capability in the Signing & Capabilities editor. That causes Xcode to: Sign the app to claim the entitlement. Embed a provisioning profile that authorises that claim. In my command to re-sign the app I have this: % codesign … --preserve-metadata=identifier,entitlements,flags,runtime … which should preserve the entitlement claim that Xcode added. I’m not sure why it wasn’t working in your case. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: App & System Services SubTopic: Core OS Tags:
May ’25
Reply to Xcode 11, Command CodeSign failed with a nonzero exit code
I changed the build products location from the default to project relative. This caused the Command CodeSign failed with a nonzero exit code. When I changed the build products location back to the Derived Data folder (default location for Xcode) the build had no errors. I tried to delete the build products from the new location but it did to matter. I had to use the Xcode default or it broke my project. I am using Xcode26 beta.
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
Boosts
Views
Activity
Jun ’25
Xcode 11, Command CodeSign failed with a nonzero exit code
Ever since updating (against my will) to Xcode 11, I'm getting this error when I try to build my project:Command CodeSign failed with a nonzero exit codeI've tried cleaning my project, resetting my login keychain, and restarting my computer, but I still get this error... what to do?xcode
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
26
Boosts
0
Views
62k
Activity
Sep ’23
XPC connection consistently invalidated on app upgrade
Hi, Our project is a MacOS SwiftUI GUI application that bundles a System Network Extension, signed with a Developer ID certificate for distribution outside of the app store. The system network extension is used to write a packet tunnel provider. The signing of the app & network extension is handled by XCode (v16.0.0), we do not run codesign ourselves. We have no issues with XPC or the system network extension during normal usage, nor when the application is installed on a user's device for the first time. The problem only arises when the user upgrades the application. I have experienced this issue myself, as have our users. It's been reported on Apple Silicon macbooks running at least macOS 15.3.2. Much like the SimpleFirewall example (which we used as a reference), we use XPC for basic communication of state between the app and NE. These XPC connections stop working when the user installs a new version of the app, with OS logs from the process indicating that the connection is immediately invali
Topic: App & System Services SubTopic: Networking Tags:
Replies
5
Boosts
0
Views
423
Activity
Jun ’25
Testing MAS build locally?
I'm trying to create a package for the Mac App Store using Electron 6.1.9 and Electron builder 21.2.0. I sign the package with 3rd Party Mac Developer Application and 3rd Party Mac Developer Installer certificates and an am using a proper provisioning profile. It appears to work fine, the build is successful. But I cannot start the resulting app. It crashes immediately with this error: Exception Type: EXCCRASH (Code Signature Invalid) Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Note: EXCCORPSE_NOTIFY Termination Reason: Namespace CODESIGNING, Code 0x1 I also tried to a create VM running MacOS Catalina and install and run the app there. The result is the same. My question is how do I make sure that the MAS package is OK? How to test this package? Tools like codesign, pkgutil etc all print the expected output, the signature appears to be fine. Yet I'm still getting invalid signature error.
Topic: App Store Distribution & Marketing SubTopic: General Tags:
Replies
3
Boosts
0
Views
2.0k
Activity
Jan ’22
no valid aps-environment entitlement string found for application
Error in application:didFailToRegisterForRemoteNotificationsWithError: no valid aps-environment entitlement string found for application have tried out the below commands % codesign -d --entitlements - /path/to/your.app % security cms -D -i /path/to/your.app/embedded.mobileprovision and it seems both are working fine, Im currently developing react native app with expo and firebase for notifications this works fine when im running it via installing the app from testflight, but the issue occurs when i test in testflight or while the apple team reviewing my app My entitlements file aps-environment production
Topic: Code Signing SubTopic: Entitlements Tags:
Replies
2
Boosts
0
Views
198
Activity
Jun ’25
Flutter build fails on iOS physical device in Android Studio, works in Xcode
Hello, I'm encountering an issue when trying to build and launch a Flutter app on a physical iOS device using Android Studio. Here is the full log: `Launching lib/main.dart on （iPhone Name） in debug mode... Automatically signing iOS for device deployment using specified development team in Xcode project: （Project ID） Running Xcode build... Xcode build done. 19.7s Failed to build iOS app Could not build the precompiled application for the device. Error (Xcode): Target debug_unpack_ios failed: Exception: Failed to codesign （Project Names）/build/ios/Debug-iphoneos/Flutter.framework/Flutter with identity （identity ID）. Error launching application on （iPhone Name）.` This only happens when using Android Studio. When I build the same project using Xcode, it runs fine on the same device. Background: I accidentally deleted all Apple accounts from Xcode recently. In Keychain Access, I had three identical certificates; I deleted the older two and kept the newest one. I suspect this may be related to provisionin
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
Replies
2
Boosts
0
Views
155
Activity
Jun ’25
Creating codesigned AppleScript apps
In the past it was relatively easy to download from the developer portal both the app signing and installer signing certs so that I could sign AppleScripts from Script Editor when exporting them and when building packages in Jamf Composer. I went to set that up today and it seems things have changed in the last few years since I've had to set this up. I've been unable to sort this out and would love some help. I'm looking for a tutorial on doing this that walks someone step-by-step through the process for obtaining the certs (yes, I have dev account) and setting them up in keychain and then making use of them. Thanks!
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
Replies
1
Boosts
0
Views
181
Activity
Jun ’25
Reply to Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Fortunately this crash does not appear related to a code signing issue. Execution of Thread 6 branched to an address which just so happened to reside within the GPU Carveout memory region. The GPU Carveout memory region does not contain executable code, nor do those pages have an associated code signature. Hence the CODESIGNING termination reason. But it is better to think of this crash as a segmentation fault (EXC_BAD_ACCESS / SIGSEGV). Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNU
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Jun ’25
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING App was being idle and then the user brought an application to foreground, on being app transition observed app crash. 2025-04-23 19:16:26.795985 +0530 launchd exited with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING, ran for 1801880ms default Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNUSED SPACE AT END Termination Reason: CODESIGNING 2 Invalid Page Attached
Topic: App & System Services SubTopic: Core OS Tags:
Replies
1
Boosts
0
Views
164
Activity
Jun ’25
Integrating CryptoTokenKit with productsign
Hi all, I'm using a CryptoTokenKit (CTK) extension to perform code signing without having the private key stored on my laptop. The extension currently only supports the rsaSignatureDigestPKCS1v15SHA256 algorithm: func tokenSession(_ session: TKTokenSession, supports operation: TKTokenOperation, keyObjectID: TKToken.ObjectID, algorithm: TKTokenKeyAlgorithm) -> Bool { return algorithm.isAlgorithm(SecKeyAlgorithm.rsaSignatureDigestPKCS1v15SHA256) } This setup works perfectly with codesign, and signing completes without any issues. However, when I try to use productsign, the system correctly detects and delegates signing to my CTK extension, but it seems to always request rsaSignatureDigestPKCS1v15SHA1 instead: productsign --timestamp --sign unsigned.pkg signed.pkg productsign: using timestamp authority for signature productsign: signing product with identity Developer ID Installer: () from keychain (null) ... Error Domain=NSOSStatusErrorDomain Code=-50 algid:sign:RSA:digest-PKCS1v15:SHA1: algorithm
Topic: Privacy & Security SubTopic: General Tags:
Replies
7
Boosts
0
Views
627
Activity
Jun ’25
Reply to Cross process URL bookmark
I have a bunch of links to XPC info in my XPC Resources post. In general, I recommend that you split this problem in three: Implement XPC communication in general. Start XPC communication to a named XPC endpoint. Install the launchd job. For the first part, use the loopback approach described in TN3113 Testing and Debugging XPC Code With an Anonymous Listener. IMPORTANT While that technote assumes NSXPCConnection, this approach also works with low-level C API. It’s not yet supported by the low-level Swift API (r. 113356759). For the second part, I generally create a launchd agent and install it using launchctl. I’m not actually sure that’s the best option, but it’s one I’m familiar with. The agent property list would look something like this: % plutil -p com.example.MyProduct.MyAgent.plist { BundleProgram => /path/to/my/agent Label => com.example.MyProduct.MyAgent MachServices => { com.example.MyProduct.MyEndpointName => 1 } } One potential source of confusion here is the difference between the la
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
Replies
Boosts
Views
Activity
Jun ’25
a required plist file or resource is malformed
I am facing this error on every flutter project build. Although it runs ok. The error happens on the codesign command What do I need to fix ? I have validated that every *.plist file is ok using plutil -lint ERROR MESSAGE /usr/bin/codesign --force --sign MY_SHA_CODE --verbose /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib)` exited with status 0. The command's output was: /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib: a required plist file or resource is malformed Info.plist CFBundleDevelopmentRegion $(DEVELOPMENT_LANGUAGE) CFBundleDisplayName Flutter Application 1 CFBundleExecutable $(EXECUTABLE_NAME) CFBundleIdentifier $(PRODUCT_BUNDLE_IDENTIFIER) CFBundleInfoDictionaryVersion 6.0 CFBundleName flutter_application_1 CFBundlePackageType APPL CFBundleShortVersionString $(FLUTTER_BUILD_NAME) CFBundleSignature ???? CFBundleVersion $(FLUTTER_BUILD_NUMB
Topic: Code Signing SubTopic: General Tags:
Replies
4
Boosts
0
Views
244
Activity
May ’25
JIT entitlement for command line tool
My command line tool with a JIT entitlement is failing to run on Sequoia. 2025-05-26 14:17:09.758 E taskgated-helper[91764:3ab7036] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing DecisionRuleTool because no eligible provisioning profiles found 2025-05-26 14:17:09.758 Df amfid[576:3ab6d6b] /Users/jim/DecisionRuleTool not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 No matching profile found UserInfo={NSURL=file:///Users/jim/DecisionRuleTool, NSLocalizedDescription=No matching profile found} 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] (AppleMobileFileIntegrity) AMFI: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] mac_vnode_check_signature: /Users/jim/DecisionRuleTool: code signature validation failed fatally: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] proc 91763: load code signature error 4 for file DecisionRuleTool 2025-05-26 14:17:09.759 Df kernel[0:3ab7032] (AppleSystemPolicy) ASP: Security p
Topic: Code Signing SubTopic: Entitlements
Replies
1
Boosts
0
Views
137
Activity
May ’25
Reply to JIT entitlement for command line tool
You are heading down the wrong path here. The JIT entitlement (com.apple.security.cs.allow-jit) is unrestricted: It doesn’t need to be authorised by a provisioning profile [1]. Thus the advice in Signing a daemon with a restricted entitlement doesn’t apply. Anyone can claim this entitlement in any code. Note For more about how provisioning profiles authorise entitlement claims, see TN3125 Inside Code Signing: Provisioning Profiles. The issue here is that your tool is trying to claim other entitlements that are restricted, namely, com.apple.application-identifier and com.apple.developer.team-identifier. If you remove those, your code will run. Consider this: % codesign -s Apple Development: Quinn Quinn (7XFU7D52S4) -f -o runtime Test785697 Test785697: replacing existing signature % codesign -d -vvv --entitlements - Test785697 … CodeDirectory v=20500 size=694 flags=0x10000(runtime) … … Authority=Apple Development: Quinn Quinn (7XFU7D52S4) … no entitlements … % ./Test785697 Hello Cruel World! M
Topic: Code Signing SubTopic: Entitlements
Replies
Boosts
Views
Activity
May ’25
Reply to Run SampleEndpointApp but got Automatic signing failed
I’m glad you got it working. By way of explanation, com.apple.developer.system-extension.install is a restricted entitlement, meaning that: It must be authorised by a provisioning profile. It’s not managed, that is, you don’t need to apply to Apple to use it. Anyone can enable it from Xcode or the Developer website. In the sample the app target includes the System Extension capability in the Signing & Capabilities editor. That causes Xcode to: Sign the app to claim the entitlement. Embed a provisioning profile that authorises that claim. In my command to re-sign the app I have this: % codesign … --preserve-metadata=identifier,entitlements,flags,runtime … which should preserve the entitlement claim that Xcode added. I’m not sure why it wasn’t working in your case. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
May ’25