Search results for

“codesign”

3,221 results found

Post

Replies

Boosts

Views

Activity

Flutter build fails on iOS physical device in Android Studio, works in Xcode
Hello, I'm encountering an issue when trying to build and launch a Flutter app on a physical iOS device using Android Studio. Here is the full log: `Launching lib/main.dart on （iPhone Name） in debug mode... Automatically signing iOS for device deployment using specified development team in Xcode project: （Project ID） Running Xcode build... Xcode build done. 19.7s Failed to build iOS app Could not build the precompiled application for the device. Error (Xcode): Target debug_unpack_ios failed: Exception: Failed to codesign （Project Names）/build/ios/Debug-iphoneos/Flutter.framework/Flutter with identity （identity ID）. Error launching application on （iPhone Name）.` This only happens when using Android Studio. When I build the same project using Xcode, it runs fine on the same device. Background: I accidentally deleted all Apple accounts from Xcode recently. In Keychain Access, I had three identical certificates; I deleted the older two and kept the newest one. I suspect this may be related to provisionin
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
2
0
155
Jun ’25
Autogenerated UI Test Runner Blocked By Local Network Permission Prompt
I've recently updated one of our CI mac mini's to Sequoia in preparation for the transition to Tahoe later this year. Most things seemed to work just fine, however I see this dialog whenever the UI Tests try to run. This application BoostBrowerUITest-Runner is auto-generated by Xcode to launch your application and then run your UI Tests. We do not have any control over it, which is why this is most surprising. I've checked the codesigning identity with codesign -d -vvvv as well as looked at it's Info.plist and indeed the usage descriptions for everything are present (again, this is autogenerated, so I'm not surprised, but just wanted to confirm the string from the dialog was coming from this app) <?xml version=1.0 encoding=UTF-8?> <!DOCTYPE plist PUBLIC -//Apple//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd> <plist version=1.0> <dict> <key>BuildMachineOSBuild</key> <string>22A380021</string> <key>CFBundleAllowMixedLoca
Topic: App & System Services SubTopic: Networking Tags:
10
0
726
Jun ’25
unable to build chain to self-signed root for signer
Having reviewed every document, this has been going on for nearly two months. Originally, it was thought that the problem might be related to the fact I had created the developer ID signing certificate on an intel mac, and trying to import and use it on an M1 Mac-Mini. That turned out to not be the case. Completely started over with a new account (the company changed names), requested and was granted the entitlements we needed. Create a new CSR from this new m1 machine, created a Developer ID certificate, installed the certificate on this machine. But no matter what, the codesign fails. Troubleshooting Environment: Brand new Apple Developer account and Developer ID Application certificate (generated CSR on this Mac, installed cert and private key in login keychain) macOS build/signing machine, not running codesign as root Working from Terminal app in GUI session, not via SSH/cron Keychain & Certificate Chain: Verified Developer ID Application: Fidelis Security LLC (J4WGF5B6KZ) certificat
Topic: Code Signing SubTopic: General Tags:
9
0
473
Jun ’25
Creating codesigned AppleScript apps
In the past it was relatively easy to download from the developer portal both the app signing and installer signing certs so that I could sign AppleScripts from Script Editor when exporting them and when building packages in Jamf Composer. I went to set that up today and it seems things have changed in the last few years since I've had to set this up. I've been unable to sort this out and would love some help. I'm looking for a tutorial on doing this that walks someone step-by-step through the process for obtaining the certs (yes, I have dev account) and setting them up in keychain and then making use of them. Thanks!
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
1
0
181
Jun ’25
Reply to Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Fortunately this crash does not appear related to a code signing issue. Execution of Thread 6 branched to an address which just so happened to reside within the GPU Carveout memory region. The GPU Carveout memory region does not contain executable code, nor do those pages have an associated code signature. Hence the CODESIGNING termination reason. But it is better to think of this crash as a segmentation fault (EXC_BAD_ACCESS / SIGSEGV). Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNU
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’25
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING App was being idle and then the user brought an application to foreground, on being app transition observed app crash. 2025-04-23 19:16:26.795985 +0530 launchd exited with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING, ran for 1801880ms default Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNUSED SPACE AT END Termination Reason: CODESIGNING 2 Invalid Page Attached
Topic: App & System Services SubTopic: Core OS Tags:
1
0
164
Jun ’25
no valid aps-environment entitlement string found for application
Error in application:didFailToRegisterForRemoteNotificationsWithError: no valid aps-environment entitlement string found for application have tried out the below commands % codesign -d --entitlements - /path/to/your.app % security cms -D -i /path/to/your.app/embedded.mobileprovision and it seems both are working fine, Im currently developing react native app with expo and firebase for notifications this works fine when im running it via installing the app from testflight, but the issue occurs when i test in testflight or while the apple team reviewing my app My entitlements file aps-environment production
Topic: Code Signing SubTopic: Entitlements Tags:
2
0
198
Jun ’25
Reply to Cross process URL bookmark
I have a bunch of links to XPC info in my XPC Resources post. In general, I recommend that you split this problem in three: Implement XPC communication in general. Start XPC communication to a named XPC endpoint. Install the launchd job. For the first part, use the loopback approach described in TN3113 Testing and Debugging XPC Code With an Anonymous Listener. IMPORTANT While that technote assumes NSXPCConnection, this approach also works with low-level C API. It’s not yet supported by the low-level Swift API (r. 113356759). For the second part, I generally create a launchd agent and install it using launchctl. I’m not actually sure that’s the best option, but it’s one I’m familiar with. The agent property list would look something like this: % plutil -p com.example.MyProduct.MyAgent.plist { BundleProgram => /path/to/my/agent Label => com.example.MyProduct.MyAgent MachServices => { com.example.MyProduct.MyEndpointName => 1 } } One potential source of confusion here is the difference between the la
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
Jun ’25
WeatherKit JWT fails (WDSJWTAuthenticatorServiceListener Code 2) despite entitlement
I’m hitting a WeatherKit JWT failure (WDSJWTAuthenticatorServiceListener Code = 2) at runtime even though the entitlement is present in both the signed binary and the embedded provisioning profile. Environment Team ID 5SZLQLQ9MD Bundle ID ParkProfessor.ParkProfessorDisneyland Device / OS iPhone 15 Pro · iOS 17.4.1 (hardware, not simulator) Xcode 15.3 (15E204a) Console output Failed to generate jwt token for: com.apple.weatherkit.authservice Error Domain=WeatherDaemon.WDSJWTAuthenticatorServiceListener.Errors Code=2 (null) Entitlement & profile snippets codesign -d --entitlements :- WeatherKitTest.app | grep -A2 weatherkit com.apple.developer.weatherkit security cms -D -i embedded.mobileprovision | grep -A2 weatherkit com.apple.developer.weatherkit What I’ve already tried Regenerated a new development certificate and a new iOS App Development provisioning profile with WeatherKit enabled. Confirmed the capability is selected in Certificates ▸ Identifiers ▸ Profiles and added in Xcode target setting
Topic: App & System Services SubTopic: General Tags:
4
0
293
May ’25
a required plist file or resource is malformed
I am facing this error on every flutter project build. Although it runs ok. The error happens on the codesign command What do I need to fix ? I have validated that every *.plist file is ok using plutil -lint ERROR MESSAGE /usr/bin/codesign --force --sign MY_SHA_CODE --verbose /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib)` exited with status 0. The command's output was: /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib: a required plist file or resource is malformed Info.plist CFBundleDevelopmentRegion $(DEVELOPMENT_LANGUAGE) CFBundleDisplayName Flutter Application 1 CFBundleExecutable $(EXECUTABLE_NAME) CFBundleIdentifier $(PRODUCT_BUNDLE_IDENTIFIER) CFBundleInfoDictionaryVersion 6.0 CFBundleName flutter_application_1 CFBundlePackageType APPL CFBundleShortVersionString $(FLUTTER_BUILD_NAME) CFBundleSignature ???? CFBundleVersion $(FLUTTER_BUILD_NUMB
Topic: Code Signing SubTopic: General Tags:
4
0
244
May ’25
Reply to JIT entitlement for command line tool
You are heading down the wrong path here. The JIT entitlement (com.apple.security.cs.allow-jit) is unrestricted: It doesn’t need to be authorised by a provisioning profile [1]. Thus the advice in Signing a daemon with a restricted entitlement doesn’t apply. Anyone can claim this entitlement in any code. Note For more about how provisioning profiles authorise entitlement claims, see TN3125 Inside Code Signing: Provisioning Profiles. The issue here is that your tool is trying to claim other entitlements that are restricted, namely, com.apple.application-identifier and com.apple.developer.team-identifier. If you remove those, your code will run. Consider this: % codesign -s Apple Development: Quinn Quinn (7XFU7D52S4) -f -o runtime Test785697 Test785697: replacing existing signature % codesign -d -vvv --entitlements - Test785697 … CodeDirectory v=20500 size=694 flags=0x10000(runtime) … … Authority=Apple Development: Quinn Quinn (7XFU7D52S4) … no entitlements … % ./Test785697 Hello Cruel World! M
Topic: Code Signing SubTopic: Entitlements
May ’25
JIT entitlement for command line tool
My command line tool with a JIT entitlement is failing to run on Sequoia. 2025-05-26 14:17:09.758 E taskgated-helper[91764:3ab7036] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing DecisionRuleTool because no eligible provisioning profiles found 2025-05-26 14:17:09.758 Df amfid[576:3ab6d6b] /Users/jim/DecisionRuleTool not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 No matching profile found UserInfo={NSURL=file:///Users/jim/DecisionRuleTool, NSLocalizedDescription=No matching profile found} 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] (AppleMobileFileIntegrity) AMFI: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] mac_vnode_check_signature: /Users/jim/DecisionRuleTool: code signature validation failed fatally: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] proc 91763: load code signature error 4 for file DecisionRuleTool 2025-05-26 14:17:09.759 Df kernel[0:3ab7032] (AppleSystemPolicy) ASP: Security p
Topic: Code Signing SubTopic: Entitlements
1
0
137
May ’25
Reply to Run SampleEndpointApp but got Automatic signing failed
I’m glad you got it working. By way of explanation, com.apple.developer.system-extension.install is a restricted entitlement, meaning that: It must be authorised by a provisioning profile. It’s not managed, that is, you don’t need to apply to Apple to use it. Anyone can enable it from Xcode or the Developer website. In the sample the app target includes the System Extension capability in the Signing & Capabilities editor. That causes Xcode to: Sign the app to claim the entitlement. Embed a provisioning profile that authorises that claim. In my command to re-sign the app I have this: % codesign … --preserve-metadata=identifier,entitlements,flags,runtime … which should preserve the entitlement claim that Xcode added. I’m not sure why it wasn’t working in your case. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: App & System Services SubTopic: Core OS Tags:
May ’25
Reply to Binary Signing Error
Just to be clear, frameworks don’t need a provisioning profile. The purpose of a profile is to authorise the execution of code. You can’t execute a framework directly — it’s always run as part of a process that was started from some executable — and thus there’s never a need for it to have a profile. Or entitlements for that matter. We talk about this in gory detail in TN3125 Inside Code Signing: Provisioning Profiles. As to what’s going wrong here, it’s hard to say without more details. Let’s start at the end and work backwards. My understanding is that you’re hitting this error when you attempt to submit (or validate) an App Store submission using the Xcode organiser. Is that right? If so, is that for your iOS app? If so, please run through the Distribute App > Custom > App Store > Export workflow. That should succeed and produce a .ipa. Unpack the .ipa file (it’s a zip archive under the covers) and then look at the built app. What do you get back from the following? % codesign -d -vvv --e
Topic: Code Signing SubTopic: General Tags:
May ’25
Reply to "Command CodeSign failed with a nonzero exit code" I got this error
My issue was different than the others above and I've run into it a couple times over the years. During CI automation we run fastlane and ran into this mysterious Command CodeSign failed with a nonzero exit code. Both times the fix was to manually start up Xcode start building and then there would be a CodeSign pop up asking for credentials. It only occurs when setting up a new machine.
Topic: Developer Tools & Services SubTopic: Xcode Tags:
May ’25
Flutter build fails on iOS physical device in Android Studio, works in Xcode
Hello, I'm encountering an issue when trying to build and launch a Flutter app on a physical iOS device using Android Studio. Here is the full log: `Launching lib/main.dart on （iPhone Name） in debug mode... Automatically signing iOS for device deployment using specified development team in Xcode project: （Project ID） Running Xcode build... Xcode build done. 19.7s Failed to build iOS app Could not build the precompiled application for the device. Error (Xcode): Target debug_unpack_ios failed: Exception: Failed to codesign （Project Names）/build/ios/Debug-iphoneos/Flutter.framework/Flutter with identity （identity ID）. Error launching application on （iPhone Name）.` This only happens when using Android Studio. When I build the same project using Xcode, it runs fine on the same device. Background: I accidentally deleted all Apple accounts from Xcode recently. In Keychain Access, I had three identical certificates; I deleted the older two and kept the newest one. I suspect this may be related to provisionin
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
Replies
2
Boosts
0
Views
155
Activity
Jun ’25
Autogenerated UI Test Runner Blocked By Local Network Permission Prompt
I've recently updated one of our CI mac mini's to Sequoia in preparation for the transition to Tahoe later this year. Most things seemed to work just fine, however I see this dialog whenever the UI Tests try to run. This application BoostBrowerUITest-Runner is auto-generated by Xcode to launch your application and then run your UI Tests. We do not have any control over it, which is why this is most surprising. I've checked the codesigning identity with codesign -d -vvvv as well as looked at it's Info.plist and indeed the usage descriptions for everything are present (again, this is autogenerated, so I'm not surprised, but just wanted to confirm the string from the dialog was coming from this app) <?xml version=1.0 encoding=UTF-8?> <!DOCTYPE plist PUBLIC -//Apple//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd> <plist version=1.0> <dict> <key>BuildMachineOSBuild</key> <string>22A380021</string> <key>CFBundleAllowMixedLoca
Topic: App & System Services SubTopic: Networking Tags:
Replies
10
Boosts
0
Views
726
Activity
Jun ’25
unable to build chain to self-signed root for signer
Having reviewed every document, this has been going on for nearly two months. Originally, it was thought that the problem might be related to the fact I had created the developer ID signing certificate on an intel mac, and trying to import and use it on an M1 Mac-Mini. That turned out to not be the case. Completely started over with a new account (the company changed names), requested and was granted the entitlements we needed. Create a new CSR from this new m1 machine, created a Developer ID certificate, installed the certificate on this machine. But no matter what, the codesign fails. Troubleshooting Environment: Brand new Apple Developer account and Developer ID Application certificate (generated CSR on this Mac, installed cert and private key in login keychain) macOS build/signing machine, not running codesign as root Working from Terminal app in GUI session, not via SSH/cron Keychain & Certificate Chain: Verified Developer ID Application: Fidelis Security LLC (J4WGF5B6KZ) certificat
Topic: Code Signing SubTopic: General Tags:
Replies
9
Boosts
0
Views
473
Activity
Jun ’25
Creating codesigned AppleScript apps
In the past it was relatively easy to download from the developer portal both the app signing and installer signing certs so that I could sign AppleScripts from Script Editor when exporting them and when building packages in Jamf Composer. I went to set that up today and it seems things have changed in the last few years since I've had to set this up. I've been unable to sort this out and would love some help. I'm looking for a tutorial on doing this that walks someone step-by-step through the process for obtaining the certs (yes, I have dev account) and setting them up in keychain and then making use of them. Thanks!
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
Replies
1
Boosts
0
Views
181
Activity
Jun ’25
Reply to Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Fortunately this crash does not appear related to a code signing issue. Execution of Thread 6 branched to an address which just so happened to reside within the GPU Carveout memory region. The GPU Carveout memory region does not contain executable code, nor do those pages have an associated code signature. Hence the CODESIGNING termination reason. But it is better to think of this crash as a segmentation fault (EXC_BAD_ACCESS / SIGSEGV). Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNU
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Jun ’25
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING
Crash observed on brought app to foreground with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING App was being idle and then the user brought an application to foreground, on being app transition observed app crash. 2025-04-23 19:16:26.795985 +0530 launchd exited with exit reason (namespace: 3 code: 0x2) - OS_REASON_CODESIGNING, ran for 1801880ms default Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000006d6f632e74 Exception Codes: 0x0000000000000002, 0x0000006d6f632e74 VM Region Info: 0x6d6f632e74 is in 0x1000000000-0x7000000000; bytes after start: 401300729460 bytes before end: 11016130955 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL commpage (reserved) fc0000000-1000000000 [ 1.0G] ---/--- SM=NUL reserved VM address space (unallocated) ---> GPU Carveout (reserved) 1000000000-7000000000 [384.0G] ---/--- SM=NUL reserved VM address space (unallocated) UNUSED SPACE AT END Termination Reason: CODESIGNING 2 Invalid Page Attached
Topic: App & System Services SubTopic: Core OS Tags:
Replies
1
Boosts
0
Views
164
Activity
Jun ’25
no valid aps-environment entitlement string found for application
Error in application:didFailToRegisterForRemoteNotificationsWithError: no valid aps-environment entitlement string found for application have tried out the below commands % codesign -d --entitlements - /path/to/your.app % security cms -D -i /path/to/your.app/embedded.mobileprovision and it seems both are working fine, Im currently developing react native app with expo and firebase for notifications this works fine when im running it via installing the app from testflight, but the issue occurs when i test in testflight or while the apple team reviewing my app My entitlements file aps-environment production
Topic: Code Signing SubTopic: Entitlements Tags:
Replies
2
Boosts
0
Views
198
Activity
Jun ’25
Reply to Cross process URL bookmark
I have a bunch of links to XPC info in my XPC Resources post. In general, I recommend that you split this problem in three: Implement XPC communication in general. Start XPC communication to a named XPC endpoint. Install the launchd job. For the first part, use the loopback approach described in TN3113 Testing and Debugging XPC Code With an Anonymous Listener. IMPORTANT While that technote assumes NSXPCConnection, this approach also works with low-level C API. It’s not yet supported by the low-level Swift API (r. 113356759). For the second part, I generally create a launchd agent and install it using launchctl. I’m not actually sure that’s the best option, but it’s one I’m familiar with. The agent property list would look something like this: % plutil -p com.example.MyProduct.MyAgent.plist { BundleProgram => /path/to/my/agent Label => com.example.MyProduct.MyAgent MachServices => { com.example.MyProduct.MyEndpointName => 1 } } One potential source of confusion here is the difference between the la
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
Replies
Boosts
Views
Activity
Jun ’25
WeatherKit JWT fails (WDSJWTAuthenticatorServiceListener Code 2) despite entitlement
I’m hitting a WeatherKit JWT failure (WDSJWTAuthenticatorServiceListener Code = 2) at runtime even though the entitlement is present in both the signed binary and the embedded provisioning profile. Environment Team ID 5SZLQLQ9MD Bundle ID ParkProfessor.ParkProfessorDisneyland Device / OS iPhone 15 Pro · iOS 17.4.1 (hardware, not simulator) Xcode 15.3 (15E204a) Console output Failed to generate jwt token for: com.apple.weatherkit.authservice Error Domain=WeatherDaemon.WDSJWTAuthenticatorServiceListener.Errors Code=2 (null) Entitlement & profile snippets codesign -d --entitlements :- WeatherKitTest.app | grep -A2 weatherkit com.apple.developer.weatherkit security cms -D -i embedded.mobileprovision | grep -A2 weatherkit com.apple.developer.weatherkit What I’ve already tried Regenerated a new development certificate and a new iOS App Development provisioning profile with WeatherKit enabled. Confirmed the capability is selected in Certificates ▸ Identifiers ▸ Profiles and added in Xcode target setting
Topic: App & System Services SubTopic: General Tags:
Replies
4
Boosts
0
Views
293
Activity
May ’25
a required plist file or resource is malformed
I am facing this error on every flutter project build. Although it runs ok. The error happens on the codesign command What do I need to fix ? I have validated that every *.plist file is ok using plutil -lint ERROR MESSAGE /usr/bin/codesign --force --sign MY_SHA_CODE --verbose /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib)` exited with status 0. The command's output was: /Users/macbookair/workspace/flutter_application_1/build/ios/Release-iphoneos/Runner.app/Frameworks/libswiftCore.dylib: a required plist file or resource is malformed Info.plist CFBundleDevelopmentRegion $(DEVELOPMENT_LANGUAGE) CFBundleDisplayName Flutter Application 1 CFBundleExecutable $(EXECUTABLE_NAME) CFBundleIdentifier $(PRODUCT_BUNDLE_IDENTIFIER) CFBundleInfoDictionaryVersion 6.0 CFBundleName flutter_application_1 CFBundlePackageType APPL CFBundleShortVersionString $(FLUTTER_BUILD_NAME) CFBundleSignature ???? CFBundleVersion $(FLUTTER_BUILD_NUMB
Topic: Code Signing SubTopic: General Tags:
Replies
4
Boosts
0
Views
244
Activity
May ’25
Reply to JIT entitlement for command line tool
You are heading down the wrong path here. The JIT entitlement (com.apple.security.cs.allow-jit) is unrestricted: It doesn’t need to be authorised by a provisioning profile [1]. Thus the advice in Signing a daemon with a restricted entitlement doesn’t apply. Anyone can claim this entitlement in any code. Note For more about how provisioning profiles authorise entitlement claims, see TN3125 Inside Code Signing: Provisioning Profiles. The issue here is that your tool is trying to claim other entitlements that are restricted, namely, com.apple.application-identifier and com.apple.developer.team-identifier. If you remove those, your code will run. Consider this: % codesign -s Apple Development: Quinn Quinn (7XFU7D52S4) -f -o runtime Test785697 Test785697: replacing existing signature % codesign -d -vvv --entitlements - Test785697 … CodeDirectory v=20500 size=694 flags=0x10000(runtime) … … Authority=Apple Development: Quinn Quinn (7XFU7D52S4) … no entitlements … % ./Test785697 Hello Cruel World! M
Topic: Code Signing SubTopic: Entitlements
Replies
Boosts
Views
Activity
May ’25
JIT entitlement for command line tool
My command line tool with a JIT entitlement is failing to run on Sequoia. 2025-05-26 14:17:09.758 E taskgated-helper[91764:3ab7036] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing DecisionRuleTool because no eligible provisioning profiles found 2025-05-26 14:17:09.758 Df amfid[576:3ab6d6b] /Users/jim/DecisionRuleTool not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 No matching profile found UserInfo={NSURL=file:///Users/jim/DecisionRuleTool, NSLocalizedDescription=No matching profile found} 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] (AppleMobileFileIntegrity) AMFI: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] mac_vnode_check_signature: /Users/jim/DecisionRuleTool: code signature validation failed fatally: When validating /Users/jim/DecisionRuleTool: 2025-05-26 14:17:09.759 Df kernel[0:3ab7031] proc 91763: load code signature error 4 for file DecisionRuleTool 2025-05-26 14:17:09.759 Df kernel[0:3ab7032] (AppleSystemPolicy) ASP: Security p
Topic: Code Signing SubTopic: Entitlements
Replies
1
Boosts
0
Views
137
Activity
May ’25
Reply to Run SampleEndpointApp but got Automatic signing failed
I’m glad you got it working. By way of explanation, com.apple.developer.system-extension.install is a restricted entitlement, meaning that: It must be authorised by a provisioning profile. It’s not managed, that is, you don’t need to apply to Apple to use it. Anyone can enable it from Xcode or the Developer website. In the sample the app target includes the System Extension capability in the Signing & Capabilities editor. That causes Xcode to: Sign the app to claim the entitlement. Embed a provisioning profile that authorises that claim. In my command to re-sign the app I have this: % codesign … --preserve-metadata=identifier,entitlements,flags,runtime … which should preserve the entitlement claim that Xcode added. I’m not sure why it wasn’t working in your case. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
May ’25
Reply to Binary Signing Error
Just to be clear, frameworks don’t need a provisioning profile. The purpose of a profile is to authorise the execution of code. You can’t execute a framework directly — it’s always run as part of a process that was started from some executable — and thus there’s never a need for it to have a profile. Or entitlements for that matter. We talk about this in gory detail in TN3125 Inside Code Signing: Provisioning Profiles. As to what’s going wrong here, it’s hard to say without more details. Let’s start at the end and work backwards. My understanding is that you’re hitting this error when you attempt to submit (or validate) an App Store submission using the Xcode organiser. Is that right? If so, is that for your iOS app? If so, please run through the Distribute App > Custom > App Store > Export workflow. That should succeed and produce a .ipa. Unpack the .ipa file (it’s a zip archive under the covers) and then look at the built app. What do you get back from the following? % codesign -d -vvv --e
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
May ’25
Reply to "Command CodeSign failed with a nonzero exit code" I got this error
My issue was different than the others above and I've run into it a couple times over the years. During CI automation we run fastlane and ran into this mysterious Command CodeSign failed with a nonzero exit code. Both times the fix was to manually start up Xcode start building and then there would be a CodeSign pop up asking for credentials. It only occurs when setting up a new machine.
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
Boosts
Views
Activity
May ’25