Hello. I have an enterprise application that requires specific privileges to execute correctly on MacOS. One of these privileges is SystemPolicyAllFiles (aka Full Disk Access), as we use the endpoint security framework. When we distribute our application, we generate: A signed, notarized pkg consisting of our application binaries. An MDM-compatible .mobileconfig, which contains the SystemPolicyAllFiles setting. We expect our users to install both to get the application to function correctly. However, we have three environments we deploy to: Internal (local development on a developer's workstation), development (where features are integrated prior to release) and production (what our customers get). For local, our developers create an Apple account and use a Mac Development certificate for signing. They also generate their own embedded.provisionprofile and drop that into their local installation config. For development/production, we use our Developer ID certificate and Developer Installer certificate, with an
Search results for
codesign
3,113 results found
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
Error 1 in the OSSystemExtensionErrorDomain is OSSystemExtensionErrorUnknown. That doesn’t sound good. [quote='829698022, conectado, /thread/776759?answerId=829698022#829698022, /profile/conectado'] after that I don't see any of the delegate being called [/quote] And that’s also not good. System Extensions framework is meant to be called from a GUI application. Is that the case here? I see a lot of folks try to use the framework from a command-line tool (or daemon or whatever) that’s pretending to be a GUI app, and that often ends badly. Check that you’re container app has a reasonable structure and that the sysex is embedded within that: QNE2DNSProxyMac.app/ Contents/ Info.plist Library/ SystemExtensions/ com.example.apple-samplecode.QNE2DNSProxyMac.SysEx.systemextension/ Contents/ Info.plist MacOS/ com.example.apple-samplecode.QNE2DNSProxyMac.SysEx _CodeSignature/ CodeResources embedded.provisionprofile MacOS/ QNE2DNSProxyMac … _CodeSignature/ CodeResources embedded.provisionprofile Check that the app is si
Topic:
App & System Services
SubTopic:
Networking
Tags:
I’m building an Electron app for macOS that I plan to distribute to users in a .dmg outside the Mac App Store. I have a Developer ID Application certificate (from Apple’s Developer Portal) and a private key, and I can see “Developer ID Certification Authority” in my System Roots keychain. • My Developer ID Application certificate is in the login keychain, and it shows up under “My Certificates” with its private key. • On Keychain, certificate shows red message not trusted, but when I evaluate and check it specifically for codesigning it shows a green checkmark and success • Developer ID Certification Authority is in System Roots. • security find-identity -p codesigning – shows my certificate, but shows 0 valid identities • Updated operating system and deleted and recreated a new certificate, still get the same issue
The devil is in the details here. First, this: [quote='776479021, baxterjo, /thread/776479, /profile/baxterjo'] from a VScode terminal and I am getting permissions prompts. [/quote] A VS Code terminal is not Terminal. The exception carved out for Terminal doesn’t apply to other terminal-ish apps. What’ll actually happen in the VS Code case is gonna depend on how it implemented its terminal environment. It’s possible that the system will see VS Code as the responsible code for your program and thus VS Code’s Local Network privilege will apply. However, it’s also possible for programs to do things that break that responsibility chain, in which case your program will look like a tool being run in a background context. What happens then is complex. Regardless, this is something to talk about with the VS Code folks. Coming back to Terminal, that exception works as documented, at least in my experience. Consider my built copy of the TLSTool sample code: % codesign -d -vvv `which TLSTool` … Authority=Develo
Topic:
App & System Services
SubTopic:
Networking
Tags:
codesign wants too access my certain key in my keychain
Topic:
Code Signing
SubTopic:
General
Xcode is prompting I enter a codesign login password when I am archiving my project. My password seems incorrect since there is no action after I enter my password and tap allow. what could be the problem?
Topic:
Code Signing
SubTopic:
General
[quote='829245022, chipcastle, /thread/774923?answerId=829245022#829245022, /profile/chipcastle'] ran my codesigning script which signs in the following order [/quote] Step 2 is unnecessary here. Using the terms from Creating distribution-signed code for macOS, your app is bundled code. That means you only need to sign the bundle. If you sign the PATHmanager executable separately, that signature is just overwritten when you sign the PATHmanager.app. [quote='829245022, chipcastle, /thread/774923?answerId=829245022#829245022, /profile/chipcastle'] so I continue to be puzzled [/quote] That error is misleading, in that there are two potential causes: The executable is missing this entitlement. The executable’s code signature is broken, which means that App Store Connect is unable to check that the entitlement is present. I suspect you’re hitting the second case. If you unpack the installer [1] and check the app’s code signature like so: % codesign --verify -vvv PATHmanager.app what does it repor
Topic:
Code Signing
SubTopic:
General
Thanks for the suggestion. I was able to extract libui.dylib by running bundle install with the following configuration: cat ~/code/ruby/pathos_macos/.bundle/config --- BUNDLE_PATH: vendor/ BUNDLE_WITHOUT: development:test This created vendor/ruby/3.3.0/gems/libui-0.1.2-arm64-darwin/vendor/libui.dylib, which I ditto'd over to ~/Desktop/distribution/PATHmanager.app/Contents/Frameworks/libui.dylib I bumped version (as described previously) and ran my codesigning script which signs in the following order (under /Users/chip/Desktop/distribution/PATHmanager.app/): Contents/Frameworks/libui.dylib Contents/MacOS/PATHmanager PATHmanager.app directory After uploading the .pkg file using Transporter, I get this old error: Validation failed (409) App sandbox not enabled. The following executables must include the com.apple.security.app-sandbox entitlement with a Boolean value of true in the entitlements property list: [( com.chipcastle.pathmanager.pkg/Payload/PATHmanager.app/Contents/MacOS/PATHmanager )] Refer
Topic:
Code Signing
SubTopic:
General
I am experiencing an issue when publishing my .NET MAUI application for iOS using Visual Studio Code. During the publishing process, I encountered a codesign error. Hope someone can help me. This is the error: Warning: unable to build chain to self-signed root for signer Apple Distribution: SOFTBUILDER SDN. BHD. (********) /Users/frankongthuanhong/Desktop/App/MLBusinessCafe_Maui/MLBusinessCafe_Maui/bin/Release/net8.0-ios/ios-arm64/MLBusinessCafe_Maui.app: errSecInternalComponent /usr/local/share/dotnet/packs/Microsoft.iOS.Sdk.net8.0_18.0/18.0.8316/tools/msbuild/iOS/Xamarin.Shared.targets(2335,3): error : /usr/bin/codesign exited with code 1: [/Users/frankongthuanhong/Desktop/App/MLBusinessCafe_Maui/MLBusinessCafe_Maui/MLBusinessCafe_Maui.csproj::TargetFramework=net8.0-ios] /usr/local/share/dotnet/packs/Microsoft.iOS.Sdk.net8.0_18.0/18.0.8316/tools/msbuild/iOS/Xamarin.Shared.targets(2335,3): error : Warning: unable to build chain to self-signed root for signer Apple Distribution: SOFTBUILDER
I think I'm closing in on a solution. Here's what I did to get here: 1. Removed all development gems from Gemfile & bundled bundle install --without development test This removed the date gem, which was the original complaint by macOS, along with other gems (i.e., psych, rdoc, debug). 2. Created executable tebako clean && tebako press --root=/Users/chip/code/ruby/pathos_macos --entry-point=/Users/chip/code/ruby/pathos_macos/bin/pathos_macos -o ~/Desktop/pathos 3. Copied over executable to .app folder cp ~/Desktop/pathos ~/Desktop/distribution/PATHmanager.app/Contents/MacOS/PATHmanager 4. Fixed ownerships (needs further investigation) chown -R chip:staff ~/Desktop/distribution 5. Bumped version number manual file edit in Info.plist & appstore.rb (codesigning script) 6. Ran codesigning script ~/code/ruby/pathos_macos/assets/appstore.rb 7. Uploaded package via Transporter Located at (~/Desktop/PATHmanager.pkg) 8. Test with TestFlight I had to remove myself from QA/Testers on App
Topic:
Code Signing
SubTopic:
General
I'm working on an audio plugin, and when I set the target to VST3 instead of Standalone Plugin and check the Debug Executable box, I get this error: Message from debugger: attach failed (Not allowed to attach to process. Look in the console messages (Console.app), near the debugserver entries, when the attach failed. The subsystem that denied the attach permission will likely have logged an informative message about why it was denied.) I found this post, which seems to be about this same issue, and I followed the recommended solution: I made sure CODE_SIGN_INJECT_BASE_ENTITLEMENTS is true and DEPLOYMENT_POSTPROCESSING is false. I also checked the entitlements on the .app using codesign -d --entitlements, and it returned: [Key] com.apple.security.get-task-allow [Value] [Bool] true This seems like it has the proper entitlements, but it is still breaking with the above error message when I clean and build. Any ideas?
Hi folks We have a Developer ID Application which we create using electron. We made our last release for our Application on Nov'24 which was correctly working. Using the same code, we tried creating a notarized application again which started showing the following error while opening our Application. Monterey- M2- When we directly run the dmg on the dev machine, it does not give us the prompt. But if we download it from somewhere and run, the prompt comes up even in dev machine. We executed some commands to verify the notarization: 1- spctl --assess -vv /Applications/Refresh Pro.app On both dev machine and non-dev machine, the output was accepted /Applications/Refresh Pro.app: accepted source=Notarized Developer ID origin=Developer ID Application: Prograde Digital Incorporated (*******) 2- xcrun stapler validate /Applications/Refresh Pro.app On dev machine, we executed this command and the output is as follows. Processing: /Applications/Refresh Pro.app The validate action worked! 3- codesign -vvv --d
[quote='828419022, chipcastle, /thread/774923?answerId=828419022#828419022, /profile/chipcastle'] PATHmanager.app: invalid Info.plist (plist or signature have been modified) [/quote] Well, that’s not good. The most obvious cause of this problem is that your Info.plist has changed after the code was signed, which breaks the seal on the code signature. For example: % codesign -v --deep --strict QProcessDock.app % plutil -insert Greeting -string 'Hello Cruel World!' QProcessDock.app/Contents/Info.plist % codesign -v --deep --strict QProcessDock.app QProcessDock.app: invalid Info.plist (plist or signature have been modified) In architecture: arm64 It’s possible that you might see this for other reasons — like codesign being confused by whether the item you’re signing is a bundle or not — but that seems unlikely given that your bundle structure seems reasonable based on the info you’ve posted upthread. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmai
Topic:
Code Signing
SubTopic:
General
Hi Kevin We tried creating a notarized build after this fix. However, we are facing a prompt on macOS while opening our Application. Attaching screenshot. To debug this, we reverted our code to a release which was not giving us this prompt(removed the fix as well for now). We then created a notarized dmg again. With this, the prompt started showing up here as well. When we directly run the dmg in the dev machine, it does not give us the prompt. But if we download it from somewhere and run, the prompt comes up even in dev machine. We executed some commands to verify the notarization: spctl --assess -vv /Applications/Refresh Pro.app On the dev machine, the output was accepted but on other machine, it was rejected. Output as follows: /Applications/Refresh Pro.app: rejected source=Notarized Developer ID origin=Developer ID Application: Prograde Digital Incorporated (*******) xcrun stapler validate /Applications/Refresh Pro.app On dev machine, we executed this command and the output is as follows. Processing: /App
Topic:
App & System Services
SubTopic:
Core OS
Tags:
I am trying to resign a package using a script from Docebo. But I got an error when running the script error: The specified item could not be found in the keychain. So I ran security find-identity and I got a 0 Valid identity message. But I can see these certificates installed in my keychain and downloaded a brand new mobile provissioning profile. No dice... any ideas?
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles