I've recently upgraded to the RC candidates of macOS 26 and Xcode 26. The app I'm building has a helper tool using SMAppService. When I run the app and helper tool in macOS 15 or macOS 26, all works as expected. When it runs on macOS 13 or 14, which previously worked. The helper now crashes on launch with the following reason: Termination Reason: CODESIGNING 4 Launch Constraint Violation I found this developer session which seems to address this, but the plist I've added doesn't seem to satisfy the constraint. https://developer.apple.com/videos/play/wwdc2023/10266/ Here are the contents of my new plist: Are there any gotchas here that I might be missing? Thanks!
Search results for
codesign
3,110 results found
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
[quote='859354022, DTS Engineer, /thread/801222?answerId=859354022#859354022'] Activating components embedded in your own bundle means that codesigning validation ensures that your daemon can't be altered. [/quote] Right. More specifically, once Gatekeeper has checked your app it becomes subject to app bundle protection. Trusted Execution Resources has a link to the WWDC talk that explains that. Its not a coincidence that app bundle protection was introduced in macOS 13, which is the very same release that introduced SMAppService. [quote='859354022, DTS Engineer, /thread/801222?answerId=859354022#859354022'] That means using XPC to validate the connection itself … [/quote] For advice on that specifically, see the Validating Signature Of XPC Process link in XPC Resources. RZillmer, if you’re looking to move away from SMJobBless, you should check out my Getting Started with SMAppService post. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + appl
Topic:
App & System Services
SubTopic:
Processes & Concurrency
Tags:
I tried building a macOS app with Electron, but I ran into problems during notarization. I used notarytool to upload my DMG and got status: Invalid. xcrun notarytool log output { logFormatVersion: 1, jobId: 680bf475-a5f4-4675-9083-aa755d492b18, status: Invalid, statusSummary: Archive contains critical validation errors, statusCode: 4000, archiveFilename: BODYPARK-v3.6.0-mac.app.zip, uploadDate: 2025-09-25T02:50:41.523Z, sha256: e61074b9bba6d03696f2d8b0b13870daafc283960e61ab5002d688e4e82ef6f6, ticketContents: null, issues: [ { severity: error, code: null, path: BODYPARK-v3.6.0-mac.app.zip/BODYPARK-v3.6.0-mac.app/Contents/Resources/plugin/XMagic/mac/libpag.framework/libpag, message: The signature of the binary is invalid., docUrl: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735, architecture: x86_64 }, { severity: error, code: null, path: BODYPARK-v3.6.0-mac.app.zip/BODYPARK-v3.6.0-mac.app/Contents/Resources/plugin/XMa
I have two certificates in my Accounts>Manage Certificates section. One is active, the other is greyed out with a status of Not in Keychain. I only have ONE certificate in the developer account online. Timeline: Had an issue with fastlane codesigning and was trying to resolve that. In that attempt I deleted my related Certificates from my keychain Xcode showed them as disabled (greyed out) and not in Keychain. Look up how to resolve, need to revoke certificates in Developer account online. I go and revoke those certificates. Nothing changes I create new certificate and try to add it to xcode>account>certificate managment>Apple Development. Get an error saying I can't add a new can't do that because a certificate is already pending. I waited a day because I assumed like somethings with apple, updates are not immediate. I come back the next day and am able to add a new certificate. However, the previous one that is greyed out and reads Not in Keychain under Status, is still there. How do I
I'm seeking help troubleshooting a persistent com.apple.IdentityLookup.error.messagefilter Code=3 error when my Message Filter Extension tries to defer to network. I’ve exhausted Apple documentation and forum posts, and Apple Support has asked me to escalate this via the forums to reach engineering. ✅ My Setup: Xcode: 16.2 macOS: Sequoia 15.3.1 (Apple Silicon Mac mini) Device: iPhone 14 Pro iOS: 18.3.2 (Developer Mode enabled) Tested via: TestFlight install on real device 📦 App Structure: Main App Target (minimal hello world logic) Message Filter Extension Target Messages Extension Target Message Reporting Extension Target Notifications Extension Target ✅ Capabilities & Configurations Main App Capabilities: App Groups: group.com.example.shared Network Extensions: Content Filter Associated Domains: messagefilter:my-api.example.com applinks:my-api.example.com Message Filter Capabilities: App Groups: same as main app Network Extensions: Content Filter Associated Domains: same as above 📄 Info.plist Config M
Exact Error: Provisioning profile iOS Team Provisioning Profile: com.huiwan.Ohra-Journal doesn't include the BGTaskSchedulerPermittedIdentifiers entitlement. So, the issue here is that the way Xcode describes codesign error is with the assumption that your local configuration (meaning, your Entitlement plist) is correct and the provisioning profile is wrong, so you need to add something to your profile. In this case, the solution is the reverse of that— instead of modifying your profile, what you actually need to do is delete BGTaskSchedulerPermittedIdentifiers from your entitlement plist. Expanding on that point here: Despite all these correct local settings, the provisioning profile automatically generated by Xcode is consistently missing the required entitlement. Nothing in the BackgroundTask framework requires any entitlement. The only configuration required is the Info.plist configuration. Finally, on this point: Despite all these correct local settings, the provisioning profile automatically ge
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
You’re relying on framework versions? Actually, no — that’s just how Chromium organizes its build. Is the local network call being made by the process running your app’s main executable? Or by, perhaps, a helper tool embedded in this framework? Chromium does network request out of Main process, in helper process in framework. /Applications/Comet Dev.app/Contents/Frameworks/Comet Dev Framework.framework/Versions/140.0.7339.20748/Helpers/Comet Dev Helper.app/Contents/MacOS/Comet Dev Helper --type=utility Here I prepared two videos with demos: Usually it is easy reproducible when open Google meet… Here I run a regular build with local network permissions, mount the new build, run rsync, and catch the issue: https://www.loom.com/share/0e1dcafdf6c645e9a34087e36414bc78 As an experiment, I also prepared two builds with a static UUID for each Mach-0 generated by my patched LLD (UUID based on hash of the filename): https://www.loom.com/share/d48b6365a4154a3ba8da8f921ad445ca In this case I cannot reproduce the issue —
Topic:
App & System Services
SubTopic:
Networking
Tags:
Ah, yes, Chrom{e,ium}. There’s definitely something weird going on there, but I’ve yet to see a definitive answer as to what it is. It certainly isn’t as simple as ‘local network using build UUIDs for everything’, because if that were the case then all apps would lose their local network privacy privilege after every update. However, it’s also true that the network subsystem uses build UUIDs in ways that I’m not super happy with. [quote='859253022, poluyanov, /thread/800879?answerId=859253022#859253022, /profile/poluyanov'] a new …/Versions/A.B.C.D folder with the updated version is added [/quote] Wha? You’re relying on framework versions? That is… well… not what I’d do. That’s not been best practice for a long time, and our docs are now clear about that. Is the local network call being made by the process running your app’s main executable? Or by, perhaps, a helper tool embedded in this framework? Is this issue causing grief for your users? Or only during development? After reproducing the problem, what does
Topic:
App & System Services
SubTopic:
Networking
Tags:
Our app has an old codebase, originating in 2011, which started out as purely Objective-C (and a little bit of Objective-C++), but a good amount of Swift has been added over time as well. Lots of Objective-C and Swift inter-op, but in general very few 3rd party libraries/frameworks. Like many other codebases of this size and age, we have a good amount of accumulated tech debt. In our case, that mostly comes in the form of using old/deprecated APIs (OpenGL primary amongst them), and also using some ‘tricks’ that allowed us to do highly customized UI popups and the like before they were officially supported by iOS, but unfortunately are still in use to this day (i.e. adding views directly to the UIWindow such that that are ‘on top’ of everything, instead of presenting a VC). Overall though, the app is very powerful and capable, and generally has a relatively low crash rate. About two months ago, we started seeing some new crashes that seemed to be totally unrelated to the code changes that were made at the time
i have the same issue too, xcode safari unable to launch, when open will report error : Exception Type: EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid)) Exception Subtype: UNKNOWN_0x32 at 0x000000011c816ca8 Exception Codes: 0x0000000000000032, 0x000000011c816ca8 Termination Reason: Namespace CODESIGNING, Code 2, Invalid Page
Topic:
Developer Tools & Services
SubTopic:
Xcode
Tags:
Thanks for bringing this to the forums. This is a weird one, and I’m glad to be able to answer it in public. [quote='801478021, dkocher, /thread/801478, /profile/dkocher'] The designated codesign requirement on the XPC connection is set to … [/quote] The most likely cause of this issue is a quoting problem. Consider this: % cat ok.txt anchor apple generic and certificate leaf[subject.OU] = SKMME9E2Y8 % csreq -r ok.txt -t anchor apple generic and certificate leaf[subject.OU] = SKMME9E2Y8 % cat ng.txt anchor apple generic and certificate leaf[subject.OU] = 1KMME9E2Y8 % csreq -r ng.txt -t error: invalid or corrupted code requirement(s) Requirement syntax error(s): line 1:55: unexpected token: = line 1:57: expecting EOF, found '1' The only difference between ok.txt and ng.txt is that the Team ID starts with a digit. That throws off the requirements parser, resulting in wacky errors. When you use it with NSXPCConnection the error occurs at a point where it’s very hard to propagate, and thus you trap. The
Topic:
App & System Services
SubTopic:
Processes & Concurrency
Tags:
We have an application that sets a code signing requirement on a XPC connection between a File Provider extension and the main application. Only with a specific Developer ID certificate that designated requirement is not accepted and the application crashes with EXC_CRASH (SIGABRT) and the stacktrace Thread 1 Crashed:: Dispatch queue: com.apple.root.default-qos 0 libsystem_kernel.dylib 0x19b556388 __pthread_kill + 8 1 libsystem_pthread.dylib 0x19b58f88c pthread_kill + 296 2 libsystem_c.dylib 0x19b498a3c abort + 124 3 libc++abi.dylib 0x19b545384 abort_message + 132 4 libc++abi.dylib 0x19b533cf4 demangling_terminate_handler() + 344 5 libobjc.A.dylib 0x19b1b8dd4 _objc_terminate() + 156 6 libc++abi.dylib 0x19b544698 std::__terminate(void (*)()) + 16 7 libc++abi.dylib 0x19b547c30 __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) + 88 8 libc++abi.dylib 0x19b547bd8 __cxa_throw + 92 9 libobjc.A.dylib 0x19b1aecf8 objc_exception_throw + 448 10 Foundation 0x19d5c3840 -[NSXPCConnection setCodeSigningRequirement:] +
I've seen the suggestion in the documentation to use SMAppService, but couldn't find a good implementation covering security aspects. In terms of installation security, this is largely handled by SMAppService itself. Activating components embedded in your own bundle means that codesigning validation ensures that your daemon can't be altered. In terms of runtime validation, the techniques for that are basically the same as what's shown in EvenBetterAuthorization. That means using XPC to validate the connection itself and the authorization system to confirm user intent. __ Kevin Elliott DTS Engineer, CoreOS/Hardware
Topic:
App & System Services
SubTopic:
Processes & Concurrency
Tags:
Hiya folks! I'm David and I work on rust-analyzer, which is a language server for Rust similar to sourcekit-lsp. I'm using the new Instruments profiling tooling functionality in Xcode 16.3 and Xcode 26 (Processor Trace and CPU Counters) to profile our trait solver/type checker. While I've been able to use the new CPU Counters instrument successfully (the CPU Bottleneck feature is incredible! Props to the team!), I've been unable to make use of the Processor Trace instrument. Instruments gives me the error message Processor Trace cannot profile this process without proper permissions. The diagnostic suggests adding the com.apple.security-get-task-allow entitlement to the code I'm trying to profile, or ensure that the build setting CODE_SIGN_INJECT_BASE_ENTITLEMENTS = YES is enabled in Xcode. Unfortunately, I don't know how I can add that entitlement to a self-signed binary produced by Cargo and I'm not using Xcode for somewhat obvious reasons. Here's some information about my setup: Instruments Version 26.0 (1
Hi Quinn, Thank you for your reply! After your advice I checked the code signing, and here’s what I found: With every release of our software, we sign all binaries using the codesign utility, and each binary has static Designated Requirements that don’t change from release to release. Overall, our signing process is the same as everyone else’s, and as far as I know, the original Chromium faces the same update issues https://issues.chromium.org/issues/346505950. Moreover, Chromium developers made opinion in (https://issues.chromium.org/issues/346505950#comment31) that this local network permission is associated with the specific Mach-O UUIDs of an application rather than being tied to a code signing identity like most other TCC permissions are on macOS. The network extension subsystem listens for LaunchServices notifications about an application being installed and updates the Mach-O UUIDs it associates with an application's bundle identifier. This means that when LaunchService sees a new version of a
Topic:
App & System Services
SubTopic:
Networking
Tags: