Search results for

codesign

3,110 results found

Post

Replies

Boosts

Views

Activity

Reply to Privileged helper without SMJobBless
[quote='859354022, DTS Engineer, /thread/801222?answerId=859354022#859354022'] Activating components embedded in your own bundle means that codesigning validation ensures that your daemon can't be altered. [/quote] Right. More specifically, once Gatekeeper has checked your app it becomes subject to app bundle protection. Trusted Execution Resources has a link to the WWDC talk that explains that. Its not a coincidence that app bundle protection was introduced in macOS 13, which is the very same release that introduced SMAppService. [quote='859354022, DTS Engineer, /thread/801222?answerId=859354022#859354022'] That means using XPC to validate the connection itself … [/quote] For advice on that specifically, see the Validating Signature Of XPC Process link in XPC Resources. RZillmer, if you’re looking to move away from SMJobBless, you should check out my Getting Started with SMAppService post. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + appl
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
3w
What is the difference between applying "hardened runtime" to an executable and adding the `-o library` flag to codesign?
Hey, Just recently I realized something I have been overlooking in my build pipelines. I thought that by adding the the hardened runtime, I disable 3rd-party library injection (I do not have the disable-library-validation entitlement added). However, I was using some checks on my code and I noticed that the library validation code signature check fails on my applications (e.g. adding the .libraryValidation requirement via the LightweightCodeRequirements framework) - with codesign -dvvvv /path/to/app I can check it doesn't have the CS_REQUIRE_LV flag: [...] CodeDirectory v=20500 size=937 flags=0x10000(runtime) hashes=18+7 location=embedded [...] then I used in Xcode the Other Code Signing Flags setting and added the -o library option, which added the flag: [...] CodeDirectory v=20500 size=937 flags=0x12000(library-validation,runtime) hashes=18+7 location=embedded [...] Is this flag something I should be explicitly setting? Because I was under the impression enabling hardened runtime would be enough. P
Topic: Code Signing SubTopic: General Tags:
1
0
160
3w
The signature of the binary is invalid
I tried building a macOS app with Electron, but I ran into problems during notarization. I used notarytool to upload my DMG and got status: Invalid. xcrun notarytool log output { logFormatVersion: 1, jobId: 680bf475-a5f4-4675-9083-aa755d492b18, status: Invalid, statusSummary: Archive contains critical validation errors, statusCode: 4000, archiveFilename: BODYPARK-v3.6.0-mac.app.zip, uploadDate: 2025-09-25T02:50:41.523Z, sha256: e61074b9bba6d03696f2d8b0b13870daafc283960e61ab5002d688e4e82ef6f6, ticketContents: null, issues: [ { severity: error, code: null, path: BODYPARK-v3.6.0-mac.app.zip/BODYPARK-v3.6.0-mac.app/Contents/Resources/plugin/XMagic/mac/libpag.framework/libpag, message: The signature of the binary is invalid., docUrl: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735, architecture: x86_64 }, { severity: error, code: null, path: BODYPARK-v3.6.0-mac.app.zip/BODYPARK-v3.6.0-mac.app/Contents/Resources/plugin/XMa
Topic: Code Signing SubTopic: General Tags:
1
0
142
3w
I think there's a rootkit installed on my device. Please help.
Does anyone know how to fix their launch agents list to remove suspicious applications. I found out there is a codesigning tool allowing suspicious applications to snatch Apple's certificates and codesign their own binaries with them. How do I know, I've literally done it test the restrictions / requirements. Once a binary or application has been signed, it can run anywhere and the system will trust it. I found a process called com.apple.seserviced in the file path /usr/libexec/seserviced. I checked the entitlments and this straight up looks like a commercial sized entrance for this binaries to trample on my computer and iPhone. I'm thinking about putting the code in jail or a lock on the file until I can figure out it's purpose. codesign -d --entitlements :- /usr/libexec/seserviced
Topic: Community SubTopic: Apple Developers
0
0
118
3w
Reply to Xcode Provisioning Profile missing required BGTaskSchedulerPermittedIdentifiers entitlement despite correct project configuration
Exact Error: Provisioning profile iOS Team Provisioning Profile: com.huiwan.Ohra-Journal doesn't include the BGTaskSchedulerPermittedIdentifiers entitlement. So, the issue here is that the way Xcode describes codesign error is with the assumption that your local configuration (meaning, your Entitlement plist) is correct and the provisioning profile is wrong, so you need to add something to your profile. In this case, the solution is the reverse of that— instead of modifying your profile, what you actually need to do is delete BGTaskSchedulerPermittedIdentifiers from your entitlement plist. Expanding on that point here: Despite all these correct local settings, the provisioning profile automatically generated by Xcode is consistently missing the required entitlement. Nothing in the BackgroundTask framework requires any entitlement. The only configuration required is the Info.plist configuration. Finally, on this point: Despite all these correct local settings, the provisioning profile automatically ge
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
3w
Reply to Allow "Browser" to find devices on local networks
You’re relying on framework versions? Actually, no — that’s just how Chromium organizes its build. Is the local network call being made by the process running your app’s main executable? Or by, perhaps, a helper tool embedded in this framework? Chromium does network request out of Main process, in helper process in framework. /Applications/Comet Dev.app/Contents/Frameworks/Comet Dev Framework.framework/Versions/140.0.7339.20748/Helpers/Comet Dev Helper.app/Contents/MacOS/Comet Dev Helper --type=utility Here I prepared two videos with demos: Usually it is easy reproducible when open Google meet… Here I run a regular build with local network permissions, mount the new build, run rsync, and catch the issue: https://www.loom.com/share/0e1dcafdf6c645e9a34087e36414bc78 As an experiment, I also prepared two builds with a static UUID for each Mach-0 generated by my patched LLD (UUID based on hash of the filename): https://www.loom.com/share/d48b6365a4154a3ba8da8f921ad445ca In this case I cannot reproduce the issue —
Topic: App & System Services SubTopic: Networking Tags:
3w
Reply to Allow "Browser" to find devices on local networks
Ah, yes, Chrom{e,ium}. There’s definitely something weird going on there, but I’ve yet to see a definitive answer as to what it is. It certainly isn’t as simple as ‘local network using build UUIDs for everything’, because if that were the case then all apps would lose their local network privacy privilege after every update. However, it’s also true that the network subsystem uses build UUIDs in ways that I’m not super happy with. [quote='859253022, poluyanov, /thread/800879?answerId=859253022#859253022, /profile/poluyanov'] a new …/Versions/A.B.C.D folder with the updated version is added [/quote] Wha? You’re relying on framework versions? That is… well… not what I’d do. That’s not been best practice for a long time, and our docs are now clear about that. Is the local network call being made by the process running your app’s main executable? Or by, perhaps, a helper tool embedded in this framework? Is this issue causing grief for your users? Or only during development? After reproducing the problem, what does
Topic: App & System Services SubTopic: Networking Tags:
3w
Reply to XPC codesign requirement crashes application
Thanks for bringing this to the forums. This is a weird one, and I’m glad to be able to answer it in public. [quote='801478021, dkocher, /thread/801478, /profile/dkocher'] The designated codesign requirement on the XPC connection is set to … [/quote] The most likely cause of this issue is a quoting problem. Consider this: % cat ok.txt anchor apple generic and certificate leaf[subject.OU] = SKMME9E2Y8 % csreq -r ok.txt -t anchor apple generic and certificate leaf[subject.OU] = SKMME9E2Y8 % cat ng.txt anchor apple generic and certificate leaf[subject.OU] = 1KMME9E2Y8 % csreq -r ng.txt -t error: invalid or corrupted code requirement(s) Requirement syntax error(s): line 1:55: unexpected token: = line 1:57: expecting EOF, found '1' The only difference between ok.txt and ng.txt is that the Team ID starts with a digit. That throws off the requirements parser, resulting in wacky errors. When you use it with NSXPCConnection the error occurs at a point where it’s very hard to propagate, and thus you trap. The
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
3w
Reply to Privileged helper without SMJobBless
I've seen the suggestion in the documentation to use SMAppService, but couldn't find a good implementation covering security aspects. In terms of installation security, this is largely handled by SMAppService itself. Activating components embedded in your own bundle means that codesigning validation ensures that your daemon can't be altered. In terms of runtime validation, the techniques for that are basically the same as what's shown in EvenBetterAuthorization. That means using XPC to validate the connection itself and the authorization system to confirm user intent. __ Kevin Elliott DTS Engineer, CoreOS/Hardware
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
4w
Reply to Allow "Browser" to find devices on local networks
Hi Quinn, Thank you for your reply! After your advice I checked the code signing, and here’s what I found: With every release of our software, we sign all binaries using the codesign utility, and each binary has static Designated Requirements that don’t change from release to release. Overall, our signing process is the same as everyone else’s, and as far as I know, the original Chromium faces the same update issues https://issues.chromium.org/issues/346505950. Moreover, Chromium developers made opinion in (https://issues.chromium.org/issues/346505950#comment31) that this local network permission is associated with the specific Mach-O UUIDs of an application rather than being tied to a code signing identity like most other TCC permissions are on macOS. The network extension subsystem listens for LaunchServices notifications about an application being installed and updates the Mach-O UUIDs it associates with an application's bundle identifier. This means that when LaunchService sees a new version of a
Topic: App & System Services SubTopic: Networking Tags:
4w
Reply to XPC codesign requirement crashes application
Log output from com.apple.securityd below: 2025-08-29 15:36:50.076408+0200 0x6dc007 Debug 0x0 26936 0 : (libxpcfileprovider.dylib) [:NSXPCConnection] Set code signing requirement with team identifier 2025-08-29 15:36:50.076991+0200 0x6dc007 Default 0x0 26936 0 : (Security) [com.apple.securityd:security_exception] MacOS error: -67052 2025-08-29 15:36:50.078752+0200 0x6dc007 Debug 0x0 26936 0 : (Security) [com.apple.securityd:security_exception] 0 Security 0x000000019fa4ec74 Security::CommonError::LogBacktrace() + 124 2025-08-29 15:36:50.078785+0200 0x6dc007 Debug 0x0 26936 0 : (Security) [com.apple.securityd:security_exception] 1 Security 0x000000019fa4f20c Security::MacOSError::MacOSError(int) + 312 2025-08-29 15:36:50.078800+0200 0x6dc007 Debug 0x0 26936 0 : (Security) [com.apple.securityd:security_exception] 2 Security 0x000000019f92bbd4 Security::CodeSigning::CSError::CSError(int, __CFDictionary const*) + 24 2025-08-29 15:36:50.078810+0200 0x6dc007 Debug 0x0 26936 0 : (Security) [com.apple.securi
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
4w
XPC codesign requirement crashes application
We have an application that sets a code signing requirement on a XPC connection between a File Provider extension and the main application. Only with a specific Developer ID certificate that designated requirement is not accepted and the application crashes with EXC_CRASH (SIGABRT) and the stacktrace Thread 1 Crashed:: Dispatch queue: com.apple.root.default-qos 0 libsystem_kernel.dylib 0x19b556388 __pthread_kill + 8 1 libsystem_pthread.dylib 0x19b58f88c pthread_kill + 296 2 libsystem_c.dylib 0x19b498a3c abort + 124 3 libc++abi.dylib 0x19b545384 abort_message + 132 4 libc++abi.dylib 0x19b533cf4 demangling_terminate_handler() + 344 5 libobjc.A.dylib 0x19b1b8dd4 _objc_terminate() + 156 6 libc++abi.dylib 0x19b544698 std::__terminate(void (*)()) + 16 7 libc++abi.dylib 0x19b547c30 __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) + 88 8 libc++abi.dylib 0x19b547bd8 __cxa_throw + 92 9 libobjc.A.dylib 0x19b1aecf8 objc_exception_throw + 448 10 Foundation 0x19d5c3840 -[NSXPCConnection setCodeSigningRequirement:] +
Topic: App & System Services SubTopic: Processes & Concurrency Tags:
2
0
72
4w
Xcode 16.x crashes immediately on launch - MacBook Pro 15,4 mid-2019
Hardware & OS: MacBook Pro 15,4 (mid-2019) macOS 15.7 (24G222) Apple Hardware Diagnostics: Passed (ADP000) Xcode crashes on every launch attempt with identical CoreSimDeviceIO framework failures. This started after an automatic Xcode update and affects multiple Xcode versions. Versions tested (all crash identically): Xcode 16.0 (26.0/24228) Xcode 16.4 (23792) *Unable to download Xcode 15.4 due to my ios Crash signature: Exception Type: EXC_BAD_ACCESS (SIGKILL Code Signature Invalid) Crashed Thread: 0 (main thread) Crashing Framework: CoreSimDeviceIO.framework Termination Reason: CODESIGNING, Code 2 Invalid Page Troubleshooting completed: Multiple fresh Xcode downloads from Apple Developer portal Security database rebuild and SystemPolicy reset Complete macOS clean reinstall Developer tools reset (xcode-select) NVRAM reset Hardware diagnostics (passed) Additional problem: macOS compatibility enforcement prevents installing Xcode 15.x as a workaround, showing update to latest version errors even fo
Topic: Developer Tools & Services SubTopic: Xcode Tags:
1
0
110
Sep ’25
Certificate Active in Keychain and I think Xcode but Not Recognized by VS Code / Flutter on macOS Tahoe (macOS 15)
Hi, hoping someone can help here. I recently updated my Mac to macOS 15 (Tahoe) and am using Xcode 15+ (possibly 16). I’m working on a Flutter app and testing on a real iPhone device. Here's the situation: I’m using the free Apple Developer account. My signing certificate and provisioning profile both show as valid and active in Keychain and says signing... in Xcode. When I build and run the app from Xcode, it works completely fine on a simulator. But when I try to run the same project from VS Code using flutter run, whether on an simulator phone or my personal iphone, I get a code signing error, specifically: Failed to codesign Flutter.framework with identity... I believe the app is set to use the correct Team ID because it says my name and (team) (my team ID isBDKUKWVRBY), and I can see my certificate in Keychain under My Certificates. What I’ve already tried: flutter clean pod install / pod update Manually selecting my team in Xcode Signing settings Restarting my machine and VS Code Confirming the
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
1
0
123
Sep ’25