Search results | Apple Developer Forums

Reply to "The signature of the binary is invalid" macOS App Notarization Issue

Thank you for the suggestions, here are my results: Exporting In order to export my app archive through the organizer, I followed these steps: Xcode 16 -> Organizer -> Distribute App -> Custom -> Direct Distribution -> Export -> Automatically Manage Signing -> Export. Notarytool + Log After exporting, I followed Customizing the notarization workflow in order to run notarytool. You were right, the process was easier than I thought that it would be. After running notarytool, I was able to get the log file from the failed notarization by running xcrun notarytool log .... I have attached the log file below. Case Sensitive Volume I created a case sensitive volume using the disk utility app. After copying over and unpacking my app, I re-ran codesign --verify --strict --deep -vvv …, which produced different results than my original debugging session. The output was a lot shorter than my initial run (maybe from detecting the issue?). This seems to be the issue from the output: --prepared

Code Signing Notarization

Dec ’24

Adding a sandboxed v2ray precompiled binary to my application

Greetings! I want to add my pre-compiled binary of v2ray to my application so I can activate it in background as a proxy and run stuff through it. I've codesigned it via: codesign -s - -i production.myproject.v2ray -o runtime --entitlements v2ray.entitlements -f v2ray Contents of entitlements file: com.apple.security.app-sandbox com.apple.security.files.downloads.read-write com.apple.security.files.user-selected.read-write com.apple.security.network.client com.apple.security.network.server Originally I ran it like this without sandboxing from my main target app: guard let v2rayPath = Bundle.main.path(forResource: v2ray, ofType: nil) else { throw NSError(domain: ProxyController, code: 1, userInfo: [NSLocalizedDescriptionKey: V2Ray binary not found in bundle]) } let task = Process() task.executableURL = URL(fileURLWithPath: v2rayPath) task.arguments = [-config, configURL.path] // Redirect output for debugging let pipe = Pipe() task.standardOutput = pipe task.standardError = pipe```

Privacy & Security General Foundation Xcode App Sandbox

2

0

621

Dec ’24

Reply to Trying to track down why codesign is now failing certain files

It’s hard to answer this without a lot more details. In general, macOS and the notary service continue to tighten up their checking of code in order to close security holes. Some of those are big changes, when we tend to announce widely. I have a bunch of links to such things in Trusted Execution Resources and the other Resources posts that it links to. But some of them are relatively minor changes that don’t get widely advertised. And some changes are just implementation changes that happen to cause problems for code that’s not following the rules [1]. [quote='770552021, hamish258, /thread/770552, /profile/hamish258'] DMGs built, signed and notarised successfully are now failing codesign verification. [/quote] If you run syspolicy_check against such an app, what does it report? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] Historically those rules were very poorly documented. That’s much better these days, but lots of code, a

Code Signing General

Dec ’24

Reply to ASN.1 structure of DER encoded entitlements

[quote='817395022, wiedem, /thread/770409?answerId=817395022#817395022, /profile/wiedem'] I can understand if it's not actively supported, but I wouldn't call providing technical documentation 'active support'. [/quote] I think the current situation is instructive. Presumably you built your code signature parsing code back when the entitlements were stored as a property list. Doing that was unsupported. That code broke when we switched to ASN.1, and hence this thread. I’m trying to avoid repeating this cycle, where your code breaks again the next time we revise the code signature format. Remember, DTS’s goal is to help developers build products that work now and in the future. We don’t support things that run counter to that goal. [quote='817395022, wiedem, /thread/770409?answerId=817395022#817395022, /profile/wiedem'] Wasn't the codesign utility once open source? [/quote] I’m not sure if codesign was ever open source, but the core code signing infrastructure is. It lives within the Security

Code Signing Entitlements

Dec ’24

Reply to "The signature of the binary is invalid" macOS App Notarization Issue

The approach I usually take is to export the app from the Xcode organiser and then use notarytool to attempt to notarise that. The advantage of that approach is that you end up with a notary log [1] and the exact file that was submitted to the notary service. You can then look at the file to see what’s what. I’ve found that using Xcode for notarisation is very convenient under normal circumstances, but it adds a layer of abstraction that I’d rather not have when I’m dealing with the weird stuff. Submitting with notarytool is pretty easy; see Customizing the notarization workflow for instructions. Once you have these two bits of info — the file you submitted and the notary log — there are two things I’d recommend you do: Unpack the file on a case-sensitive volume and see if that changes the result of the code signature verification (that is, the codesign --verify --strict --deep -vvv … command). Check the zip archive for extended attributes. You can list the archive’s content with unzip -l. You want t

Code Signing Notarization

Dec ’24

Trying to track down why codesign is now failing certain files

App is built using jdk21, jpackage to create dmg, pulls in the needed jre. Been working fine until about a week ago when notarize start failing bad signing, which when examined it's complaining modified files - a handful of jre license and copyright text files. DMGs built, signed and notarised successfully are now failing codesign verification. Has a macOS 15.1.1 release or Xcode 16.1 patched something, is there new behaviour to be aware of plse?

Code Signing General

2

0

461

Dec ’24

Reply to ASN.1 structure of DER encoded entitlements

[quote='817402022, DTS Engineer, /thread/770409?answerId=817402022#817402022'] So, yeah, DTS doesn’t support that. [/quote] I can understand if it's not actively supported, but I wouldn't call providing technical documentation 'active support'. There are several official Apple articles on the subject, but most of them are not very detailed. Wasn't the codesign utility once open source? Since the reorganisation of Apple's OSS pages, many things are not so easy to find. [quote='817402022, DTS Engineer, /thread/770409?answerId=817402022#817402022'] Please post your bug number, just for the record. [/quote] The Feedback Assistant ID is FB16077892 (But for some reason my feedback seems to have been deleted immediately? At least I don't seem to be able to access it anymore) Based on my experience over the last 15 years with this type of developer feedback for iOS development, it will be years before such a feature is available in iOS. If an implementation is considered at all. In the meantime, we need a pr

Code Signing Entitlements

Dec ’24

"The signature of the binary is invalid" macOS App Notarization Issue

After sending the app archive to apple notarization services, I received the following error: The signature of the binary is invalid. This error is shown for both the arm64 and x86_64 builds of the app. Some details about the project: I have been able to notarize the app in the past, with the latest successful notarization at the start of October. The organization does have a valid developer membership. The app has no new dependencies since the last successful notarization. The project uses automatic managed signing (no visible errors in xcode). What has changed in app and development environment since the last notarization: Updated macOS to macOS 15. Updated to use new Xcode version (16) The organizations membership did expire for a bit, but is now valid. Changed apps target macOS version from 12.3 -> 13.5. What I've tried to debug / resolve this issue: Clean build folder and re-create archive. Waiting a period of time and retrying the notarization. Toggling 'automatic managed signing' off and on. Tried t

Code Signing Notarization System Extensions

5

0

647

Dec ’24

Cannot sign my app

Hello, I am on maxOS 14.6 and I developed a C++ application for macOS with graphical-user interface by using wxWidgets. The .app application bundle is built correctly and the application runs. Now I would like to sign it to get it notarized. I get the following error sudo codesign -vvv --deep --strict MyApp.app/Contents/MacOS/MyApp MyApps.app/Contents/MacOS/MyApp: code has no resources but signature indicates they must be present If I check the signature I get % pkgutil --check-signature MyApp.app Package MyApp: Status: package is invalid (checksum did not verify) How may I fix this? Thank you!

Code Signing General

1

0

364

Dec ’24

Reply to ASN.1 structure of DER encoded entitlements

[quote='770409021, wiedem, /thread/770409, /profile/wiedem'] What is the actual ASN.1 structure of the DER encoded entitlements used for iOS and MacOS applications? [/quote] Why does that matter to you? Most low-level code signing structures like this are not documented for third-party use. Rather, you’re expected to generate and parse them with Apple tools. In the case of entitlements, that means codesign, which continues to support the XML property list format for both signing and display. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Code Signing Entitlements

Dec ’24

Reply to CodeSign with entitlements problem

It’s quite hard to read your post. See Quinn’s Top Ten DevForums Tips for info on how to use a Code Block for preformatted text. [quote='770419021, leolee123, /thread/770419, /profile/leolee123'] why when codesign with entitlements, the zzz cant run success? if I upload to appstore, the client will get the zsh error? [/quote] This relates to App Sandbox inheritance. I talk about that in some detail in Resolving Trusted Execution Problems, and specifically Resolving App Sandbox Inheritance Problems. In short: App Review requires that all code within your app by sandboxed, that is, be signed with the com.apple.security.app-sandbox entitlement. If the code is launched by the system — for example, the main app or an XPC helper — then that’s the only entitlement it needs. The presence of com.apple.security.app-sandbox causes the system to set up a new sandbox for the process. If the code is spawned as a child process of the main app then it also needs com.apple.security.inherit. This tells the system that

Code Signing Entitlements

Dec ’24

Reasons for the prompt "application is damaged and cannot be opened. You should move it to trash"

We have an application which keeps throwing the error application is damaged and cannot be opened. You should move it to Trash We have checked the following possible root causes: Codesign of the application using the codesign command Notarization of the application using the spctl command Executable permissions Checked for the presence of com.apple.quarantine flag for the application using xattr -l

App & System Services Notifications macOS

3

0

327

Dec ’24

CodeSign with entitlements problem

I got a error when validate App as flow Asset validation failed App sandbox not enabled. The following executables must include the com.apple.security.app-sandbox entitlement with a Boolean value of true in the entitlements property list: [( com.xxx.yyy.pkg/Payload/xxx.app/Contents/MacOS/zzz )] Refer to App Sandbox page at https://developer.apple.com/documentation/security/app_sandbox for more information on sandboxing your app. (ID: dc264017-f236-4e89-a100-e69c7f0fb318) zzz is a command tool build by make, I need codesign it. #1. use two lines below, run succes, but get 'App sandbox not enabled' problem codesign -s TTT1 -f -v --timestamp --options runtime dist/m_arm64/zzz codesign -s TTT1 -f -v --timestamp --options runtime dist/m_x64/zzz #2. use two lines below, reduce 'App sandbox not enabled' , but run zzz get 'zsh: trace trap' codesign -s TTT2 -o runtime --entitlements zzz.entitlements -f dist/debug/zzz codesign -s TTT2 -o runtime --entitlements zzz.entitlemen

Code Signing Entitlements

1

0

764

Dec ’24

Reply to .NET 8: Developer Verification Error During App Store Review

[quote='770211021, jaroslavic, /thread/770211, /profile/jaroslavic'] Sign it using the following command: codesign -… --deep … [/quote] You’re falling at the first (well, second :-) hurdle here. Don’t use --deep when signing code. --deep Considered Harmful explains why that’s a problem. It’s much easier to sign and package code using Xcode. If you can’t do that, there are detailed instructions on how to do this manually in: Creating distribution-signed code for macOS Packaging Mac software for distribution [quote='770211021, jaroslavic, /thread/770211, /profile/jaroslavic'] com.apple.security.cs.allow-jit … com.apple.security.cs.allow-unsigned-executable-memory [/quote] There’s no point having both of those, because the latter is effectively a superset of the former. Talk to your tools vendor to determine which one they actually need. [quote='770211021, jaroslavic, /thread/770211, /profile/jaroslavic'] com.apple.security.cs.disable-library-validation [/quote] Don’t disable library validation as a mat

Code Signing Certificates, Identifiers & Profiles

Dec ’24

.NET 8: Developer Verification Error During App Store Review

I’m developing an app on .NET8 for macOS and encountered an issue during App Review with feedback: An error showed upon launch. The app cannot be opened because the developer cannot be verified. This may be due to an issue with your app’s Gatekeeper conformance. Additionally, the provided screenshot showed this message: Application is damaged and can't be opened. Delete and reinstall from App Store. Here’s the process I follow to create the package: Build the application. Sign it using the following command: codesign --force --verify --verbose --deep --options runtime --timestamp --entitlements ../Entitlements.plist -s '3rd Party Mac Developer Application: [ID]' Demo.app Create the package using this command: productbuild --component Demo.app /Applications --sign '3rd Party Mac Developer Installer: [ID]' Demo.pkg After installing the app from TestFligt it doesn’t show the errors. Could someone please advise on what might be causing this issue and how I can fix it? The Entitlements.plist file contains

Code Signing Certificates, Identifiers & Profiles

2

0

497

Dec ’24

codesign

Post

Replies

Boosts

Views

Activity