Search results for

“codesign”

3,222 results found

Post

Replies

Boosts

Views

Activity

Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed 1.>Generated the Apple Development certificate using Keychain Access on macOS. 2.>Added that certificate into my developer account and created the corresponding provisioning profile. 3.>Created an App ID, attached the App ID to the provisioning profile, and downloaded it. 4.>Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited wit
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
1
0
248
Nov ’25
Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed Generated the Apple Development certificate using Keychain Access on macOS. Added that certificate into my developer account and created the corresponding provisioning profile. Created an App ID, attached the App ID to the provisioning profile, and downloaded it. Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited with code 1: Frameworks/lib
Topic: Developer Tools & Services SubTopic: Xcode Tags:
1
0
194
Nov ’25
Reply to Re-sign third party apps for Automation testing
Hey! You can replace the signature of a binary or package using the codesign utility. You can refer to the codesign manual - https://developer.apple.com/documentation/os/reading_unix_manual_pages (man codesign from a terminal), the options you will want are --force to replace a signature or --remove-signature to remove one. Note that when you replace the signature, the program will no longer have access to its keychain items and you might not be able to sign in all the entitlements it had before. I'd suggest you make a copy before fiddling with the signature as it'll probably take a couple of goes to get everything right. You will probably also need to do things like transferring entitlements. Entitlements can be dumped by doing codesign -d --entitlements :- /path/to/thing > thing.entitlements then resigning with codesign --sign <identity> --force --entitlements thing.entitlements /path/to/new/thing (replacing <identity> with either your profile or -
Topic: App Store Distribution & Marketing SubTopic: General Tags:
Jul ’20
Reply to Code signing C++ app with embedded Python3 interpreter
I gave up and spent about 3 hours googling around and found a project that had successfully codesigned an embedded Python.framework and I was able to adapt it to actually work. In case others run into this issue here is the script: cd bin # Use Depth First # Python Frameworks find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -perm -u=x -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s ${CODE_SIGN_ID} {} ; find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/bin/ -type f -perm -u=x -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s ${CODE_SIGN_ID} {} ; find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -name *dylib -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s ${CODE_SIGN_ID} {} ; find ./Sigil.app/Contents/Fr
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Aug ’24
My app is signed (verified with spctl and codesign) but it still "can’t be opened because it is from an unidentified developer."
Hi,I am having trouble signing a .pkg that I have made. I have wrapped the .pkg in a .dmg, you can download it here: www.sptgps.com/GameTrakaInstaller.dmgI have verified that the .pkg is signed with a number of tools, output is below. I have read about the new version 2 signatures and I think that I am using one (even though my Sealed Resource=none.)I am using OS X Yosemite 10.10.5 (14F27).I am manually signing and building my application as it is a Java Web Start (jnlp) based application.My installer package does the following:1) installs java: (I have signed this .pkg)sudo installer -pkg java8u60.pkg -target /2) installs a USB driver: (I have signed this .pkg)sudo installer -pkg PIUSBGPSDriver-4.2.1b5.pkg -target /3) executes an application.jnlp filesudo javaws application.jnlpI know that all the moving parts are working, because if I bypass Gatekeeper everything runs smoothly.Any help would be greatly appreciated!Thank you,Andreas.Verification that root package is signed.$ spctl -a -t exec -vv GameTraka.pk
Topic: Developer Tools & Services SubTopic: Developer Forums Tags:
2
0
963
Sep ’15
Reply to Code Signing With Embedded Provisioning Profiles
I was originally trying to resign the bundle and other components after I modified the info.plist but the signature was invalid. I figured I only needed to resign the bundle and pass --preserve-metadata=identifier,entitlements,requirements in my call. This is my codesign call: codesign -f -v -o kill,runtime --timestamp --preserve-metadata=identifier,entitlements,requirements -s ;
Topic: Code Signing SubTopic: General Tags:
Feb ’22
Reply to Codesign command is extremely long making builds last 20-30 minutes
Recommend you try this, instead:local code_sign_cmd=/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS} --preserve-metadata=identifier,entitlements '$1'local code_sign_cmd=/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS} --preserve-metadata=identifier,entitlements '$1'..and then do an option-clean build folder before trying again.Good luck.
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
Nov ’16
Reply to jpackage bombing on codesign/libnet.dylib (but only on M2 MacBook)
[quote='790330021, pbierre, /thread/790330, /profile/pbierre'] The error feedback from codesign is nonspecific and inactionable. [/quote] Looking at the log you posted I don’t actually see any error information from codesign. It seems that your tooling runs codesign which then exits with status 1, and that’s it. Normally when codesign fails it prints something to stderr. Is that not the case here? Or did it print something but it’s not in the log you included? ps My best guess, based on the info you included, is that this error will be something like this: % codesign -s …all your other arguments elided… libnet.dylib libnet.dylib: is already signed That’s due to a subtle difference between Intel and Apple silicon. On Apple silicon all code is signed by default. If you using an open source toolchain to build your code then it gets ad-hoc signed by the linker. That means that, when you go to sign it, the signing fails because it’s already signed, and hence this error.
Topic: Code Signing SubTopic: General
Jun ’25
Reply to Add a checksum file to my macOS notarised app bundle
1) we developers are obliged to codesign the bundle. Yes 2) the codesign don't let us add our protection (as an additional checksum file). You can add any files you want. You shouldn't add a separate checksum file because the code signature itself does this. 3) the codesign can be easily violated (as I have seen my own macOS app and even the Apple apps, codesigned and notarised, cracked on some web torrent web sites). No, it can't. What you are seeing is that you, and other apps, aren't verifying your code signatures. Apple doesn't really care, because it has SIP and normally doesn't sell apps. What you have to do is verify your own code signature. I've posted instructions on how to do that here: https://developer.apple.com/forums/thread/128586 Your code can still be hacked, of course. But this makes it much more difficult. As you know, is a way to make my macOS app hacker-proof ?
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Aug ’20
Xcode 8 on 10.12 codesign segmentation fault
I have a separate script that signs my embedded frameworks.This was worked fine form 10.9 - 10.11.On 10.12 I get a segmentation fault.codesign --verbose --force --sign $IDENTITY ${FRAMEWORKS_LOCATION}/${FRAMEWORK}.framework/Versions/A18939 Segmentation fault: 11Running the command outside of Xcode produces the same result.
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
8
0
5.9k
Oct ’16
The signature of the binary is invalid but codesign says otherwise
HiI'm trying to notarize my app. I've been signing mutiple binaries and libs and I'm left with two binaries related to JxBrowser (browsercore and browsercore-helper).The notarization process returns an error on those two binaries saying The signature of the binary is invalid..When I extract the binaries from the .dmg file and check them with:codesign -vvv --deep --strict <binary_name>The output is:browsercore: valid on disk browsercore: satisfies its Designated RequirementWhat am I doing wrong and how can I pass them through the notarization process?Best regards
Topic: Code Signing SubTopic: General Tags:
6
0
8.5k
May ’19
Reply to Unable to codesign my *.app (error: unable to build chain to self-signed root for signer)
Oh, one more thing: Why are you running codesign using sudo? That’s generally not necessary and can cause problems [1]. I recommend that you retest this as follows: Log in to the GUI of the Mac that has the Apple Development: Amritpal Singh (…) identity in its keychain. In Terminal, run security find-identity -v -p codesigning (without the sudo) to confirm that it’s available. Then use codesign (again without the sudo) to sign a simple test tool. What do you see in that case? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @apple.com [1] sudo switches the traditional BSD execution context to root but it does not switch the macOS-specific execution context. The codesign tool relies on the Security framework which relies on the security context. See Technote 2083 Daemons and Agents - https://developer.apple.com/library/mac/#technotes/tn2083/_index.html for more background on this.
Topic: Code Signing SubTopic: General Tags:
Nov ’20
Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed 1.>Generated the Apple Development certificate using Keychain Access on macOS. 2.>Added that certificate into my developer account and created the corresponding provisioning profile. 3.>Created an App ID, attached the App ID to the provisioning profile, and downloaded it. 4.>Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited wit
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
Replies
1
Boosts
0
Views
248
Activity
Nov ’25
Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed Generated the Apple Development certificate using Keychain Access on macOS. Added that certificate into my developer account and created the corresponding provisioning profile. Created an App ID, attached the App ID to the provisioning profile, and downloaded it. Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited with code 1: Frameworks/lib
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
1
Boosts
0
Views
194
Activity
Nov ’25
Reply to Re-sign third party apps for Automation testing
Hey! You can replace the signature of a binary or package using the codesign utility. You can refer to the codesign manual - https://developer.apple.com/documentation/os/reading_unix_manual_pages (man codesign from a terminal), the options you will want are --force to replace a signature or --remove-signature to remove one. Note that when you replace the signature, the program will no longer have access to its keychain items and you might not be able to sign in all the entitlements it had before. I'd suggest you make a copy before fiddling with the signature as it'll probably take a couple of goes to get everything right. You will probably also need to do things like transferring entitlements. Entitlements can be dumped by doing codesign -d --entitlements :- /path/to/thing > thing.entitlements then resigning with codesign --sign <identity> --force --entitlements thing.entitlements /path/to/new/thing (replacing <identity> with either your profile or -
Topic: App Store Distribution & Marketing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Jul ’20
Reply to Code signing C++ app with embedded Python3 interpreter
I gave up and spent about 3 hours googling around and found a project that had successfully codesigned an embedded Python.framework and I was able to adapt it to actually work. In case others run into this issue here is the script: cd bin # Use Depth First # Python Frameworks find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -perm -u=x -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s ${CODE_SIGN_ID} {} ; find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/bin/ -type f -perm -u=x -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s ${CODE_SIGN_ID} {} ; find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -name *dylib -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s ${CODE_SIGN_ID} {} ; find ./Sigil.app/Contents/Fr
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
Boosts
Views
Activity
Aug ’24
My app is signed (verified with spctl and codesign) but it still "can’t be opened because it is from an unidentified developer."
Hi,I am having trouble signing a .pkg that I have made. I have wrapped the .pkg in a .dmg, you can download it here: www.sptgps.com/GameTrakaInstaller.dmgI have verified that the .pkg is signed with a number of tools, output is below. I have read about the new version 2 signatures and I think that I am using one (even though my Sealed Resource=none.)I am using OS X Yosemite 10.10.5 (14F27).I am manually signing and building my application as it is a Java Web Start (jnlp) based application.My installer package does the following:1) installs java: (I have signed this .pkg)sudo installer -pkg java8u60.pkg -target /2) installs a USB driver: (I have signed this .pkg)sudo installer -pkg PIUSBGPSDriver-4.2.1b5.pkg -target /3) executes an application.jnlp filesudo javaws application.jnlpI know that all the moving parts are working, because if I bypass Gatekeeper everything runs smoothly.Any help would be greatly appreciated!Thank you,Andreas.Verification that root package is signed.$ spctl -a -t exec -vv GameTraka.pk
Topic: Developer Tools & Services SubTopic: Developer Forums Tags:
Replies
2
Boosts
0
Views
963
Activity
Sep ’15
Reply to Code Signing With Embedded Provisioning Profiles
I was originally trying to resign the bundle and other components after I modified the info.plist but the signature was invalid. I figured I only needed to resign the bundle and pass --preserve-metadata=identifier,entitlements,requirements in my call. This is my codesign call: codesign -f -v -o kill,runtime --timestamp --preserve-metadata=identifier,entitlements,requirements -s ;
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Feb ’22
Reply to Codesign command is extremely long making builds last 20-30 minutes
Recommend you try this, instead:local code_sign_cmd=/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS} --preserve-metadata=identifier,entitlements '$1'local code_sign_cmd=/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS} --preserve-metadata=identifier,entitlements '$1'..and then do an option-clean build folder before trying again.Good luck.
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
Replies
Boosts
Views
Activity
Nov ’16
Reply to jpackage bombing on codesign/libnet.dylib (but only on M2 MacBook)
[quote='790330021, pbierre, /thread/790330, /profile/pbierre'] The error feedback from codesign is nonspecific and inactionable. [/quote] Looking at the log you posted I don’t actually see any error information from codesign. It seems that your tooling runs codesign which then exits with status 1, and that’s it. Normally when codesign fails it prints something to stderr. Is that not the case here? Or did it print something but it’s not in the log you included? ps My best guess, based on the info you included, is that this error will be something like this: % codesign -s …all your other arguments elided… libnet.dylib libnet.dylib: is already signed That’s due to a subtle difference between Intel and Apple silicon. On Apple silicon all code is signed by default. If you using an open source toolchain to build your code then it gets ad-hoc signed by the linker. That means that, when you go to sign it, the signing fails because it’s already signed, and hence this error.
Topic: Code Signing SubTopic: General
Replies
Boosts
Views
Activity
Jun ’25
Reply to Apple kext rejected due to invalid signature
codesign -vvvvvv /Library/Apple/System/Library/Extensions/AppleMobileDevice.kext
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Apr ’20
Reply to Sign an app to distribute it outside of the app store
You can codesign using a self-signed certificate, but GateKeeper will complain since you will still be unidentified.
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
Boosts
Views
Activity
May ’16
Reply to App not launch on an M1 mac
have you tried using the codesign tool to verify the code signature and notarization status of your app?
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
Boosts
Views
Activity
Nov ’21
Reply to Add a checksum file to my macOS notarised app bundle
1) we developers are obliged to codesign the bundle. Yes 2) the codesign don't let us add our protection (as an additional checksum file). You can add any files you want. You shouldn't add a separate checksum file because the code signature itself does this. 3) the codesign can be easily violated (as I have seen my own macOS app and even the Apple apps, codesigned and notarised, cracked on some web torrent web sites). No, it can't. What you are seeing is that you, and other apps, aren't verifying your code signatures. Apple doesn't really care, because it has SIP and normally doesn't sell apps. What you have to do is verify your own code signature. I've posted instructions on how to do that here: https://developer.apple.com/forums/thread/128586 Your code can still be hacked, of course. But this makes it much more difficult. As you know, is a way to make my macOS app hacker-proof ?
Topic: Developer Tools & Services SubTopic: Xcode Tags:
Replies
Boosts
Views
Activity
Aug ’20
Xcode 8 on 10.12 codesign segmentation fault
I have a separate script that signs my embedded frameworks.This was worked fine form 10.9 - 10.11.On 10.12 I get a segmentation fault.codesign --verbose --force --sign $IDENTITY ${FRAMEWORKS_LOCATION}/${FRAMEWORK}.framework/Versions/A18939 Segmentation fault: 11Running the command outside of Xcode produces the same result.
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles Tags:
Replies
8
Boosts
0
Views
5.9k
Activity
Oct ’16
The signature of the binary is invalid but codesign says otherwise
HiI'm trying to notarize my app. I've been signing mutiple binaries and libs and I'm left with two binaries related to JxBrowser (browsercore and browsercore-helper).The notarization process returns an error on those two binaries saying The signature of the binary is invalid..When I extract the binaries from the .dmg file and check them with:codesign -vvv --deep --strict <binary_name>The output is:browsercore: valid on disk browsercore: satisfies its Designated RequirementWhat am I doing wrong and how can I pass them through the notarization process?Best regards
Topic: Code Signing SubTopic: General Tags:
Replies
6
Boosts
0
Views
8.5k
Activity
May ’19
Reply to Unable to codesign my *.app (error: unable to build chain to self-signed root for signer)
Oh, one more thing: Why are you running codesign using sudo? That’s generally not necessary and can cause problems [1]. I recommend that you retest this as follows: Log in to the GUI of the Mac that has the Apple Development: Amritpal Singh (…) identity in its keychain. In Terminal, run security find-identity -v -p codesigning (without the sudo) to confirm that it’s available. Then use codesign (again without the sudo) to sign a simple test tool. What do you see in that case? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @apple.com [1] sudo switches the traditional BSD execution context to root but it does not switch the macOS-specific execution context. The codesign tool relies on the Security framework which relies on the security context. See Technote 2083 Daemons and Agents - https://developer.apple.com/library/mac/#technotes/tn2083/_index.html for more background on this.
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Nov ’20