Search results for

“codesign”

3,221 results found

Post

Replies

Boosts

Views

Activity

security add-keychain
Running on Sierra I found that Keychain Access is no longer updated with a new keychain created with security create-keychain.So what happens is:1. security delete-keychain <keychain> ; this actually deletes the keychain and removes from Keychain Access2. security create-keychain <keychain> ; this creates the keychain however it does not populate to Keychain Access unless it is the login.keychain[-db] - which it is not3. security find-identity <keychain> -p codesigning -v ; fails even after adding .p12 and .cer / .pem files4. unlocking the keychain does not help, setting default-keychain does not help either as those do not populate the created keychain into Keychain Access5. opening Keychain Access and selecting File / Add Keychain... is the only thing what helps and makes security find-identity <keychain> -p codesigning -v successfulThe problem is that I create the keychain with about 40 keys and certs in a batch job on a build machine so adding the signing identite
2
0
4.1k
Jun ’17
Invalid Swift Support - The file libswiftAVFoundation.dylib doesn’t have the correct code signature.
I have a project that uses Swift and Objective, no Cocoapods.Shortly after uploading my IPA through Application Loader I received this email from Apple:Dear developer,We have discovered one or more issues with your recent delivery for EdgevisTest. To process your delivery, the following issues must be corrected:Invalid Swift Support - The file libswiftAVFoundation.dylib doesn’t have the correct code signature. Make sure you’re using the correct signature, rebuild your app using the current public (GM) version of Xcode, and resubmit it. Don’t just modify the code signature of libswiftAVFoundation.dylib.Once these issues have been corrected, you can then redeliver the corrected binary.Regards,The App Store teamI should point out that I have used a script to resign the IPA for a customer. Any ideas what I can do to sort this?Attached below is the script I have used.# !/bin/bash SOURCEIPA=$1 DEVELOPER=$2 MOBILEPROV=$3 TARGET=$4 BUNDLE=$5 unzip -qo $SOURCEIPA -d extracted APPLICATION=$(ls extracted/Payload/) #Remo
21
0
18k
Jun ’17
Reply to High Sierra blocking kernel extensions?
• Could it be possible to explain how this is supposed to bring additional security considering that: - kernel extensions installed prior to upgrading to High Sierrra won't be filtered. - by not loading the kernel extensions, this feature can decrease the security/safety level expected by users who purchased a solution whose purpose is to provide additional security/safety levels.Basically, it's already required to: - codesign the kernel extension with Developer ID Certificates specific for kernel extensions and which are apparently quite hard to obtain these days. - productsign the installation packages when using Apple standard installation packages - request administrative privileges from the user installing (or dynamically loading) the kernel extensions.• Wouldn't it be just easier to require to use an Apple standard installation package to install any kernel extension so that some Apple code: - can check the contents of the payload for any kernel extension and the related certificate. - allows o
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’17
Reply to Code signing: initial steps
Edited.The question in fact is how to clear the finder detritus that were created by previous versions of the system.I've tried to clear from terminal, using xattr -lc command ; extended attributes seem to have been clerad, but strill get the same message and build error :/Users/Me/Library/Developer/Xcode/DerivedData/myApp-hknqslligudgdhdhpwvfhpbtcilk/Build/Products/Debug/myApp.app: resource fork, Finder information, or similar detritus not allowedAre there other attributes to clear ?I read in doc :A: This is a security hardening change that was introduced with iOS 10, macOS Sierra, watchOS 3, and tvOS 10.Code signing no longer allows any file in an app bundle to have an extended attribute containing a resource fork or Finder info.To see which files are causing this error, run this command in Terminal:$ xattr -lr <path_to_app_bundle>replacing <path_to_app_bundle> with the path to your actual app bundle.Here's an example of this command in action:$ xattr -lr Foo.app/Applications/Foo.app: com.apple.
Jun ’17
DNS Proxy Network Extension startProxy
I'm trying to get a DNS Proxy working in iOS 11.0 beta 2. I have the entitlements, and I have enabled the DNS proxy through the manager but it isn't calling startProxy in my Proxy Provider. I'm able to loadFromPreferences() so I think the entitlements are correct and isEnabled shows true when I move the app to the background and back to the foreground. Any help would be great.In my main app:func applicationDidBecomeActive(_ application: UIApplication) { let manager = NEDNSProxyManager.shared() if manager.isEnabled == true { NSLog(enabled) } else { manager.localizedDescription = DNS Proxy manager.loadFromPreferences { error in if (error != nil) { NSLog(Load error: (String(describing: error?.localizedDescription))); } else { NSLog(loaded preferences); let dict = [foo: bar] let proto = NEDNSProxyProviderProtocol() proto.providerConfiguration = dict proto.providerBundleIdentifier = com.bangj.DNS.DNS-Proxy manager.providerProtocol = proto manager.isEnabled = true } } } }My Proxy Provider:class DNSProxyProvider: NE
15
0
9.7k
Jun ’17
Reply to Confused about TestFlight submission process
Using TestFlight is an optional part of the process afer put build in the store - either way, the app still needs to be reviewed, but you need to upload the app first, then use iTunes Connect from there.See https://help.apple.com/itunes-connect/developer/#/devdc42b26b8 >So I'm not sure how the submission winds up being reviewed for TestFlight and not the App Store.In that case, you'd wait to flag it for 'final review'. See this SO thread for discussion:https://stackoverflow.com/questions/41395077/testflight-while-app-is-waiting-for-reviewYour codesigning errors are another issue - Is there a specific scenario involved that requires AL? Suggest you use a current version of Xcode in your example.
Jul ’17
Reply to DNS Proxy Network Extension startProxy
I only had a short amount of time to play with this today but I did manage to get the provider loading. I’m going to address some specific points in your original post and then describe what I did.You wrote:I'm able to loadFromPreferences() …Did you actually call saveToPreferences(completionHandler:)? I don’t see that anywhere in the snippets you posted. I think my entitlements look good:You should dump the entitlements of the .appexinside your .app, rather than the one at the top level of your build results folder. That ensures that you’re dumping the entitlements that are actually being looked at by iOS. You should also dump your provisioning profiles to ensure that they whitelist the entitlements you use (specifically com.apple.developer.networking.networkextension). One thing that is confusing is that in NEDNSProxyManager.h, enabledis the property but I can't set enabled in Xcode. Right. That’s a Swift thing. In Objective-C you have the isEnabled getter paired to the enabled setter, but Swift exposes both
Jul ’17
including resources in a plugin bundle, causes a code signing error?
so, the subject says it all.I literally include a 30x30 png in my bundle... which is a plugin... and the entire app will not compile.all I'm trying to do is store resources for the plugin, IN the plugin, and then retrieve them when I need them.this isn't a code thing, I can't even get through the first step: copying the images into the bundle causes this issue:.../Xcode/DerivedData/concrete-avagvvzvpkupkmeubvvuggphmrsf/Build/Products/Debug/CentralDogma.plugin: replacing existing signature.../Xcode/DerivedData/concrete-avagvvzvpkupkmeubvvuggphmrsf/Build/Products/Debug/CentralDogma.plugin: resource fork, Finder information, or similar detritus not allowedCommand /usr/bin/codesign failed with exit code 1been doing google searches for hours. I just need to know what I'm doing wrong.
0
0
257
Jul ’17
Reply to High Sierra - Beta 4 - Parallels Does not Function
I would advice all developers to read the Apple TN2459 concerning KEXT Consent.https://developer.apple.com/library/content/technotes/tn2459/_index.html#//apple_ref/doc/uid/DTS40017658This will impact your work and your users, even if your app does not use KEXTs.You can add to the trusted developer team list for KEXT-CONSENT by booting to Recovery and using spctl as described in the note. If the KEXT you are trying to load is not yours, you need to ascertain the TEAM ID of the kext by using codesign. It is not clear in the note, but the team ID is not the company string as reported in the dialog, but the HEX key in the certificate and also used for siging in Xcode.I prefer to run with SIP enabled, but I think that the current apporach will have the effect that a lot do support people will advice their users to turn off sip, which is arguably and easier command then trying to have them type in a complex string like spctl kext-consent allow XYZABCD3FT.I have been working on this issue for several days t
Topic: App & System Services SubTopic: Core OS Tags:
Jul ’17
Reply to High Sierra - Beta 4 - Parallels Does not Function
You need to find one of the Parallels KEXTS and then run: codesign -dvvv <path-to-kext>In the resultant listing you will see somthing like this (VMWare is my example) Authority=Developer ID Application: VMware, Inc. (Fusion) (8J7TAMPT4P)The last string in parens is the TEAM ID. For VMware, you would use the following in the Recovery shell spctl kext-consent add 8J7TAMPT4PAlso do a spctl kext-consent listto make sure it took.BTW, hopefully they signed all their KEXTs with the same TEAM ID.
Topic: App & System Services SubTopic: Core OS Tags:
Jul ’17
Error occurred during export, Codesign failed
Hello, From last few days I am facing one strange problem while archiving my app using developer id signed. I am getting an error when I try to export archive saying Error occured during export, code sign failed. I am also getting this log in the console signature too large to embed (size limitation of on-disk representation). I also noticed one strange thing, archive export works fine for project written in pure Objective C language and this problem exists for project written in pure swift and objective C + swift mixed language. I also checked provision profile and other certificates, everything is fine (No expired certificates). Can anyone please provide solution for this?Regards,Rohith Nayak
Topic: UI Frameworks SubTopic: AppKit Tags:
9
0
3.5k
Aug ’17
Reply to Error occurred during export, Codesign failed
Ok removing the expired certificate didn't change anything. I took a quick look into the libsecurity source code to see when this error is thrown. It's either when some extended attributes are too long or when the codesign blob is longer than the allocated space within the Mach-O binary. I can't see which one of those two cases applies here. But it only happens while signing a Framework. In our case it was either while signing the Swift AppKit Framework or in another project the QtGui Framework. We did not change our project settings, source code, installed developer tools or certificate. It just stopped working over the weekend! We already tried different versions of XCode to fix it. Can there be an issue with the size of a timestamp in codesign? The time is the only thing that changed.
Topic: UI Frameworks SubTopic: AppKit Tags:
Aug ’17
Developer ID code sign Error
Hi,We are unable to codesign our Mac app using Developer Id Application certificate. This was workig fine till last week.If we set timestamp option to none everyting works fine. As we are distributing this app to public, can not use timestamp=none option.This error occurs only if app bundle has any framework or dylib. As we use swift in our application, swift dylibs will be emebeded with in the app.I am using Xcode 8.3.3 and Mac OS 10.12.4. I have also attached error logs here.Can anyone help me resolve this?Test-MBP$ codesign -s SIGNING_IDENTITY” —deep test123.app --force -o library test123.app: replacing existing signature test123.app: signature too large to embed (size limitation of on-disk representation) In subcomponent: test123.app/Contents/Frameworks/libswiftCore.dylib
4
0
1.7k
Aug ’17
"No identity found" error when codesigning app
I keep getting this error despite having installed new certificates. I have 3rd Party Mac Developer Application, AddTrust External CA Root, Apple Application Inegration Certification Authority, Developer ID Application, Apple Worldwide Developer Relations Certification Authority, Developer ID Application, Developer ID Certification Authority, Developer ID Installer and some others. Why does it give me this error?
9
0
27k
Aug ’17
security add-keychain
Running on Sierra I found that Keychain Access is no longer updated with a new keychain created with security create-keychain.So what happens is:1. security delete-keychain <keychain> ; this actually deletes the keychain and removes from Keychain Access2. security create-keychain <keychain> ; this creates the keychain however it does not populate to Keychain Access unless it is the login.keychain[-db] - which it is not3. security find-identity <keychain> -p codesigning -v ; fails even after adding .p12 and .cer / .pem files4. unlocking the keychain does not help, setting default-keychain does not help either as those do not populate the created keychain into Keychain Access5. opening Keychain Access and selecting File / Add Keychain... is the only thing what helps and makes security find-identity <keychain> -p codesigning -v successfulThe problem is that I create the keychain with about 40 keys and certs in a batch job on a build machine so adding the signing identite
Replies
2
Boosts
0
Views
4.1k
Activity
Jun ’17
Invalid Swift Support - The file libswiftAVFoundation.dylib doesn’t have the correct code signature.
I have a project that uses Swift and Objective, no Cocoapods.Shortly after uploading my IPA through Application Loader I received this email from Apple:Dear developer,We have discovered one or more issues with your recent delivery for EdgevisTest. To process your delivery, the following issues must be corrected:Invalid Swift Support - The file libswiftAVFoundation.dylib doesn’t have the correct code signature. Make sure you’re using the correct signature, rebuild your app using the current public (GM) version of Xcode, and resubmit it. Don’t just modify the code signature of libswiftAVFoundation.dylib.Once these issues have been corrected, you can then redeliver the corrected binary.Regards,The App Store teamI should point out that I have used a script to resign the IPA for a customer. Any ideas what I can do to sort this?Attached below is the script I have used.# !/bin/bash SOURCEIPA=$1 DEVELOPER=$2 MOBILEPROV=$3 TARGET=$4 BUNDLE=$5 unzip -qo $SOURCEIPA -d extracted APPLICATION=$(ls extracted/Payload/) #Remo
Replies
21
Boosts
0
Views
18k
Activity
Jun ’17
Reply to High Sierra blocking kernel extensions?
• Could it be possible to explain how this is supposed to bring additional security considering that: - kernel extensions installed prior to upgrading to High Sierrra won't be filtered. - by not loading the kernel extensions, this feature can decrease the security/safety level expected by users who purchased a solution whose purpose is to provide additional security/safety levels.Basically, it's already required to: - codesign the kernel extension with Developer ID Certificates specific for kernel extensions and which are apparently quite hard to obtain these days. - productsign the installation packages when using Apple standard installation packages - request administrative privileges from the user installing (or dynamically loading) the kernel extensions.• Wouldn't it be just easier to require to use an Apple standard installation package to install any kernel extension so that some Apple code: - can check the contents of the payload for any kernel extension and the related certificate. - allows o
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Jun ’17
spctl rejects signed dylib
I code signed a dylib, and spctl says rejected (the code is valid but does not seem to be an app). Well, I didn't say it was an app, I just want to be sure that it is properly codesigned. I could swear this used to work.
Replies
2
Boosts
0
Views
1.4k
Activity
Jun ’17
Reply to Code signing: initial steps
Edited.The question in fact is how to clear the finder detritus that were created by previous versions of the system.I've tried to clear from terminal, using xattr -lc command ; extended attributes seem to have been clerad, but strill get the same message and build error :/Users/Me/Library/Developer/Xcode/DerivedData/myApp-hknqslligudgdhdhpwvfhpbtcilk/Build/Products/Debug/myApp.app: resource fork, Finder information, or similar detritus not allowedAre there other attributes to clear ?I read in doc :A: This is a security hardening change that was introduced with iOS 10, macOS Sierra, watchOS 3, and tvOS 10.Code signing no longer allows any file in an app bundle to have an extended attribute containing a resource fork or Finder info.To see which files are causing this error, run this command in Terminal:$ xattr -lr <path_to_app_bundle>replacing <path_to_app_bundle> with the path to your actual app bundle.Here's an example of this command in action:$ xattr -lr Foo.app/Applications/Foo.app: com.apple.
Replies
Boosts
Views
Activity
Jun ’17
DNS Proxy Network Extension startProxy
I'm trying to get a DNS Proxy working in iOS 11.0 beta 2. I have the entitlements, and I have enabled the DNS proxy through the manager but it isn't calling startProxy in my Proxy Provider. I'm able to loadFromPreferences() so I think the entitlements are correct and isEnabled shows true when I move the app to the background and back to the foreground. Any help would be great.In my main app:func applicationDidBecomeActive(_ application: UIApplication) { let manager = NEDNSProxyManager.shared() if manager.isEnabled == true { NSLog(enabled) } else { manager.localizedDescription = DNS Proxy manager.loadFromPreferences { error in if (error != nil) { NSLog(Load error: (String(describing: error?.localizedDescription))); } else { NSLog(loaded preferences); let dict = [foo: bar] let proto = NEDNSProxyProviderProtocol() proto.providerConfiguration = dict proto.providerBundleIdentifier = com.bangj.DNS.DNS-Proxy manager.providerProtocol = proto manager.isEnabled = true } } } }My Proxy Provider:class DNSProxyProvider: NE
Replies
15
Boosts
0
Views
9.7k
Activity
Jun ’17
Reply to Confused about TestFlight submission process
Using TestFlight is an optional part of the process afer put build in the store - either way, the app still needs to be reviewed, but you need to upload the app first, then use iTunes Connect from there.See https://help.apple.com/itunes-connect/developer/#/devdc42b26b8 >So I'm not sure how the submission winds up being reviewed for TestFlight and not the App Store.In that case, you'd wait to flag it for 'final review'. See this SO thread for discussion:https://stackoverflow.com/questions/41395077/testflight-while-app-is-waiting-for-reviewYour codesigning errors are another issue - Is there a specific scenario involved that requires AL? Suggest you use a current version of Xcode in your example.
Replies
Boosts
Views
Activity
Jul ’17
Reply to DNS Proxy Network Extension startProxy
I only had a short amount of time to play with this today but I did manage to get the provider loading. I’m going to address some specific points in your original post and then describe what I did.You wrote:I'm able to loadFromPreferences() …Did you actually call saveToPreferences(completionHandler:)? I don’t see that anywhere in the snippets you posted. I think my entitlements look good:You should dump the entitlements of the .appexinside your .app, rather than the one at the top level of your build results folder. That ensures that you’re dumping the entitlements that are actually being looked at by iOS. You should also dump your provisioning profiles to ensure that they whitelist the entitlements you use (specifically com.apple.developer.networking.networkextension). One thing that is confusing is that in NEDNSProxyManager.h, enabledis the property but I can't set enabled in Xcode. Right. That’s a Swift thing. In Objective-C you have the isEnabled getter paired to the enabled setter, but Swift exposes both
Replies
Boosts
Views
Activity
Jul ’17
including resources in a plugin bundle, causes a code signing error?
so, the subject says it all.I literally include a 30x30 png in my bundle... which is a plugin... and the entire app will not compile.all I'm trying to do is store resources for the plugin, IN the plugin, and then retrieve them when I need them.this isn't a code thing, I can't even get through the first step: copying the images into the bundle causes this issue:.../Xcode/DerivedData/concrete-avagvvzvpkupkmeubvvuggphmrsf/Build/Products/Debug/CentralDogma.plugin: replacing existing signature.../Xcode/DerivedData/concrete-avagvvzvpkupkmeubvvuggphmrsf/Build/Products/Debug/CentralDogma.plugin: resource fork, Finder information, or similar detritus not allowedCommand /usr/bin/codesign failed with exit code 1been doing google searches for hours. I just need to know what I'm doing wrong.
Replies
0
Boosts
0
Views
257
Activity
Jul ’17
Reply to High Sierra - Beta 4 - Parallels Does not Function
I would advice all developers to read the Apple TN2459 concerning KEXT Consent.https://developer.apple.com/library/content/technotes/tn2459/_index.html#//apple_ref/doc/uid/DTS40017658This will impact your work and your users, even if your app does not use KEXTs.You can add to the trusted developer team list for KEXT-CONSENT by booting to Recovery and using spctl as described in the note. If the KEXT you are trying to load is not yours, you need to ascertain the TEAM ID of the kext by using codesign. It is not clear in the note, but the team ID is not the company string as reported in the dialog, but the HEX key in the certificate and also used for siging in Xcode.I prefer to run with SIP enabled, but I think that the current apporach will have the effect that a lot do support people will advice their users to turn off sip, which is arguably and easier command then trying to have them type in a complex string like spctl kext-consent allow XYZABCD3FT.I have been working on this issue for several days t
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Jul ’17
Reply to High Sierra - Beta 4 - Parallels Does not Function
You need to find one of the Parallels KEXTS and then run: codesign -dvvv <path-to-kext>In the resultant listing you will see somthing like this (VMWare is my example) Authority=Developer ID Application: VMware, Inc. (Fusion) (8J7TAMPT4P)The last string in parens is the TEAM ID. For VMware, you would use the following in the Recovery shell spctl kext-consent add 8J7TAMPT4PAlso do a spctl kext-consent listto make sure it took.BTW, hopefully they signed all their KEXTs with the same TEAM ID.
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Jul ’17
Error occurred during export, Codesign failed
Hello, From last few days I am facing one strange problem while archiving my app using developer id signed. I am getting an error when I try to export archive saying Error occured during export, code sign failed. I am also getting this log in the console signature too large to embed (size limitation of on-disk representation). I also noticed one strange thing, archive export works fine for project written in pure Objective C language and this problem exists for project written in pure swift and objective C + swift mixed language. I also checked provision profile and other certificates, everything is fine (No expired certificates). Can anyone please provide solution for this?Regards,Rohith Nayak
Topic: UI Frameworks SubTopic: AppKit Tags:
Replies
9
Boosts
0
Views
3.5k
Activity
Aug ’17
Reply to Error occurred during export, Codesign failed
Ok removing the expired certificate didn't change anything. I took a quick look into the libsecurity source code to see when this error is thrown. It's either when some extended attributes are too long or when the codesign blob is longer than the allocated space within the Mach-O binary. I can't see which one of those two cases applies here. But it only happens while signing a Framework. In our case it was either while signing the Swift AppKit Framework or in another project the QtGui Framework. We did not change our project settings, source code, installed developer tools or certificate. It just stopped working over the weekend! We already tried different versions of XCode to fix it. Can there be an issue with the size of a timestamp in codesign? The time is the only thing that changed.
Topic: UI Frameworks SubTopic: AppKit Tags:
Replies
Boosts
Views
Activity
Aug ’17
Developer ID code sign Error
Hi,We are unable to codesign our Mac app using Developer Id Application certificate. This was workig fine till last week.If we set timestamp option to none everyting works fine. As we are distributing this app to public, can not use timestamp=none option.This error occurs only if app bundle has any framework or dylib. As we use swift in our application, swift dylibs will be emebeded with in the app.I am using Xcode 8.3.3 and Mac OS 10.12.4. I have also attached error logs here.Can anyone help me resolve this?Test-MBP$ codesign -s SIGNING_IDENTITY” —deep test123.app --force -o library test123.app: replacing existing signature test123.app: signature too large to embed (size limitation of on-disk representation) In subcomponent: test123.app/Contents/Frameworks/libswiftCore.dylib
Replies
4
Boosts
0
Views
1.7k
Activity
Aug ’17
"No identity found" error when codesigning app
I keep getting this error despite having installed new certificates. I have 3rd Party Mac Developer Application, AddTrust External CA Root, Apple Application Inegration Certification Authority, Developer ID Application, Apple Worldwide Developer Relations Certification Authority, Developer ID Application, Developer ID Certification Authority, Developer ID Installer and some others. Why does it give me this error?
Replies
9
Boosts
0
Views
27k
Activity
Aug ’17