“codesign”

[quote='774345021, pavel-kozlov-01, /thread/774345, /profile/pavel-kozlov-01'] Is that a correct statement? [/quote] Largely. The one exception point to keep in mind is that macOS 13 and later support app bundle protection, so if this tool is in your app bundle then you benefit from that. For more, see the WWDC 2022 talk referenced in Trusted Execution Resources. [quote='774345021, pavel-kozlov-01, /thread/774345, /profile/pavel-kozlov-01'] Is there any chance the process gets some CPU before it's killed in case of failed codesign check? [/quote] No. Well, if there were, that’d be a significant security bug (-: I don’t want to get too deep into the details here, partly because they’re all implementation details that could change, but mostly because I don’t work on this stuff and thus there are limits to how much I can talk about it. However… I think it’s say to say that Apple platforms have a trusted execution subsystem that controls the code that a process is allowed to load and run. A classic examp

Result of syspolicy_check distribution: App has failed one or more pre-distribution checks. Codesign Error File: /Users/user/Documents/MyApp.pkg Severity: Fatal Full Error: File is not signed at all. Type: Notary Error Notary Ticket Missing File: /Users/user/Documents/MyApp.pkg Severity: Fatal Full Error: A Notarization ticket is not stapled to this application. Type: Distribution Error Seems odd as pkgutil --check-signature shows that the installer is both signed and notarized.

We are not using NSEndpointSecurityEarlyBoot. None of the calls into Apple frameworks that we've seen lead to killing the extension are during our extension initialization. They're all in response to some event, e.g., ES_EVENT_TYPE_AUTH_MOUNT calls into DiskArbitration, ES_EVENT_TYPE_AUTH_OPEN calls into Security. Important to note: we only care about those OPEN events for a restricted set of paths (our files) and immediately return ALLOW for anything else. The stack you posted is a standard example of what I described here: ...If you call an API that generates auth requests to you and you fail to process those auth requests, then you'll deadlock yourself and the system will kill you. That is, your code is running on directly in the event delivery callback: 34 com.redacted.EndpointSecurity 0x100434284 0x100430000 + 17028 35 libEndpointSecurity.dylib 0x19af7d7d0 BBReader::handleItems() + 356 36 libEndpointSecurity.dylib 0x19af7d558 BBReader::woke(void*) + 28 37 libdispatch.dylib 0x1881c0400 _dispatch_client_ca

Hi Kevin. Thanks for your detailed reply. We are not using NSEndpointSecurityEarlyBoot. None of the calls into Apple frameworks that we've seen lead to killing the extension are during our extension initialization. They're all in response to some event, e.g., ES_EVENT_TYPE_AUTH_MOUNT calls into DiskArbitration, ES_EVENT_TYPE_AUTH_OPEN calls into Security. Important to note: we only care about those OPEN events for a restricted set of paths (our files) and immediately return ALLOW for anything else. Here is a lightly redacted crash log: Process: com.redacted.EndpointSecurity [492] Path: /Library/SystemExtensions/*/com.redacted.EndpointSecurity Identifier: com.redacted.EndpointSecurity Version: v2.10.0-21-g35018b949c-dirty (58)Code Type: ARM-64 (Native) Parent Process: launchd [1] User ID: 0 Date/Time: 2025-02-04 12:18:33.7447 -0500 OS Version: macOS 13.6.7 (22G720) Report Version: 12 Anonymous UUID: 6570580F-1EF2-E6B5-E10B-CA9F00455210 Time Awake Since Boot: 58 seconds System Integrity Protection: enabled Cras

The Authority fields displayed by codesign are simply a summary of the subject of each certificate in the chain. If you want to check that, check the certificate fields. However, you’re much better off requiring a ValidationCategory of .developerID and a specific Team ID. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

I removed all existing Apple Development keys, added a new one 2/5/25 via ManageCertificates from Accounts in Xcode, the keyChain still tell me the newly pulled Apple Development certificate is not trusted, my system time is fine the expire time of the certificate is 2026, Is it possible the develop certificate issues server has bug? Issued by: Apple Worldwide Developer Relations Certification Authority Expires: Thursday, February 5, 2026 at 8:11:07 AM Mountain Standard Time =========================== steventang@Mac-mini ~ % codesign -s Apple Development: Steven Tang (4XXXXXX4) -f MyTrue MyTrue: replacing existing signature Warning: unable to build chain to self-signed root for signer Apple Development: Steven Tang (4XXXXXXX4) MyTrue: errSecInternalComponent

I got steventang@Mac-mini ~ % codesign -s Apple Development: Steven Tang (4XXXXXXX4) -f MyTrue Apple Development: Steven Tang (4XXXXXX4): ambiguous (matches Apple Development: Steven Tang (4XXXXXX4) and Apple Development: Steven Tang (4XXXXXXX4) in /Volumes/TwoTSSD/steventang/Library/Keychains/login.keychain-db)

I’m confused by your latest posts, in that that they suggest two different errors: unable to build chain to self-signed root for signer Automatic signing failed Xcode failed to provision this target Are you getting both of these errors? Regardless, I recommend that you run a quick test with codesign: % cp /usr/bin/true MyTrue % codesign -s Apple Development: Quinn Quinn (EW7W773AA7) -f MyTrue MyTrue: replacing existing signature replacing Apple Development: Quinn Quinn (EW7W773AA7) with the code-signing identity from your example. Does that work? IMPORTANT After you sign this code it won’t run; we’re just testing the signing here. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Verified for code sign and Notarisation as below: prjadhav@dhcp-10-180-186-174 Downloads % codesign -v -vvv --strict --deep issue_avoidance_mac issue_avoidance_mac: valid on disk issue_avoidance_mac: satisfies its Designated Requirement prjadhav@dhcp-10-180-186-174 Downloads % prjadhav@dhcp-10-180-186-174 Downloads % codesign -d -vvv issue_avoidance_mac Executable=/Users/prjadhav/Downloads/issue_avoidance_mac Identifier=issue_avoidance_mac Format=Mach-O thin (x86_64) CodeDirectory v=20400 size=855 flags=0x0(none) hashes=21+2 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=071855ea2dc635ef0c42896888239d623a48bea5 CandidateCDHashFull sha256=071855ea2dc635ef0c42896888239d623a48bea562fa83450dedb07df06fb383 Hash choices=sha256 CMSDigest=071855ea2dc635ef0c42896888239d623a48bea562fa83450dedb07df06fb383 CMSDigestType=2 CDHash=071855ea2dc635ef0c42896888239d623a48bea5 Signature size=9010 Authority=Developer ID Application: Oracle America, Inc. (VB5E2TV963) Authority=Developer ID Cert