Search results for

“codesign”

3,222 results found

Post

Replies

Boosts

Views

Activity

Reply to dlopen on development iPhone codesign issue
Hi Quinn, I can confirm that loading the dylib when it is copied into the app bundle works correctly, so it seems like it is not a codesigning issue but rather from where the dylib is loaded. Interpreted code is unfortunately not an option because this is for rather high performance code. Wasm could be a possibility but as far as I can see there is no functionality in iOS to execute wasm code inside of an iOS app. Can you give some more details on what holes in the firewall Xcode punches for development purposes. Maybe some of that could be used for a better dev workflow on iOS.
Topic: Code Signing SubTopic: General Tags:
Jan ’25
Unnotarized Developer ID
I'm new to notarizing applications. I'm building an Electron application using electron-packager. The signing looks solid: codesign -vvv --deep --strict path/to/app.app # satisfies its Designated Requirement But checking notarization, looks like it didn't work. spctl --assess -vv path/to/app.app # source=Unnotarized Developer ID # origin=Developer ID Application: Tyson XXXX (XXXXX) I'm wondering how to fix the Unnotarized Developer ID. Thanks!
1
0
481
Jan ’25
Reply to codesign error - No such file or directory
Thanks for that. I downloaded your app and was able to sign it just fine: % sw_vers ProductName: macOS ProductVersion: 15.2 BuildVersion: 24C101 % % codesign -s - -f ALP_Document_Factory_II .app ALP_Document_Factory_II .app: replacing existing signature The one thing I noticed is that your app name contains weird characters. Note the ‘gaps’ in the shell completed name above. Now consider this: % ls | xxd 00000000: 414c 505f 446f 6375 6d65 6e74 5f46 6163 ALP_Document_Fac 00000010: 746f 7279 5f49 49c2 a0c2 a02e 6170 700a tory_II.....app. 00000020: 414c 505f 446f 6375 6d65 6e74 5f46 6163 ALP_Document_Fac 00000030: 746f 7279 5f49 49c2 a0c2 a02e 7a69 700a tory_II.....zip. Each c2 a0 sequence is a U+00A0 NO-BREAK SPACE. Did you add those deliberately? If not, I recommend that you remove them. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General Tags:
Jan ’25
Reply to dlopen on development iPhone codesign issue
One curious thing I am seeing is that: codesign -vv -d --verbose testlibrary-ios.dylib outputs: Executable=/Users/joe/sources/Curiosity/hotreload/cmake-build-debug/testlibrary-ios.dylib Identifier=testlibrary-ios Format=Mach-O thin (arm64) ... It surprised me that my dylib has an Executable= with the path to the dylib. Is this expected and could it be related to my problem?
Topic: Code Signing SubTopic: General Tags:
Jan ’25
Reply to codesign entitlements syntax error
I know this is a very old post but I just ran into the same problem (for an iOS app) and I think I figured it out. This is not an invalid XML so the error is misleading, and that's why plutil has no trouble with it. The problem is datetime format: 2038-01-31T11:46:58Z This is a fully-qualified ISO date but it looks like the codesign tool chokes on it. I was able to work around this by truncating the time part and keeping just the date: 2038-01-31 With this change, I was able to sign and deploy my app to my physical device.
Jan ’25
codesign entitlements syntax error
Hey, I'm trying to code sign my Mac OS X app. I generate entitlements file, but during execution of the command: codesign -f -s DeveloperName -o runtime --timestamp ./App.app --entitlements app.entitlements it gives me the next error: Failed to parse entitlements: AMFIUnserializeXML: syntax error near line 12 In the file I have a date value field on the line 12: ExpirationDate 2038-01-31T11:46:58Z If I move the date on the other line, codesign shows the error line number according to the new line number. If I removed I used plutil commands from the Apple article - https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/resolving_common_notarization_issues?language=objc, and the utility show that everything is ok, but it make no sense for codesign. Mac OS X version: 10.15.7 How can fix it and sign the app with entitlements file?
2
0
3.9k
Dec ’20
Reply to codesign error - No such file or directory
[quote='773118021, dickL45, /thread/773118, /profile/dickL45'] Yours baffled [/quote] This is a weird error. I’ve seen in before [1] but I’ve not yet worked out exactly how to trigger it. Problems like this are almost always the result of folks not following the rules described in Placing Content in a Bundle. However, it’s hard to debug this with just the error message you’re getting from codesign. Two things: If you add more -v flags to codesign, does the verbose logging reveal anything? If not, are you willing to share a copy of the ALP_Document_Factory_II.app? If so, zip it up and reply here with the URL. ps I recommend you have a read of Quinn’s Top Ten DevForums Tips. Specifically tip 5’s info about preformatted text and tip 14 about posting URLs. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] For example, here.
Topic: Code Signing SubTopic: General Tags:
Jan ’25
Reply to Auditing code signatures
So I also asked about this internally and have something I’d like you to try. If you dump a code signature with enough -v options, you eventually get to the CMSDigest field. Does that line up with your signing operations? % codesign -d --arch arm64 -vvvvv /Applications/Pages.app … CMSDigest=4380386763a016bee5fbfbf362f7c9c05bb1a5ea2d5ed9535b371fb36223e3e6 … % codesign -d --arch x86_64 -vvvvv /Applications/Pages.app … CMSDigest=d4d89d97cc94daa5437f14f02490a4a9efd9eece7ca22150d807df344c36d3c9 … Note that it’s different for each architecture. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General Tags:
Jan ’25
Unable to use XCode Auto-sign for a project with network + system extension
Hi, We are developing software that configures a network extension via a system extension on MacOS. The host application (run as service) enables network extension and system extension capabilities. It registers the network extension. The network extension has network extension capabilities and configures an app-group to be bundled into the service. What we have built is already working, i.e. we build, sign, notarize and ship the code (it's already running on hundreds of SIP enabled customer devices in production). But, we are currently falling back to manual profile management (i.e. download and import the profile) so that Xcode accepts the entitlements suffixed with -systemextention. Recently we are testing deployment on iOS devices. For iOS profiles we cannot overcome the issues with setting the profile manually, XCode complains about mismatching networkextension entitlements even when manually importing the profile. So I thought I get to the bottom of why automated signing is not working and hopefully ove
1
0
570
Jan ’25
Disappearing External link account entitlement
I've got a Flutter app that is a “reader” app. The External Link Account Entitlement has already been requested and granted. It is already added as an Additional Capability to the App ID. The com.apple.developer.storekit.external-link.account entitlement is already present in the .entitlements file. Also SKExternalLinkAccount key is added to the Info.plist file with the correct URL. ExternalLinkAccount.open() is invoked via a MethodChannel call handler and things work perfectly in debug mode. The modal appears as expected and opens the link in the external browser. Xcode archive is also sucessful and the entitlement seems to be in place when inspecting the app with: codesign -d --entitlements :- ./path/to/app But when trying to distribute the app via Xcode the entitlement disappears. Other entitlements are not affected by this issue, eg.: com.apple.developer.associated-domains for universal links. This happens with automatically managed singing and a manually selected provisioning profile as well. Wh
3
0
839
Jan ’25
Reply to The staple and validate action failed! Error 65.
Error 65 means that there is no ticket for the thing you’re trying to staple. The usually means that your notarisation failed but, as you’ve shown here, the notarisation actually succeeded. So either you’re stapling something that you didn’t notarise or the notary service didn’t recognise all of your code, and thus failed to include the relevant value in your ticket. Before you start debugging this specific problems, there are two parts to your process that you need to fix. The first is this: [quote='772807021, PeteMinus, /thread/772807, /profile/PeteMinus'] codesign --deep --force --options runtime … [/quote] Don’t sign code with --deep. See --deep Considered Harmful for an explanation as to why that’s bad. For advice on how to sign and package your code, see: Creating distribution-signed code for macOS Packaging Mac software for distribution The second fix relates to this: [quote='772807021, PeteMinus, /thread/772807, /profile/PeteMinus'] ditto -c -k --sequesterRsrc --keepParent dist/mac-arm64/Mode
Jan ’25
Reply to ICDeviceBrowser, PTP tethering, not working in macOS 14.2?
Hello, have you solved this issue? I also use ImageCaptureCore to develop digital cameras tether software. During the development process, I found that the software uses temporary signatures and ICDeviceBrowser can search for devices, but after using formal signatures, it cannot search for any devices. Use the following two commands to temporarily sign: codesign --remove-signature codesign --sign - hope to get your reply! BR,
Topic: App & System Services SubTopic: Core OS Tags:
Jan ’25
Reply to How to count the number of signed files
[quote='821436022, mariocst, /thread/772549?answerId=821436022#821436022, /profile/mariocst'] We execute the codesign inside a CI pipeline. [/quote] So you want to generate this report at build time on a machine you control? If so, you could do this by parsing the CodeResources file within the signed bundle. See TN3126 Inside Code Signing: Hashes. WARNING Don’t do this on the user’s device. Quoting TN3126 “The structure of a code signature has changed numerous times in the past and may well change again in the future.” However, doing this on your CI machine should be fine because, if it breaks, only you are affected. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General
Jan ’25
Reply to dlopen on development iPhone codesign issue
Hi Quinn, I can confirm that loading the dylib when it is copied into the app bundle works correctly, so it seems like it is not a codesigning issue but rather from where the dylib is loaded. Interpreted code is unfortunately not an option because this is for rather high performance code. Wasm could be a possibility but as far as I can see there is no functionality in iOS to execute wasm code inside of an iOS app. Can you give some more details on what holes in the firewall Xcode punches for development purposes. Maybe some of that could be used for a better dev workflow on iOS.
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Jan ’25
Unnotarized Developer ID
I'm new to notarizing applications. I'm building an Electron application using electron-packager. The signing looks solid: codesign -vvv --deep --strict path/to/app.app # satisfies its Designated Requirement But checking notarization, looks like it didn't work. spctl --assess -vv path/to/app.app # source=Unnotarized Developer ID # origin=Developer ID Application: Tyson XXXX (XXXXX) I'm wondering how to fix the Unnotarized Developer ID. Thanks!
Replies
1
Boosts
0
Views
481
Activity
Jan ’25
Reply to codesign error - No such file or directory
Thanks for that. I downloaded your app and was able to sign it just fine: % sw_vers ProductName: macOS ProductVersion: 15.2 BuildVersion: 24C101 % % codesign -s - -f ALP_Document_Factory_II .app ALP_Document_Factory_II .app: replacing existing signature The one thing I noticed is that your app name contains weird characters. Note the ‘gaps’ in the shell completed name above. Now consider this: % ls | xxd 00000000: 414c 505f 446f 6375 6d65 6e74 5f46 6163 ALP_Document_Fac 00000010: 746f 7279 5f49 49c2 a0c2 a02e 6170 700a tory_II.....app. 00000020: 414c 505f 446f 6375 6d65 6e74 5f46 6163 ALP_Document_Fac 00000030: 746f 7279 5f49 49c2 a0c2 a02e 7a69 700a tory_II.....zip. Each c2 a0 sequence is a U+00A0 NO-BREAK SPACE. Did you add those deliberately? If not, I recommend that you remove them. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Jan ’25
Reply to dlopen on development iPhone codesign issue
One curious thing I am seeing is that: codesign -vv -d --verbose testlibrary-ios.dylib outputs: Executable=/Users/joe/sources/Curiosity/hotreload/cmake-build-debug/testlibrary-ios.dylib Identifier=testlibrary-ios Format=Mach-O thin (arm64) ... It surprised me that my dylib has an Executable= with the path to the dylib. Is this expected and could it be related to my problem?
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Jan ’25
Reply to codesign entitlements syntax error
I know this is a very old post but I just ran into the same problem (for an iOS app) and I think I figured it out. This is not an invalid XML so the error is misleading, and that's why plutil has no trouble with it. The problem is datetime format: 2038-01-31T11:46:58Z This is a fully-qualified ISO date but it looks like the codesign tool chokes on it. I was able to work around this by truncating the time part and keeping just the date: 2038-01-31 With this change, I was able to sign and deploy my app to my physical device.
Replies
Boosts
Views
Activity
Jan ’25
codesign entitlements syntax error
Hey, I'm trying to code sign my Mac OS X app. I generate entitlements file, but during execution of the command: codesign -f -s DeveloperName -o runtime --timestamp ./App.app --entitlements app.entitlements it gives me the next error: Failed to parse entitlements: AMFIUnserializeXML: syntax error near line 12 In the file I have a date value field on the line 12: ExpirationDate 2038-01-31T11:46:58Z If I move the date on the other line, codesign shows the error line number according to the new line number. If I removed I used plutil commands from the Apple article - https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/resolving_common_notarization_issues?language=objc, and the utility show that everything is ok, but it make no sense for codesign. Mac OS X version: 10.15.7 How can fix it and sign the app with entitlements file?
Replies
2
Boosts
0
Views
3.9k
Activity
Dec ’20
Reply to codesign error - No such file or directory
[quote='773118021, dickL45, /thread/773118, /profile/dickL45'] Yours baffled [/quote] This is a weird error. I’ve seen in before [1] but I’ve not yet worked out exactly how to trigger it. Problems like this are almost always the result of folks not following the rules described in Placing Content in a Bundle. However, it’s hard to debug this with just the error message you’re getting from codesign. Two things: If you add more -v flags to codesign, does the verbose logging reveal anything? If not, are you willing to share a copy of the ALP_Document_Factory_II.app? If so, zip it up and reply here with the URL. ps I recommend you have a read of Quinn’s Top Ten DevForums Tips. Specifically tip 5’s info about preformatted text and tip 14 about posting URLs. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] For example, here.
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Jan ’25
Reply to Auditing code signatures
So I also asked about this internally and have something I’d like you to try. If you dump a code signature with enough -v options, you eventually get to the CMSDigest field. Does that line up with your signing operations? % codesign -d --arch arm64 -vvvvv /Applications/Pages.app … CMSDigest=4380386763a016bee5fbfbf362f7c9c05bb1a5ea2d5ed9535b371fb36223e3e6 … % codesign -d --arch x86_64 -vvvvv /Applications/Pages.app … CMSDigest=d4d89d97cc94daa5437f14f02490a4a9efd9eece7ca22150d807df344c36d3c9 … Note that it’s different for each architecture. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General Tags:
Replies
Boosts
Views
Activity
Jan ’25
Unable to use XCode Auto-sign for a project with network + system extension
Hi, We are developing software that configures a network extension via a system extension on MacOS. The host application (run as service) enables network extension and system extension capabilities. It registers the network extension. The network extension has network extension capabilities and configures an app-group to be bundled into the service. What we have built is already working, i.e. we build, sign, notarize and ship the code (it's already running on hundreds of SIP enabled customer devices in production). But, we are currently falling back to manual profile management (i.e. download and import the profile) so that Xcode accepts the entitlements suffixed with -systemextention. Recently we are testing deployment on iOS devices. For iOS profiles we cannot overcome the issues with setting the profile manually, XCode complains about mismatching networkextension entitlements even when manually importing the profile. So I thought I get to the bottom of why automated signing is not working and hopefully ove
Replies
1
Boosts
0
Views
570
Activity
Jan ’25
Disappearing External link account entitlement
I've got a Flutter app that is a “reader” app. The External Link Account Entitlement has already been requested and granted. It is already added as an Additional Capability to the App ID. The com.apple.developer.storekit.external-link.account entitlement is already present in the .entitlements file. Also SKExternalLinkAccount key is added to the Info.plist file with the correct URL. ExternalLinkAccount.open() is invoked via a MethodChannel call handler and things work perfectly in debug mode. The modal appears as expected and opens the link in the external browser. Xcode archive is also sucessful and the entitlement seems to be in place when inspecting the app with: codesign -d --entitlements :- ./path/to/app But when trying to distribute the app via Xcode the entitlement disappears. Other entitlements are not affected by this issue, eg.: com.apple.developer.associated-domains for universal links. This happens with automatically managed singing and a manually selected provisioning profile as well. Wh
Replies
3
Boosts
0
Views
839
Activity
Jan ’25
Reply to The staple and validate action failed! Error 65.
Error 65 means that there is no ticket for the thing you’re trying to staple. The usually means that your notarisation failed but, as you’ve shown here, the notarisation actually succeeded. So either you’re stapling something that you didn’t notarise or the notary service didn’t recognise all of your code, and thus failed to include the relevant value in your ticket. Before you start debugging this specific problems, there are two parts to your process that you need to fix. The first is this: [quote='772807021, PeteMinus, /thread/772807, /profile/PeteMinus'] codesign --deep --force --options runtime … [/quote] Don’t sign code with --deep. See --deep Considered Harmful for an explanation as to why that’s bad. For advice on how to sign and package your code, see: Creating distribution-signed code for macOS Packaging Mac software for distribution The second fix relates to this: [quote='772807021, PeteMinus, /thread/772807, /profile/PeteMinus'] ditto -c -k --sequesterRsrc --keepParent dist/mac-arm64/Mode
Replies
Boosts
Views
Activity
Jan ’25
Reply to ICDeviceBrowser, PTP tethering, not working in macOS 14.2?
Hello, have you solved this issue? I also use ImageCaptureCore to develop digital cameras tether software. During the development process, I found that the software uses temporary signatures and ICDeviceBrowser can search for devices, but after using formal signatures, it cannot search for any devices. Use the following two commands to temporarily sign: codesign --remove-signature codesign --sign - hope to get your reply! BR,
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Jan ’25
Reply to How to count the number of signed files
[quote='821436022, mariocst, /thread/772549?answerId=821436022#821436022, /profile/mariocst'] We execute the codesign inside a CI pipeline. [/quote] So you want to generate this report at build time on a machine you control? If so, you could do this by parsing the CodeResources file within the signed bundle. See TN3126 Inside Code Signing: Hashes. WARNING Don’t do this on the user’s device. Quoting TN3126 “The structure of a code signature has changed numerous times in the past and may well change again in the future.” However, doing this on your CI machine should be fine because, if it breaks, only you are affected. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General
Replies
Boosts
Views
Activity
Jan ’25
How to count the number of signed files
Hi at all, is there a way to count how many files have been marked with the codesign? Thanks in advance
Topic: Code Signing SubTopic: General
Replies
3
Boosts
0
Views
501
Activity
Jan ’25
Reply to How to count the number of signed files
Yes I'm referring to the files inside the .app. We need this info for statistics and create if possible also the reports. We execute the codesign inside a CI pipeline. Thanks
Topic: Code Signing SubTopic: General
Replies
Boosts
Views
Activity
Jan ’25