Search results | Apple Developer Forums

Reply to Signing application with app extensions

[quote='763450021, OscarHedeby, /thread/763450, /profile/OscarHedeby'] If we insert the .appex file before notarization then we get an error that we are replacing existing signature. [/quote] That’s not an error; it’s just codesign telling you about the action it took. Consider: % cp /usr/bin/true MyTrue % codesign -s - MyTrue ; echo $? MyTrue: is already signed 1 % codesign -s - -f MyTrue ; echo $? MyTrue: replacing existing signature 0 The first codesign failed because the program was already signed; the second worked, because of the -f flag, but you then get the replacing existing signature message. Taking a step back, it’s critical that you insert the app before the final signing step of the container app. That way the appex is sealed over by the code signature. If you insert it after, you break the seal on the existing code signature and, as you’ve seen, bad things ensure. For general advice on how to sign code manually, see: Creating distribution-signed code for macOS

Code Signing General

Sep ’24

"Invalid Provisioning Profile" Error on TestFlight

I have a Safari Extension deployed to test flight built and deployed using CLI tools in Azure Devops. It appears to be building, signing, and deploying properly. But when users try to install on TestFlight, they see an error saying something about an invalid provisioning profile. This seems to just be on the installer portion of the app. The extension shows up in safari settings and is otherwise useable. The users just aren't seeing the splash screen that instructs them to go to Safari Settings. I'm not really sure what's wrong here. This is what my build pipeline looks like - task: Bash@3 displayName: Build export.plist file inputs: targetType: 'inline' script: /usr/libexec/PlistBuddy -c Add :method string mac-application $(Pipeline.Workspace)/export.plist && /usr/libexec/PlistBuddy -c Add :provisioningProfiles dict $(Pipeline.Workspace)/export.plist && /usr/libexec/PlistBuddy -c Add :provisioningProfiles:$(APP_IDENTIFIER) string $(InstallDistProvisioningProfile.provisioningProfileUuid) $(Pip

Code Signing Certificates, Identifiers & Profiles TestFlight

2

0

755

Sep ’24

Reply to Missing Library Error in Mac Catalyst when distributed through Testflight

[quote='802969022, tunnelvisionary, /thread/728577?answerId=802969022#802969022, /profile/tunnelvisionary'] Disable Library Validation [/quote] Why? Disabling library validation is rarely the right option. It make sense if your app needs to load in-process plug-ins from other third-party developers, but in most other cases it causes more problems than it solves. [quote='802969022, tunnelvisionary, /thread/728577?answerId=802969022#802969022, /profile/tunnelvisionary'] The Lottie.framework does exist in the <.app>/Resources/Frameworks/ folder [/quote] That’s wrong. In a macOS app, frameworks should be in Contents/Frameworks. See Placing Content in a Bundle. [quote='802969022, tunnelvisionary, /thread/728577?answerId=802969022#802969022, /profile/tunnelvisionary'] I tried importing the framework manually and setting “Embed without Codesign” and my app won’t build. [/quote] Right. That’s taking you in the wrong direction. As a general rule, you want to sign all the code that you embed in your app.

App & System Services General

Sep ’24

packet-tunnel-systemextension OSSystemExtensionErrorDomain 8

Hi, can't activate system-extension. in any case getting Domain=OSSystemExtensionErrorDomain Code=8 Invalid code signature or missing entitlements (sometimes get code = 9) P.S. In debug running all is working. (The system is asking to activate sysex) Has to read huge amount of forum, samples, and docs. But no luck What and how i've tried steps which i've doing #- signing sysextension binaries with Developer ID Application #- signing system extension with Developer ID Application #- signing application with Developer ID Application #- checking all signatures with Developer ID Application #- building pkg installer #- signing installer with Developer ID Installer #- checking signing #- sending installer for notarization #- waiting for installer verification #- after success I call stapler staple #- When calling sysex activation I get (But the problem is persist when i've try to move signed app to application folder, or try to notarize zip) or in any case which possibly mention on forum, i've get sign command sam

Code Signing Notarization System Extensions Network Extension Notarization Code Signing

4

0

860

Sep ’24

Reply to Missing Library Error in Mac Catalyst when distributed through Testflight

I also am getting this same issue loading the Lottie.framework at runtime from my Mac Catalyst app dyld[19098]: Library not loaded: @rpath/Lottie.framework/Versions/A/Lottie Referenced from: <47989D2F-6B41-3EE2-89CA-48B1D3D8F089> /Applications/Play 2 - Beta.app/Contents/MacOS/Play 2 - Beta Reason: , (security policy does not allow @ path expansion) [1] 19098 abort /Applications/Play 2 - Beta.app/Contents/MacOS/Play 2 - Beta A few notes: : Hardened Runtime Enabled w/ Disable Library Validation Sandbox Enabled Archiving with Xcode Cloud using manual signing I then distribute with a post build action to create a DMG with the exported archive provided by XC Cloud, and notarize the DMG All code sign verification looks good The Lottie.framework does exist in the <.app>/Resources/Frameworks/ folder The Lottie framework is embedded as a binary target Interesting to note that they mention the following about versions > 4.4.0 of the Lottie framework: We distribute XCFramework bundles for each release on

App & System Services General

Sep ’24

App is getting crashed after sign the application

PLATFORM AND VERSION macOS Development environment: Other: Python Run-time configuration: macOS 14.6.1 DESCRIPTION OF PROBLEM We have created application using python and created .app using pyInstaller. We want to get the location access using python based application which we are trying to run on MacOS 14.6.1. Without including NSLocationUsageDescription in our info.plist, it is working fine but not getting location permission pop up. After including NSLocationUsageDescription in info.plist application got corrupted. STEPS TO REPRODUCE We are using below commands to sign the application codesign --force -s Developer ID Application: Pitney Bowes (72NX38Y9GF) -v DeviceHub.app --deep --strict --options=runtime --entitlements ../info.plist DeviceHub.app ditto -c -k --keepParent --rsrc --sequesterRsrc --arch 'x86_64' DeviceHub.app DeviceHub.zip xcrun notarytool submit DeviceHub.zip --keychain-profile DHAgentProfile --wait xcrun stapler staple DeviceHub.app

Code Signing General Privacy Core Location Signing Certificates Code Signing

2

0

635

Sep ’24

Reply to Previously unseen problem with certificate signing

[quote='802596022, SeymourKnecht, /thread/763002?answerId=802596022#802596022, /profile/SeymourKnecht'] There was no output at the terminal session. [/quote] I think you’re mixing up inputs and outputs. The results you posted were on a second line: paddy@Johns-MBP TestCertificate % /usr/bin/codesign … errSecInternalComponent That first part is an input but that last part is an output. I’m not entirely sure how you managed to do that, but I suspect that you mistakenly included the output from the Xcode build transcript in the command that you ran in Terminal. In the build transcript you posted, line 246 is the command you want to run. It starts with: /usr/bin/codesign --force … and ends with the path to your app. Copy that line out, past it into a text editor, insert the -vvvvv I described earlier, and then paste that single line into Terminal. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Code Signing General

Sep ’24

Reply to After entitlements add system-extension.install , The app cant run on Macos 10.15

I had tested on 10.15.7 13.0 11.0 12.3 13.3. All except 10.15.7 are valid. Sign using codesign command.

Code Signing Entitlements

Sep ’24

Reply to Previously unseen problem with certificate signing

Added the -vvvv string: paddy@Johns-MBP ~ % cd /Users/paddy/Projects/ThirdParty/TestCertificate paddy@Johns-MBP TestCertificate % /usr/bin/codesign --force --sign 1FC4588FA2EAD7DCF9AAC9CDC823B567D76BCBE8 -vvvv --entitlements /Users/paddy/Library/Developer/Xcode/DerivedData/TestCertificate-dxlxigtevepatdctuzsgtwfenhme/Build/Intermediates.noindex/TestCertificate.build/Debug-iphoneos/TestCertificate.build/TestCertificate.app.xcent --timestamp=none --generate-entitlement-der /Users/paddy/Library/Developer/Xcode/DerivedData/TestCertificate-dxlxigtevepatdctuzsgtwfenhme/Build/Products/Debug-iphoneos/TestCertificate.app /Users/paddy/Library/Developer/Xcode/DerivedData/TestCertificate-dxlxigtevepatdctuzsgtwfenhme/Build/Products/Debug-iphoneos/TestCertificate.app: errSecInternalComponent There was no output at the terminal session. Do you have another suggestion?

Code Signing General

Sep ’24

Reply to Previously unseen problem with certificate signing

[quote='802262022, SeymourKnecht, /thread/763002?answerId=802262022#802262022, /profile/SeymourKnecht'] Recreated the error with a simpler project [/quote] OK. That’s always a great debugging step, because it allows you to draw the distinction between a problem with your project and a problem with your tools. And the full build transcript you posted shows that this is indeed a problem with your tools. [quote='802099022, SeymourKnecht, /thread/763002?answerId=802099022#802099022, /profile/SeymourKnecht'] I have not so far had an explanation as to why Apple decided to prevent an application that worked before from working now [/quote] It’s hard to say what broke this, but it’s unlikely to be anything sinister. [quote='802099022, SeymourKnecht, /thread/763002?answerId=802099022#802099022, /profile/SeymourKnecht'] You did not specify which part of the build comments was the command you wished me to run. [/quote] The codesign command itself; after all, that’s the one that’s failing. Right now that command

Code Signing General

Sep ’24

iOS apps on macOS : less secure ?

I am trying to understand the mechanics of how iOS/iPadOS apps work on macs with Apple Silicon. In particular, I'd like to understand the runtime environment of these apps. I installed one to test it on a mac. I ran codesign --entitlements on a mac, on an iOS app downloaded form the mac app store. I was very surprised to see the sandbox entitement was NOT present. On iOS all apps are sandboxed, so I was very surprised to see that the macOS translation was not sandbox. This seems like a significant weakening of the security. Can anyone shed some light on that?

Privacy & Security General App Sandbox

1

0

496

Sep ’24

Reply to Previously unseen problem with certificate signing

Dear Mr. Quinn, (Case-ID: 8907830) You wrote: One trick you can use here is to copy the command out of your build transcript and run it directly from Terminal. That should reproduce the issue. You did not specify which part of the build comments was the command you wished me to run. I decided to start with the last bits that seemed to go wrong: paddy@Johns-MBP WordPuzzleAids % CodeSign /Users/paddy/Library/Developer/Xcode/DerivedData/WordPuzzleAids-dnwilitxxdvpzablseyseujsllag/Build/Products/Debug-iphoneos/WordPuzzleAids.app (in target 'WordPuzzleAids' from project 'WordPuzzleAids') cd /Users/paddy/Projects/ThirdParty/WordPuzzleAids zsh: unknown file attribute: I # No idea what this means; am I not supposed to use zsh? paddy@Johns-MBP WordPuzzleAids % Codesign Usage: codesign -s identity [-fv*] [-o flags] [-r reqs] [-i ident] path ... # sign codesign -v [-v*] [-R=|-R ] path|[+]pid ... # verify codesign -d [options] path ... # display contents codesign -h p

Code Signing General

Aug ’24

Previously unseen problem with certificate signing

I first built WordPuzzleAids over 2 years ago. I built it on my MacBook Pro, using Xcode and Swift. The destination for the build was my iPhone. Two weeks ago, the app stopped working on the iPhone: I thought I might need to rebuild it on the on the MacBook and re-deliver it to the iPhone. The build failed with: CodeSign /Users/paddy/Library/Developer/Xcode/DerivedData/WordPuzzleAids-dnwilitxxdvpzablseyseujsllag/Build/Products/Debug-iphoneos/WordPuzzleAids.app (in target 'WordPuzzleAids' from project 'WordPuzzleAids') cd /Users/paddy/Projects/ThirdParty/WordPuzzleAids Signing Identity: Apple Development: John Patterson (G9M8AH9CTD) Provisioning Profile: iOS Team Provisioning Profile: * (650d11d4-ecd2-4458-a146-3cb55438e9dc) /usr/bin/codesign --force --sign 1FC4588FA2EAD7DCF9AAC9CDC823B567D76BCBE8 --entitlements /Users/paddy/Library/Developer/Xcode/DerivedData/WordPuzzleAids-dnwilitxxdvpzablseyseujsllag/Build/Intermediates.noindex/WordPuzzleAids.build/Debug-iphoneos/WordPuzzleAids.build/WordP

Code Signing General Xcode

6

0

933

Aug ’24

Sandboxed Electron macOS app can't access Photos library

I have an Electron app built for macOS, and it was distributed via 'Developer ID' for years, it worked well and I was able to access the photos in the system Photos library. Surely I already have the 'NSPhotoLibraryUsageDescription' key in Info.plist. Recently we are trying to publish this app to Mac App Store, so I have to turn on the sandbox, after that the app starts giving XPC errors while accessing the Photos library. The errors look like: PHAuthorizationStatus: Authorized CoreData: XPC: sendMessage: failed #0 CoreData: XPC: Unable to sendMessage: to server ... CoreData: XPC: sendMessage: failed #7 CoreData: XPC: Unable to connect to server with options { NSPersistentHistoryTrackingKey = 1; NSXPCStoreServerEndpointFactory = ; skipModelCheck = 1; } CoreData: XPC: Unable to load metadata: Error Domain=NSCocoaErrorDomain Code=134060 A Core Data error occurred. UserInfo={Problem=Unable to send to server; failed after 8 attempts.} CoreData: fault: Unable to create token NSXPCConnection. NSXPCStoreServerEndpoi

Media Technologies Photos & Camera Entitlements XPC App Sandbox PhotoKit

5

0

1.2k

Aug ’24

Notarization consistently taking days to complete

Hi all — Hoping you all have insights on notarization. We are a small startup using Apple Business Essentials as our company MDM, managing our fleet of Macs. ABE has the capability (as with every MDM) to deploy custom software to those Macs via .pkg files. We create the package files with no problem, and also codesign them with no problem. We discovered that the Macs will fail to install the packages if the package is not notarized (which makes sense from the perspective of Gatekeeper). Notarizing the package was easy. Submitting them is easy. But the processing time has been crazy! I've read from posts here that the first submissions can take a long time, and indeed ours did — iirc, about 48 hours. But the pattern has continued. Our most recent submission (submission id 2a714bbf-83e7-4a25-b936-e002c94e1704 if someone from Apple is reading) has now taken almost 4 days and is still In Progress. I have no idea how to resolve this, or even to understand what's holding up the submission. Anyone have any

Code Signing Notarization

1

0

626

Aug ’24

codesign

Post

Replies

Boosts

Views

Activity