“codesign”

With regards helper tools, does your tool:Have a bundle ID, set via the __info_plist section in the executable?To get this, set both the “Info.plist File” (INFOPLIST_FILE) and the “Create Info.plist Section in Binary” (CREATE_INFOPLIST_SECTION_IN_BINARY) build settings.Have that bundle ID as a ‘child’ of the app’s bundle ID?For example, your app might be com.example.foo and your bundle ID might be com.example.foo.helper.Have a code signing identifier that matches its bundle ID?You can dump the code signing identifier using codesign -d -vvv /path/to/your/tool. For example: $ codesign -d -v /Library/PrivilegedHelperTools/com.anarchistturtle.QCDImagerHelper 2>&1 | grep Identifier Identifier=com.anarchistturtle.QCDImagerHelper … .I haven’t yet researched all of the details of this issue but it’s clearly all about code identity, and messing up one or more of the above is a common cause of code being misidentified.Share and Enjoy — Quinn “The Eskimo!” Apple Developer Relations, Developer Te

Continuing to search for a solution, I found that some people suggest that I should revoke some of the certificates. But according to Apple's Certificates Support document, that seems like a stunning disasterous move: If your certificate is revoked, users will no longer be able to install applications that have been signed with this certificate.So I'm back to figuring out how to specify just one certificate in codesign and the Xcode build, or deleting the unused ones.

I already tried to sign an app containing only the code above (and a main) with: a Mac Developer, a Mac App Distribution and a Developer ID Application certificates.Thanks for confirming that. Given this I ran an old test project that exercises this stuff here in my office, and it also fails with errSecParam (-50). However, I know it used to work, so clearly something weird is happening. After some digging I uncovered the problem. For the iOS-style keychain to work your app must have an application identifier entitlement (this is com.apple.application-identifier on the Mac, or just plain application-identifier on iOS-based platforms). This allows the keychain to identify your code reliably. This requirement isn’t a problem on iOS because all iOS apps have that entitlement (occasionally we see it cause problems on the iOS Simulator, when Xcode and the iOS Simulator’s understanding of how things work gets out of whack, but those usually get fixed pretty quickly). On macOS, however, things are more nuanced. macO

Thank you, Quinn. My build now meets the three requirements you stated. To verify:ACA80003 jk$ otool -s __TEXT __info_plist /Applications/BookMacster.app/Contents/Helpers/Sheep-Sys-Worker | xxd -r ... CFBundleIdentifier com.sheepsystems.BookMacster.Worker ... ACA80003 jk$ cat /Applications/BookMacster.app/Contents/Info.plist ... CFBundleIdentifier com.sheepsystems.BookMacster ... ACA80003 jk$ codesign -d -vvv /Applications/BookMacster.app/Contents/Helpers/Sheep-Sys-Worker Executable=/Applications/BookMacster.app/Contents/Helpers/Sheep-Sys-Worker Identifier=com.sheepsystems.BookMacster.Worker ...As you can see, (1) the bundle identifier com.sheepsystems.BookMacster.Worker is stated in the embedded Info.plist of the helper tool Sheep-Sys-Worker, (2) it is a child of the main app's bundle identifier com.sheepsystems.BookMacster, and (3) it matches the tool's code signing identifier.The result is that access to Mojave-protected files is still apparently denied by System Integrity Protection. I found this

I cleaned the building folder. I cleaned DericedData Folder. Restarted the Mac and Xcode.Still, with a simple empty app I run into this error when I try to build the app onto my iPhone.In the transcript there is no other error than this oneCopying /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/iphoneos/libswiftRemoteMirror.dylib to /Users/admin/Library/Developer/Xcode/DerivedData/Test-flkekjsfbumefvfygbfjekbbwmno/Build/Products/Debug-iphoneos/Test.app/libswiftRemoteMirror.dylibProbing signature of /Users/admin/Library/Developer/Xcode/DerivedData/Test-flkekjsfbumefvfygbfjekbbwmno/Build/Products/Debug-iphoneos/Test.app/Frameworks/libswiftCore.dylib /usr/bin/codesign '-r-' '--display' '/Users/admin/Library/Developer/Xcode/DerivedData/Test-flkekjsfbumefvfygbfjekbbwmno/Build/Products/Debug-iphoneos/Test.app/Frameworks/libswiftCore.dylib'/Users/admin/Library/Developer/Xcode/DerivedData/Test-flkekjsfbumefvfygbfjekbbwmno/Build/Products/Debug-iphoneos/Test.app/Fra

Although not documented, you can use altool for this when you have a codesigned installer package.xcrun altool -t osx -f <app>.pkg --primary-bundle-id --output-format xml --notarize-appThe output will include the UUID associated with the upload. You can use this to attach the ticketxcrun stapler staple <app>.pkg– David

I'm not sure what you mean by click on the identifier, but no, I haven't noticed a way to autofill the password.When I select Always Allow, Xcode stops asking me for the password for 1-2 weeks, but after that asks me again.My certificates are all in my Login keychain. I know that some people have reported this problem when their certificates are in the System keychain, but that is not the case with mine.I can inspect the private keys and notice that they are set to Confirm before allowing access and also that Xcode, codesign and productbuild appear in the Always allow access by these applications list. At the moment I cannot find any examples where this is not the case, but I suspect that after a certain amount of time, the access list is cleared.

If I export the archive with the “Developer ID” option and then run codesign verify it is good:$ codesign --verify --deep --strict --verbose=2 Canopy.app/ --prepared:/Users/mxcl/Desktop/Canopy-macOS 2018-09-14 11-26-40/Canopy.app/Contents/Frameworks/libswiftCoreImage.dylib --validated:/Users/mxcl/Desktop/Canopy-macOS 2018-09-14 11-26-40/Canopy.app/Contents/Frameworks/libswiftCoreImage.dylib --prepared:/Users/mxcl/Desktop/Canopy-macOS 2018-09-14 11-26-40/Canopy.app/Contents/Frameworks/libswiftObjectiveC.dylib --validated:/Users/mxcl/Desktop/Canopy-macOS 2018-09-14 11-26-40/Canopy.app/Contents/Frameworks/libswiftObjectiveC.dylib --prepared:/Users/mxcl/Desktop/Canopy-macOS 2018-09-14 11-26-40/Canopy.app/Contents/Frameworks/libswiftAppKit.dylib --validated:/Users/mxcl/Desktop/Canopy-macOS 2018-09-14 11-26-40/Canopy.app/Contents/Frameworks/libswiftAppKit.dylib --prepared:/Users/mxcl/Desktop/Canopy-macOS 2018-09-14 11-26-40/Canopy.app/Contents/Frameworks/libswiftXPC.dylib --validated:/Users/mxcl/D

Just in case, when the device is a Mac, you can of course still build your apps.But you can also still codesign them with the Developer ID Application certificate (for distribution outside of the Mac App Store) as long as the certificate isn't expired.

Following your general advice...Bug report number: 43327181Description:Area: XcodeSummary: I created a blank Hello World single page app. This runs on simulator, but not on my real device.Steps to Reproduce: Create new project. Leave all defaults. Run on iPhone 8, iOS 11.4.Expected Results: Show blank screen.Actual Results: Codesigning /Users/lothar/Library/Developer/Xcode/DerivedData/HelloWorld9-figpaviwckxwcrelzlgaeasefgbw/Build/Products/Debug-iphoneos/HelloWorld9.app/Frameworks/libswiftCore.dylib /usr/bin/codesign '--force' '--sign' '82F025A538B4126E06BD4EEB2E3D8A570CAB680C' '--verbose' '/Users/lothar/Library/Developer/Xcode/DerivedData/HelloWorld9-figpaviwckxwcrelzlgaeasefgbw/Build/Products/Debug-iphoneos/HelloWorld9.app/Frameworks/libswiftCore.dylib' error: Task failed with exit 0 signal 4 { /usr/bin/codesign '--force' '--sign' '82F025A538B4126E06BD4EEB2E3D8A570CAB680C' '--verbose' '/Users/lothar/Library/Developer/Xcode/DerivedData/HelloWorld9-figpaviwckxwcrelzlgaeasefgbw/Build

I got it working now, I will post some example code, I hope it will be useful for somebody 🙂1: When you have the special entitlement, make sure your container app and network extension have the entitlement set. You can check with `codesign -d --entitlements :- <filename>`It should look like this:<key>keychain-access-groups</key> <array> <string>com.apple.managed.vpn.shared</string> </array>I am using XCode 10 Beta and there is a problem when you use the GUI. It sets the value like<string>$(AppIdentifierPrefix)com.apple.managed.vpn.shared</string>You have to fix it with a texteditor.2: Access the data from the keychain. I will post some example code to use the data as base64 encoded strings.guard let identityReference = protocolConfiguration.identityReference else { throw ConfigError.errorIdentityNotFound } let query: [String : Any] = [ kSecValuePersistentRef as String: identityReference as CFData, kSecReturnRef as String: true, ] var copyResult: