“missing package product”

Update (MDM‑managed macOS 14.4 device): After some additional testing with our third‑party MDM, the Custom macOS app now does get installed via MDM (the notarized Developer ID PKG is assigned to a group with Install Method = MDM and Auto Deploy, and /Applications/MyProxy.app appears on the target Mac with the expected bundle id and version). However, on that MDM‑managed macOS 14.4 (Apple Silicon) device the app still cannot be launched. Finder shows a generic “MyProxy can’t be opened” error, and the process is killed immediately on launch. The key detail from the system log is that the decision is coming from the ConfigurationProfiles / MDM side rather than from Gatekeeper: taskgated-helper[…]: (ConfigurationProfiles) [com.apple.ManagedClient:ProvisioningProfiles] Disallowing com.myapp.agent.MyProxy because no eligible provisioning profiles found At the same time: spctl --assess -vvv -t exec /Applications/MyProxy.app reports source=Notarized Developer ID. codesign -dvv confirms the app is signed with

Thank you so much for the elaborate and helpful reply. I will try to address each point, to try and see how to close in on my problem. I will also attach a sample crash-report. My rule engine is very fast, based on NSPredicates over ObjC custom classes (No core-data etc.). Rule evaluation is completely internal to my daemon, no API calls and no external calls. There IS , however a stage prior to rule evaluation, where I Parse ES messages into my custom ObjC class, and in that stage there are few API calls one of which has given me grief in the past. I need to decide whether a file-system object (from the ES message) is a Document, in my own semantics. A document is any normal file, or -- package directories. If the file-system object exists and is a directory, and it has a file-name extension, I use something like: _isDocument = [[NSWorkspace sharedWorkspace] isFilePackageAtPath:_filePath ]; If it is non-existing (to be created etc.) Then I use this heuristics and API: { // non-existing directory obj

You can start by signing up for a personal Apple ID and later switch to an Apple Developer account for your LLC. Here's how it generally works: Personal Apple ID: Signing up for a personal Apple ID is quick and doesn't require a DUNS number. It allows you to explore the App Store, download developer resources, and familiarize yourself with the development environment. Switching to an Apple Developer Account: Once you have your DUNS number and are ready to publish apps under your LLC, you can enroll in the Apple Developer Program. During this process, you'll be able to convert your personal Apple ID into the Apple ID for your developer account. This means you won't lose any data or settings associated with your personal account, such as purchase history or app downloads. Benefits of Waiting: If you prefer to have everything set up under your LLC's name from the start, waiting until you receive your DUNS number might make sense. This way, your developer account will reflect your business identity from

First up, on the bug side, what would be most useful now would be to capture a sysdiagnose after the crash, then upload that log to the bug. A few notes on that: The log doesn't need to be collected all that soon after the bug. I try to collect within a few minutes of the crash, but there really isn't any difference triggering within the next 15+ minutes. Eventually, we start purging log data (losing data), but I've gotten useful data out of logs that were taken hours after the event. It IS important that you not reboot the machine first. Lots of data is purged during that process, to the point where I've basically found those logs useless. PLEASE include information about WHEN the problem occurred. Even better, upload the crash log from the same crash you want to use to look at in the sysdiagnose. The log volume is so high that trying to figure out what happened without a time reference can be extremely slow and time-consuming. Similarly, the crash log should be included in the sysdiagnose, but ther

As a follow‑up for anyone hitting the same issue: Per Quinn’s advice, I switched to manual signing outside Xcode and followed the “Exporting a Developer ID Network Extension” guidance. The code signing / notarization side now looks correct and works locally: Host app and DNS Proxy system extension are both signed with Developer ID Application for our team (for example, TEAMID1234). com.apple.developer.networking.networkextension in both host and system extension entitlements uses `dns-proxy-systemextension. The app bundle identifier is com.myapp.agent.MyProxy. The installer pkg is signed with Developer ID Installer: MyApp Inc (TEAMID1234), notarized with notarytool (status: Accepted), stapled, and passes `pkgutil --check-signature. On the test Mac (macOS 14.4, Apple Silicon), sudo installer -pkg MyProxy_…pkg -target / succeeds, the app appears in/Applications, and spctl --assess -vvv -t exec reportssource=Notarized Developer ID`. The app launches and the DNS Proxy system extension r