Search results for

codesign

3,110 results found

Post

Replies

Boosts

Views

Activity

Reply to CloudKit it writes to development container, not Production
CloudKit uses your app’s com.apple.developer.icloud-container-environment entitlement to discover whether you’re using a Development or Production version of your provisioning profile, as documented in Testing Your Code Using the Development Container. Apps running on simulators use the Development environment; apps running on a device with Xcode by default use the Development environment as well. If that is the way you run your app to populate the data, the data will go to the the Development environment. TestFlight and App Store apps by default use the Production environment, and so I am wondering if you unintentionally change the entitlement to have your app use the Development environment. You can verify by running the following command line: $ codesign -d --ent :- The output should contain something like this: aps-environment production If you see that the value of the key is development, that will explain why your app writes to the Development environment, and you can double check if you chang
Topic: App & System Services SubTopic: iCloud & Data Tags:
Aug ’25
Reply to Gatekepper acts against .app package developed by a freelancer for our company
[quote='852314022, VBFSDEV, /thread/795578?answerId=852314022#852314022, /profile/VBFSDEV'] do you mean adding the freelancer to my app store connect account? [/quote] Yes. Just like you would do for iOS. [quote='852314022, VBFSDEV, /thread/795578?answerId=852314022#852314022, /profile/VBFSDEV'] which role would you recommend … ? [/quote] That’s a balance between what authority you want to grant them and how much time you want to spend servicing their requests for credential manipulation. Although, having said that, I’ll note that this is no different than it is for iOS. IMPORTANT There’s one thing to watch out for here. If you make them an Admin, don’t explicitly allow them to created Developer ID certificates. See the “Create cloud-managed Developer ID certificates” row in Developer > Support > Articles > Program Roles. [quote='852314022, VBFSDEV, /thread/795578?answerId=852314022#852314022, /profile/VBFSDEV'] You also say that we should not grant access to any certificates [/quote] There are multi
Topic: Code Signing SubTopic: General Tags:
Aug ’25
Reply to Gatekepper acts against .app package developed by a freelancer for our company
Hi Quinn, Thanks for your reply, yet I'm still a little confused, as mentioned all I've done so far is to release mobile apps through automated signing via XCode for iOS (iPhones and iPads). I am also not sure if the freelancer developed the app within XCode. Can you maybe be more precise regarding: Regarding 1., do you mean adding the freelancer to my app store connect account? If not, where? If so, which role would you recommend, according to the principle of least needed access? You also say that we should not grant access to any certificates, so I'm a little confused by this proposition. Regarding 2., are we supposed to provide that Apple Developer Identity to him? Regarding 5., do yo mean sign codesign the app with the developer ID I generated and then notarize the app? If I understand things correctly, these two things have to be done also in the future before releasing any update, correct ?
Topic: Code Signing SubTopic: General Tags:
Aug ’25
Reply to macOS Content Filter: Entitlement Error - Legacy vs. -systemextension Mismatch
I followed the instructions in the link you provided: Exporting a Developer ID Network Extension: https://developer.apple.com/forums/thread/737894 However, when I try to open the application, I receive a popup error: The application can’t be opened. When I check the macOS console log, I see the error: Unsatisfied entitlements Specifically: error 12:01:34.578205+0700 taskgated-helper com.xxx.xxx: Unsatisfied entitlements: com.apple.developer.system-extension.install, com.apple.developer.networking.networkextension, com.apple.developer.team-identifier However, when I inspect the application using the terminal command: codesign -d --entitlements I see that my application is signed and contains all the necessary entitlements, including: com.apple.developer.system-extension.install com.apple.developer.networking.networkextension with the value content-filter-provider-systemextension com.apple.developer.team-identifier = 63D4662568 Can you please help me resolve this issue?
Topic: App & System Services SubTopic: Networking Tags:
Aug ’25
Keychain Access won't let me Export to a .p12 file
I've successfully distributed a Java-based app .dmg from my intel iMac, but am trying to port over the signing authority ( Certificate and Identity) to an M2. I'm following the backup your Identities recipe to make a .p12 file, but I can't complete the Export. The .p12 file format option is greyed out (while .pem and .cer are offered). What could be causing this? I can sign my .dmg installers from this computer, so codesign is happy with what it is seeing in the Keychain.
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
6
0
508
Aug ’25
Reply to Keychain Access won't let me Export to a .p12 file
This was never resolved properly. My Developer ID Certificates exist in two places within KeychainAccess: (correct) from login in MyCerticates (incorrect) from system in Certificates I tried to clean this up, but found that from the GUI, when you say to delete the Certificate in the incorrect location, it also deletes the one in the correct location. I accepted the status quo (2 copies of Certificate). The Codesign tool (embedded within the jpackage script) gives a warning two copies found of the certificate, choosing to use the fist one. Because of that failsafe feature, I was able to complete all my codesigning. With that, this thread is closed.
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
Aug ’25
Codesign -- force not signing 3rd Pty binaries
This math-educational 3D-graphics courseware utilizes Java3D, which sits on top of hardware-dependent JOGAMP binaries (which instruct at the GPU-level). This code signing command applied to the installer .dmg: codesign -s myName --force --options runtime ~/DFG2D_MacOS_Manufacturing/MacOSInstallers/DFG2D_Mac_J1602_x86/DataflowGeometry2D-1.0.300.dmg is supposed to force signing of all the embedded binaries, BUT the notary tool finds about 25 jogamp-fat dynamic libraries (/ *.dylib) UNSIGNED. Processing complete id: 23d81a99-4087-48d2-a567-8072dd2820fe status: Invalid pierrebierre@Pierres-iMac ~ % xcrun notarytool log 17d2fe94-f38a-47d4-9568-cf4dc65f24c9 --apple-id xxxxxxxxxxx --team-id XXXXXXXXX --password pwpwpwpwpw { logFormatVersion: 1, jobId: 17d2fe94-f38a-47d4-9568-cf4dc65f24c9, status: Invalid, statusSummary: Archive contains critical validation errors, statusCode: 4000, archiveFilename: DataflowGeometry2D-1.0.300.dmg, uploadDate: 2025-07-13T21:28:21.147Z, sha256: 57320c4ad4a07f144336084152bf7e33
Topic: Code Signing SubTopic: General
9
0
394
Aug ’25
Reply to Codesign -- force not signing 3rd Pty binaries
POSSIBLE CLUE: This feedback from: codesign --display --verbose=2 indicates a valid Developer ID signature is attached, (not an adhoc signature) pierrebierre@Pierres-iMac ~ % codesign --display --verbose=2 ~/DFG2D_MacOS_Manufacturing/JogAmpSignedJar/jogamp-fat/natives/macosx-universal/libnewt_head.dylib Executable=/Users/pierrebierre/DFG2D_MacOS_Manufacturing/JogAmpSignedJar/jogamp-fat/natives/macosx-universal/libnewt_head.dylib Identifier=libnewt_head Format=Mach-O universal (x86_64 arm64) CodeDirectory v=20400 size=912 flags=0x0(none) hashes=23+2 location=embedded Signature size=9047 Authority=Developer ID Application: Pierre Bierre (SL7L4YU8GT) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=Aug 4, 2025 at 11:36:17 AM Info.plist=not bound TeamIdentifier=SL7L4YU8GT Sealed Resources=none Internal requirements count=1 size=172 The codesign --verify --verbose command gives: pierrebierre@Pierres-iMac ~ % codesign --verify --verbose ~/DFG2D_Mac
Topic: Code Signing SubTopic: General
Aug ’25
Reply to Codesign -- force not signing 3rd Pty binaries
I have a valid Developer ID certificate and key. When I codesign, I'm prompted to enter my system pw. codesign gives absolutely ZERO feedback that it isn't using the Developer ID I reference in the codesign command line. It just says it's signed in response to --verify. You haven't told me anything specifically actionable, like how would I verify during code signing that it's using my Developer ID vs. adhoc. Is there a way to tell, short of the long, exasperating feedback loop leading to Notarization testing?
Topic: Code Signing SubTopic: General
Aug ’25
Reply to Codesign -- force not signing 3rd Pty binaries
The immediate cause of your problem is you have code that’s not signed: % file /Volumes/DataflowGeometry2D/DataflowGeometry2D.app/Contents/app/DFG2D_Mac_x86_313.jar /Volumes/DataflowGeometry2D/DataflowGeometry2D.app/Contents/app/DFG2D_Mac_x86_313.jar: Java archive data (JAR) % mkdir DFG2D_Mac_x86_313 % cd DFG2D_Mac_x86_313 % unzip /Volumes/DataflowGeometry2D/DataflowGeometry2D.app/Contents/app/DFG2D_Mac_x86_313.jar Archive: /Volumes/DataflowGeometry2D/DataflowGeometry2D.app/Contents/app/DFG2D_Mac_x86_313.jar … inflating: lib/jogamp-fat/jogamp-fat.jar … % mkdir jogamp-fat % cd jogamp-fat % unzip ../lib/jogamp-fat/jogamp-fat.jar Archive: ../lib/jogamp-fat/jogamp-fat.jar … inflating: natives/macosx-universal/libjocl.dylib … % file natives/macosx-universal/libjocl.dylib natives/macosx-universal/libjocl.dylib: Mach-O universal binary with 2 architectures… … % codesign -d -vvv natives/macosx-universal/libjocl.dylib … CodeDirectory v=20400 size=1606 flags=0x20002(adhoc,linker-signed) … … The notary service
Topic: Code Signing SubTopic: General
Aug ’25
Reply to Codesign -- force not signing 3rd Pty binaries
My latest process is still failing Notarization, saying 10 .dylib files (located in the jog amp MacosX Universal Binaries folder) are unsigned. My process: Unarchive jogamp-fat.jar (command line too jar xf) codesign --timestamp all 10 .dylib files confirm all signed reJar the jog amp-fat.jar codesign the jar, and confirm signed add signed jar back into Eclipse Java project as an external library Export app jar use jpackage tool to sign app jar , build .dmg, and sign that test run install and launch submit .dmg to Notarization Will try to email the .dmg to Quinn
Topic: Code Signing SubTopic: General
Aug ’25
Reply to Dynamic Library cannot call exposed C function
I have played around a bit more with the code: I tried passing pointers to the functions themselves Making sure the callbacks are called from the mainthread But nothing seems to work. I did stumble into this page though https://developer.apple.com/documentation/xcode/investigating-memory-access-crashes#Use-VM-Region-Info-to-locate-the-memory-in-your-apps-address-space And it's useful to understand the crash logs. My full crash is: Exception Type: EXC_BAD_ACCESS (SIGKILL) Exception Subtype: KERN_PROTECTION_FAILURE at 0x0000000000000000 Exception Codes: 0x0000000000000002, 0x0000000000000000 VM Region Info: 0 is not in any region. Bytes before following region: 4307271680 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL UNUSED SPACE AT START ---> __TEXT 100bbc000-100bc0000 [ 16K] r-x/r-x SM=COW /var/containers/Bundle/Application/D7CA13B9-71D1-467E-882D-317F9AF57049/OpacityPod_Example.app/OpacityPod_Example Termination Reason: CODESIGNING 2 Invalid Page So it's clearly a pointer exceptio
Topic: Code Signing SubTopic: General Tags:
Aug ’25
Signing a daemon with the Endpoint Security entitlement
Note: This failure occurs even when running on the same machine that performed the build, signing, and notarization steps. We are developing a command-line Endpoint Security (ES) client for macOS, distributed to customers as part of an enterprise security suite. We have a valid Apple Developer Team ID (redacted for privacy) and have requested and received the Endpoint Security entitlement for our account. What We’ve Done Built a universal (x86_64/arm64) CLI ES client using Xcode on macOS Sonoma. Signed with a Developer ID Application certificate (matching our Team ID). Applied the entitlement: com.apple.developer.endpoint-security.client. Notarized the binary via notarytool after receiving Apple’s confirmation that the entitlement was “assigned to our account.” Distributed and unzipped the notarized ZIP (with com.apple.quarantine xattr intact). What Happens: When we run the binary (as root, via sudo) on any test Mac—including the original build/notarization machine—the process is killed immediately at launch.
Topic: App & System Services SubTopic: Core OS Tags:
21
0
473
Jul ’25
What is the code signing trust level?
In some crashlog files, there are additional pieces of information related to codesigning. I can understand what most of themcorresponds to (ID, TeamID, Flags, Validation Category). But there is one I have some doubt about: Trust Level. As far as I can tell (or at least what Google and other search engines say), this is an unsigned 32 bit integer that defines the trust level with -1 being untrusted, 0, being basically an Apple executable and other potential bigger values corresponding to App Store binaries, Developer ID signature, etc. Yet, I'm not able to find a corresponding detailed documentation about this on Apple's developer website. I also had a look at the LightweightCodeRequirements include file and there does not seem to be such a field available. [Q] Is there any official documentation listing the different values for this trust level value and providing a clear description of what it corresponds to?
Topic: Privacy & Security SubTopic: General Tags:
4
0
237
Jul ’25