Search results for

“codesign”

3,221 results found

Post

Replies

Boosts

Views

Activity

Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed Generated the Apple Development certificate using Keychain Access on macOS. Added that certificate into my developer account and created the corresponding provisioning profile. Created an App ID, attached the App ID to the provisioning profile, and downloaded it. Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited with code 1: Frameworks/lib
1
0
193
Nov ’25
Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed 1.>Generated the Apple Development certificate using Keychain Access on macOS. 2.>Added that certificate into my developer account and created the corresponding provisioning profile. 3.>Created an App ID, attached the App ID to the provisioning profile, and downloaded it. 4.>Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited wit
1
0
248
Nov ’25
Reply to Archive Fails: Conflict with Existing KEXT Developer ID Certificate
Hi everyone, After extensive testing and verification, we have finally resolved the persistent DriverKit archiving and signing errors. The core issue lies in the fact that Xcode enforces distinctly different certificate requirements for DriverKit targets during the Build Phase versus the Distribution Phase. We are sharing our successful experience to help other developers facing the same trap. 💡 Core Conclusion Do not attempt to configure the Distribution Profile directly in Xcode’s Target settings, as this will cause the build to fail. The correct workflow is: Use Development Certificates (Auto) during the Build/Archive phase, and only swap in the Distribution Certificates (Manual) during the Organizer Distribution phase. 🔍 Root Cause Analysis The DriverKit Linker mandates linking against the Development SDK during the build phase. If you force a manual Distribution Profile in Xcode’s Signing & Capabilities tab, Xcode will fail because it cannot find a matching development certificate (often resulting
Nov ’25
Unable to enable eligibility for External Purchase Link APIs — seeking clarification
Hello, I am currently implementing External Purchase Link and External Purchase Custom Link and am encountering an issue where both ExternalPurchaseLink.canOpen and ExternalPurchaseCustomLink.isEligible always return false under all test conditions. I would like to confirm whether my setup is missing any required steps or whether this behavior is expected. Below are the details of my current environment and configuration: 🔧 1. Development Environment Xcode: 16.3, 16.4, 26.0 beta 4 Devices: iPhone running iOS 26.2 beta iPhone running iOS 16.7.12 macOS 15.5 (real device testing) Simulator iOS 18.0 Build Type: Local development build using a Developer Provisioning Profile Sandbox account signed in during testing 🔑 2. Entitlements (Developer site & Xcode) In Certificates → Identifiers → App ID, both capabilities are enabled: StoreKit External Purchase StoreKit External Purchase Link The .entitlements file in Xcode includes: com.apple.developer.storekit.external-purchase = YES com.apple.developer.storekit.ex
2
0
237
Nov ’25
Reply to Apple-hosted managed asset pack not found on macOS
It appears to be correctly signed. Automatically manage signing is checked, my standard team is set. With those settings, as soon as I assign an app group in Xcode 26.1, it changes to an Xcode managed provisioning profile and my valid Apple Development certificate and does not let me change them. I also checked the build with codesign -dv --verbose=4 and in ~/Library/Developer/Xcode/UserData/Provisioning Profiles to verify and that the profiles update, e.g., when I change the Info.plist. I also tried setting up a fresh sample project from the standard multiplatform SwiftUI app template in Xcode and did not change anything in Signing & Capabilities except setting the app group for the app and download extension. Same minimal app just calling AssetPackManager.shared.assetPack(withID:), same result: on iOS it works, on macOS the URL override is not permitted.
Topic: App & System Services SubTopic: General Tags:
Nov ’25
Xcode Cloud cannot detect my custom build script
Subject: Xcode Cloud not detecting ci_scripts/ci_post_clone.sh for Flutter iOS build Description: I'm attempting to build a Flutter iOS app using Xcode Cloud, but the build is failing because Xcode Cloud cannot detect my custom build script located at ci_scripts/ci_post_clone.sh in the repository root. Setup: Repository: https://github.com/GlamTam2000/King-chi-app Branch: ios-build-legacy Xcode Project: flutter_application_1/ios/Runner.xcworkspace Xcode Version specified: 15.4 Issue: The Xcode Cloud build logs consistently show: Post-Clone script not found at ci_scripts/ci_post_clone.sh However, the script file is confirmed to exist in the repository: The file is committed and pushed to GitHub (commit 9bd3aa1) Local git verification: git ls-tree HEAD ci_scripts/ shows the file exists File permissions: 100755 (executable) File location: Repository root /ci_scripts/ci_post_clone.sh What I've tried: Created ci_scripts/ci_post_clone.sh at repository root with executable permissions Ensured Unix line endings (LF,
0
0
185
Nov ’25
Malware warnings on properly notarized apps
Hello, I've been developing a mac app built with Electron Builder. In August, I was successfully notarizing my app and able to send it to testers without them receiving a malware warning. I took a two month break. When I came back in October, I am not able to distribute my app without the malware warning. I can't for the life of me figure out what I could be missing, unless my developer account was flagged by Apple for some reason. All the diagnostics I run on my app package show that it is properly signed, notarized, and stapled. Here are some diagnostics I have run on the app: Command: codesign -dv --verbose=4 /Volumes/Form Desktop 1/Form.app Output: Executable=/Volumes/Form Desktop 1/Form.app/Contents/MacOS/Form Identifier=co.Form.desktop Format=app bundle with Mach-O thin (arm64) CodeDirectory v=20500 size=763 flags=0x10000(runtime) hashes=13+7 location=embedded VersionPlatform=1 VersionMin=720896 VersionSDK=917504 Hash type=sha256 size=32 CandidateCDHash sha256=cedcaef933c003c01b4d9ef6925a413fe6
6
0
438
Nov ’25
Reply to "Signing certificate" and post-installation assignment fail due to IOPCIPrimaryMatch
I'm currently developing using sign to run locally and have been able to confirm the expected behavior. I was considering signing with Developer ID Application for future distribution to customers, but after finding the following forum, I'm now aiming to sign with Apple Development. https://developer.apple.com/forums/thread/743021 I've already replied on that post and my advice to you is going to be the same (Switch everything to automatic!) with one addition. Looking at you account, you entitlement.plist configuration should be: com.apple.developer.driverkit.transport.pci IOPCIPrimaryMatch 0x00001916&0x0000FFFF ...which matches what you were approved for. That value will display in Xcode as: 0x00001916&0x0000FFFF By the way, when I used sign to run locally, both the installation and assignment were successful with the following: IOPCIPrimaryMatch 0xFFFFFFFF&0x00161916 Unfortunately, signing locally can be deeply misleading, as it basically works by disabling exactly the validation that's fail
Topic: Code Signing SubTopic: Entitlements Tags:
Nov ’25
Unable to find identity (but have private key and certificate)
I'm unable to sign the an example application using xcode and automatically manage signing. The error I'm getting is: CodeSign [...] (in target 'foobar' from project 'foobar') Signing Identity: Apple Development: [xxxx] /usr/bin/codesign --force --sign 4ABB258102FF656E9F597546A49274C28D2B8B3E -o runtime --timestamp=none --generate-entitlement-der [filename] 4ABB258102FF656E9F597546A49274C28D2B8B3E: no identity found Command CodeSign failed with a nonzero exit code However, I am able to see a certificate and a private identity on my keychain: % security find-certificate -aZ | grep -i 4ABB258102FF656E9F597546A49274C28D2B8B3E SHA-1 hash: 4ABB258102FF656E9F597546A49274C28D2B8B3E and % security find-key -s | grep -q 'Apple Development' && echo YES YES what is puzzling is that security does not find an identity: % security find-identity -p codesigning Policy: Code Signing Matching identities 0 identities found Valid identities only 0 valid identities found but XCode clai
13
0
1.3k
Nov ’25
Reply to Notary service down again?
Apologies I am now having troubles getting this to recreate again even using the exact same submission. I will keep trying and hopefully get you something you can work with. What do you consider building with Apple tools? This is our process for building as we are a golang application developed outside of xcode. For each inner PKG: create universal binary sign and verify the binary codesign --sign Developer ID Application: --deep --timestamp --options=runtime codesign --verify --verbose build and sign the inner pkg pkgbuild --root ConcealBrowse.pkg --scripts --sign Developer ID Installer: --install-location /Applications --identifier io.conceal.helper --version pkgutil --check-signature signed-installers/ConcealBrowse.pkg Notarize and staple the PKG xcrun notarytool submit --key --key-id -i ConcealBrowse.pkg --wait xcrun stapler staple ConcealBrowse.pkg After we repeat the above process for all three of our inner PKGs I build and sign the Distribution PKG productbuild --distributio
Topic: Code Signing SubTopic: Notarization Tags:
Nov ’25
Reply to Enhanced Security Capability < iOS 26
Please file a bug about this. There’s advice on how to gather the necessary info in that error alert, and it’d be great if you attach that to your bug report. Once you’re done, please post your bug number, just for the record When you click the Show Details button in that error alert it shows a bunch of info about what’s causing the error. It’s clearly grumpy about the provisioning profile. However, when you compare the profile’s allowlist and the code signature’s claims, things generally look OK. One thing I did notice is that there’s a bit of a mix up about the type of the com.apple.security.hardened-process.enhanced-security-version entitlement. That’s documented to be a string, and the profile’s allow list uses a string value of *. However, the code signature claims an integer value of 1. I manually re-signed the app to use a string: % cat tmp.entitlements … … com.apple.security.hardened-process.enhanced-security-version 1 … % /usr/bin/codesign --force --sign 09513FD4A03387429F6568048A5F76A743
Topic: Privacy & Security SubTopic: General Tags:
Nov ’25
Reply to Provisioning profile entitlements
[quote='806186021, binarytwist, /thread/806186, /profile/binarytwist'] How can I get a provisioning profile that only has the entitlements that I actually need? [/quote] You shouldn’t need to do this. The entitlements in a provisioning profile act as an allowlist. For an in-depth explanation of that, see TN3125 Inside Code Signing: Provisioning Profiles. When you enable the NE capability on an App ID and generate a profile for that App ID, the Developer website includes all NE types supported by the target platform. Hence the presence of url-filter-provider value. However, this is just an allowlist. The entitlements you claim are those in your code signature, and that’s what the Validate App should be checking. [quote='806186021, binarytwist, /thread/806186, /profile/binarytwist'] My entitlement file has [/quote] Your .entitlements file isn’t the source of truth here. It’s source code that acts as an input to the Xcode build system. So you need to check the entitlements on your built binary. Do this: In the X
Nov ’25
Stuck waiting on Family Controls distribution entitlement, first indie app, looking for guidance/timelines
Hi everyone, solo iOS dev here. I’ve built a small focus app (“Modo”) that uses Apple’s Screen Time APIs to help curb social-media overuse. In development everything works: FamilyActivityPicker for selection, a DeviceActivityMonitor extension for schedules, and ManagedSettings shields (plus uninstall guard only while “Blocked” is active). I requested the Family Controls distribution entitlement so I can ship, but my capability request has been pending for a while and I’m not sure what the usual path forward is. What I’ve already done • Submitted the capability request (Account Holder), describing the use case (self-control / digital well-being), user consent flow,. • Implemented app + DeviceActivityMonitor + ManagedSettingsUI extensions; verified the debug build has the right entitlements and behavior. • Regenerated profiles after the request; checked codesign entitlements on the built targets. • Filed a Developer Support ticket referencing the capability request. I really appreciate any timelines, e
1
0
264
Nov ’25
App Packaging: bundle format unrecognized, invalid, or unsuitable
I am trying to package a Filemaker 18 Runtime app. A week ago, I managed to get 90% of the way towards doing as much, using MS Copilot as a guide. Unfortunately, due to my confusion over the landing stage files, I decided to start the process from scratch. This time, I fell at the first stage: Code Signing my .app Bundle. The Terminal command: codesign --deep --force --verify --verbose --sign Developer ID Application: ME (V********) /Users/Me/Documents/Apps/MyApp/Runtime/MyApp/My App.app Returned the error: /Users/Me/Documents/Apps/MyApp/Runtime/MyApp/My App.app: bundle format unrecognized, invalid, or unsuitable In subcomponent: /Users/Me/Documents/Apps/MyApp/Runtime/MyApp/My App.app/Contents/Frameworks/FMWrapper.framework No matter how many separate elements within the bundle I sign, I encounter the same error message. A few days ago, the identical command worked first time. I would be obliged for any help you can provide. Thanks.
3
0
330
Nov ’25
Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed Generated the Apple Development certificate using Keychain Access on macOS. Added that certificate into my developer account and created the corresponding provisioning profile. Created an App ID, attached the App ID to the provisioning profile, and downloaded it. Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited with code 1: Frameworks/lib
Replies
1
Boosts
0
Views
193
Activity
Nov ’25
Unable to Generate .ipa for .NET MAUI iOS App – Codesign Fails With “unable to build chain to self-signed root”
Hi everyone, I am trying to generate an .ipa file for my .NET MAUI (net9.0-ios) application, but every attempt fails with the same codesigning error. I have tried multiple approaches, including building from Windows paired to macOS, and directly building through the macOS terminal, but nothing is working. Below are the exact steps I followed: Steps I Performed 1.>Generated the Apple Development certificate using Keychain Access on macOS. 2.>Added that certificate into my developer account and created the corresponding provisioning profile. 3.>Created an App ID, attached the App ID to the provisioning profile, and downloaded it. 4.>Added the provisioning profile into Xcode. Verified that the certificate is correctly visible in Keychain Access (private key available). Attempted to build/publish the MAUI app to generate the .ipa file. Issue Whenever I run the publish command or build via Windows/macOS, codesigning fails with the following error: /usr/bin/codesign exited wit
Replies
1
Boosts
0
Views
248
Activity
Nov ’25
Reply to Archive Fails: Conflict with Existing KEXT Developer ID Certificate
Hi everyone, After extensive testing and verification, we have finally resolved the persistent DriverKit archiving and signing errors. The core issue lies in the fact that Xcode enforces distinctly different certificate requirements for DriverKit targets during the Build Phase versus the Distribution Phase. We are sharing our successful experience to help other developers facing the same trap. 💡 Core Conclusion Do not attempt to configure the Distribution Profile directly in Xcode’s Target settings, as this will cause the build to fail. The correct workflow is: Use Development Certificates (Auto) during the Build/Archive phase, and only swap in the Distribution Certificates (Manual) during the Organizer Distribution phase. 🔍 Root Cause Analysis The DriverKit Linker mandates linking against the Development SDK during the build phase. If you force a manual Distribution Profile in Xcode’s Signing & Capabilities tab, Xcode will fail because it cannot find a matching development certificate (often resulting
Replies
Boosts
Views
Activity
Nov ’25
Unable to enable eligibility for External Purchase Link APIs — seeking clarification
Hello, I am currently implementing External Purchase Link and External Purchase Custom Link and am encountering an issue where both ExternalPurchaseLink.canOpen and ExternalPurchaseCustomLink.isEligible always return false under all test conditions. I would like to confirm whether my setup is missing any required steps or whether this behavior is expected. Below are the details of my current environment and configuration: 🔧 1. Development Environment Xcode: 16.3, 16.4, 26.0 beta 4 Devices: iPhone running iOS 26.2 beta iPhone running iOS 16.7.12 macOS 15.5 (real device testing) Simulator iOS 18.0 Build Type: Local development build using a Developer Provisioning Profile Sandbox account signed in during testing 🔑 2. Entitlements (Developer site & Xcode) In Certificates → Identifiers → App ID, both capabilities are enabled: StoreKit External Purchase StoreKit External Purchase Link The .entitlements file in Xcode includes: com.apple.developer.storekit.external-purchase = YES com.apple.developer.storekit.ex
Replies
2
Boosts
0
Views
237
Activity
Nov ’25
Reply to Apple-hosted managed asset pack not found on macOS
It appears to be correctly signed. Automatically manage signing is checked, my standard team is set. With those settings, as soon as I assign an app group in Xcode 26.1, it changes to an Xcode managed provisioning profile and my valid Apple Development certificate and does not let me change them. I also checked the build with codesign -dv --verbose=4 and in ~/Library/Developer/Xcode/UserData/Provisioning Profiles to verify and that the profiles update, e.g., when I change the Info.plist. I also tried setting up a fresh sample project from the standard multiplatform SwiftUI app template in Xcode and did not change anything in Signing & Capabilities except setting the app group for the app and download extension. Same minimal app just calling AssetPackManager.shared.assetPack(withID:), same result: on iOS it works, on macOS the URL override is not permitted.
Topic: App & System Services SubTopic: General Tags:
Replies
Boosts
Views
Activity
Nov ’25
Xcode Cloud cannot detect my custom build script
Subject: Xcode Cloud not detecting ci_scripts/ci_post_clone.sh for Flutter iOS build Description: I'm attempting to build a Flutter iOS app using Xcode Cloud, but the build is failing because Xcode Cloud cannot detect my custom build script located at ci_scripts/ci_post_clone.sh in the repository root. Setup: Repository: https://github.com/GlamTam2000/King-chi-app Branch: ios-build-legacy Xcode Project: flutter_application_1/ios/Runner.xcworkspace Xcode Version specified: 15.4 Issue: The Xcode Cloud build logs consistently show: Post-Clone script not found at ci_scripts/ci_post_clone.sh However, the script file is confirmed to exist in the repository: The file is committed and pushed to GitHub (commit 9bd3aa1) Local git verification: git ls-tree HEAD ci_scripts/ shows the file exists File permissions: 100755 (executable) File location: Repository root /ci_scripts/ci_post_clone.sh What I've tried: Created ci_scripts/ci_post_clone.sh at repository root with executable permissions Ensured Unix line endings (LF,
Replies
0
Boosts
0
Views
185
Activity
Nov ’25
Malware warnings on properly notarized apps
Hello, I've been developing a mac app built with Electron Builder. In August, I was successfully notarizing my app and able to send it to testers without them receiving a malware warning. I took a two month break. When I came back in October, I am not able to distribute my app without the malware warning. I can't for the life of me figure out what I could be missing, unless my developer account was flagged by Apple for some reason. All the diagnostics I run on my app package show that it is properly signed, notarized, and stapled. Here are some diagnostics I have run on the app: Command: codesign -dv --verbose=4 /Volumes/Form Desktop 1/Form.app Output: Executable=/Volumes/Form Desktop 1/Form.app/Contents/MacOS/Form Identifier=co.Form.desktop Format=app bundle with Mach-O thin (arm64) CodeDirectory v=20500 size=763 flags=0x10000(runtime) hashes=13+7 location=embedded VersionPlatform=1 VersionMin=720896 VersionSDK=917504 Hash type=sha256 size=32 CandidateCDHash sha256=cedcaef933c003c01b4d9ef6925a413fe6
Replies
6
Boosts
0
Views
438
Activity
Nov ’25
Reply to "Signing certificate" and post-installation assignment fail due to IOPCIPrimaryMatch
I'm currently developing using sign to run locally and have been able to confirm the expected behavior. I was considering signing with Developer ID Application for future distribution to customers, but after finding the following forum, I'm now aiming to sign with Apple Development. https://developer.apple.com/forums/thread/743021 I've already replied on that post and my advice to you is going to be the same (Switch everything to automatic!) with one addition. Looking at you account, you entitlement.plist configuration should be: com.apple.developer.driverkit.transport.pci IOPCIPrimaryMatch 0x00001916&0x0000FFFF ...which matches what you were approved for. That value will display in Xcode as: 0x00001916&0x0000FFFF By the way, when I used sign to run locally, both the installation and assignment were successful with the following: IOPCIPrimaryMatch 0xFFFFFFFF&0x00161916 Unfortunately, signing locally can be deeply misleading, as it basically works by disabling exactly the validation that's fail
Topic: Code Signing SubTopic: Entitlements Tags:
Replies
Boosts
Views
Activity
Nov ’25
Unable to find identity (but have private key and certificate)
I'm unable to sign the an example application using xcode and automatically manage signing. The error I'm getting is: CodeSign [...] (in target 'foobar' from project 'foobar') Signing Identity: Apple Development: [xxxx] /usr/bin/codesign --force --sign 4ABB258102FF656E9F597546A49274C28D2B8B3E -o runtime --timestamp=none --generate-entitlement-der [filename] 4ABB258102FF656E9F597546A49274C28D2B8B3E: no identity found Command CodeSign failed with a nonzero exit code However, I am able to see a certificate and a private identity on my keychain: % security find-certificate -aZ | grep -i 4ABB258102FF656E9F597546A49274C28D2B8B3E SHA-1 hash: 4ABB258102FF656E9F597546A49274C28D2B8B3E and % security find-key -s | grep -q 'Apple Development' && echo YES YES what is puzzling is that security does not find an identity: % security find-identity -p codesigning Policy: Code Signing Matching identities 0 identities found Valid identities only 0 valid identities found but XCode clai
Replies
13
Boosts
0
Views
1.3k
Activity
Nov ’25
Reply to Persistent Code Signing Failure (HTTP 403) After Accepting Apple Developer Agreement
Code signing is usually a local operation, so it’s not clear how this is getting an HTTP server error. Where are you seeing this error? In Xcode? When running codesign directly? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Replies
Boosts
Views
Activity
Nov ’25
Reply to Notary service down again?
Apologies I am now having troubles getting this to recreate again even using the exact same submission. I will keep trying and hopefully get you something you can work with. What do you consider building with Apple tools? This is our process for building as we are a golang application developed outside of xcode. For each inner PKG: create universal binary sign and verify the binary codesign --sign Developer ID Application: --deep --timestamp --options=runtime codesign --verify --verbose build and sign the inner pkg pkgbuild --root ConcealBrowse.pkg --scripts --sign Developer ID Installer: --install-location /Applications --identifier io.conceal.helper --version pkgutil --check-signature signed-installers/ConcealBrowse.pkg Notarize and staple the PKG xcrun notarytool submit --key --key-id -i ConcealBrowse.pkg --wait xcrun stapler staple ConcealBrowse.pkg After we repeat the above process for all three of our inner PKGs I build and sign the Distribution PKG productbuild --distributio
Topic: Code Signing SubTopic: Notarization Tags:
Replies
Boosts
Views
Activity
Nov ’25
Reply to Enhanced Security Capability < iOS 26
Please file a bug about this. There’s advice on how to gather the necessary info in that error alert, and it’d be great if you attach that to your bug report. Once you’re done, please post your bug number, just for the record When you click the Show Details button in that error alert it shows a bunch of info about what’s causing the error. It’s clearly grumpy about the provisioning profile. However, when you compare the profile’s allowlist and the code signature’s claims, things generally look OK. One thing I did notice is that there’s a bit of a mix up about the type of the com.apple.security.hardened-process.enhanced-security-version entitlement. That’s documented to be a string, and the profile’s allow list uses a string value of *. However, the code signature claims an integer value of 1. I manually re-signed the app to use a string: % cat tmp.entitlements … … com.apple.security.hardened-process.enhanced-security-version 1 … % /usr/bin/codesign --force --sign 09513FD4A03387429F6568048A5F76A743
Topic: Privacy & Security SubTopic: General Tags:
Replies
Boosts
Views
Activity
Nov ’25
Reply to Provisioning profile entitlements
[quote='806186021, binarytwist, /thread/806186, /profile/binarytwist'] How can I get a provisioning profile that only has the entitlements that I actually need? [/quote] You shouldn’t need to do this. The entitlements in a provisioning profile act as an allowlist. For an in-depth explanation of that, see TN3125 Inside Code Signing: Provisioning Profiles. When you enable the NE capability on an App ID and generate a profile for that App ID, the Developer website includes all NE types supported by the target platform. Hence the presence of url-filter-provider value. However, this is just an allowlist. The entitlements you claim are those in your code signature, and that’s what the Validate App should be checking. [quote='806186021, binarytwist, /thread/806186, /profile/binarytwist'] My entitlement file has [/quote] Your .entitlements file isn’t the source of truth here. It’s source code that acts as an input to the Xcode build system. So you need to check the entitlements on your built binary. Do this: In the X
Replies
Boosts
Views
Activity
Nov ’25
Stuck waiting on Family Controls distribution entitlement, first indie app, looking for guidance/timelines
Hi everyone, solo iOS dev here. I’ve built a small focus app (“Modo”) that uses Apple’s Screen Time APIs to help curb social-media overuse. In development everything works: FamilyActivityPicker for selection, a DeviceActivityMonitor extension for schedules, and ManagedSettings shields (plus uninstall guard only while “Blocked” is active). I requested the Family Controls distribution entitlement so I can ship, but my capability request has been pending for a while and I’m not sure what the usual path forward is. What I’ve already done • Submitted the capability request (Account Holder), describing the use case (self-control / digital well-being), user consent flow,. • Implemented app + DeviceActivityMonitor + ManagedSettingsUI extensions; verified the debug build has the right entitlements and behavior. • Regenerated profiles after the request; checked codesign entitlements on the built targets. • Filed a Developer Support ticket referencing the capability request. I really appreciate any timelines, e
Replies
1
Boosts
0
Views
264
Activity
Nov ’25
App Packaging: bundle format unrecognized, invalid, or unsuitable
I am trying to package a Filemaker 18 Runtime app. A week ago, I managed to get 90% of the way towards doing as much, using MS Copilot as a guide. Unfortunately, due to my confusion over the landing stage files, I decided to start the process from scratch. This time, I fell at the first stage: Code Signing my .app Bundle. The Terminal command: codesign --deep --force --verify --verbose --sign Developer ID Application: ME (V********) /Users/Me/Documents/Apps/MyApp/Runtime/MyApp/My App.app Returned the error: /Users/Me/Documents/Apps/MyApp/Runtime/MyApp/My App.app: bundle format unrecognized, invalid, or unsuitable In subcomponent: /Users/Me/Documents/Apps/MyApp/Runtime/MyApp/My App.app/Contents/Frameworks/FMWrapper.framework No matter how many separate elements within the bundle I sign, I encounter the same error message. A few days ago, the identical command worked first time. I would be obliged for any help you can provide. Thanks.
Replies
3
Boosts
0
Views
330
Activity
Nov ’25