Search results for

codesign

3,111 results found

Post

Replies

Boosts

Views

Activity

Reply to Command CodeSign failed with a nonzero exit code - OpenGL
When you get an error like this, codesign usually outputs something helpful to the build report. I explain how to get at that in Command [something] failed with a nonzero exit code. What are you seeing? Sign to Run Locally should be fine in this context, but I generally recommend that you use Apple Development signing. You don’t have to pay to join the Apple Developer Program to use that. Rather, use your existing Apple Account to log in to Xcode > Settings > Accounts and Xcode will set up a Personal Team. IMPORTANT The Personal Team feature has significant limitations. For the details, see Developer > Support > Choosing a Membership. However, those limits are primarily relevant to iOS. Mac developers generally don’t even notice (-: Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com
Topic: Code Signing SubTopic: General
Jul ’25
Reply to Signing a daemon with the Endpoint Security entitlement
[quote='848635022, Darrilla, /thread/791996?answerId=848635022#848635022, /profile/Darrilla'] I have sent you a PM on the DTS support request with a link to download the file [/quote] Got it. Thanks! The issue here is a Developer ID certificate mismatch. Recall from TN3125 Inside Code Signing: Provisioning Profiles that your provisioning profile ties together the who, what, where, when, and how your code can run. Everything in your profile looks fine except the who. It seems your account has two Developer ID Application certificates, and your ‘app’ is signed with one but your profile authorises the other. Contrast this: % codesign -d --extract-certificates YourApp.app … % openssl x509 -inform der -in codesign0 -text Certificate: Data: Version: 3 (0x2) Serial Number: 6277427490450603824 (0x571de70b17947f30) … with this: % security cms -D -i YourApp.app/Contents/embedded.provisionprofile -o profile.plist % plutil -extract DeveloperCertificates.0 raw -o - profile.plist | base64 -D > profile.cer % ope
Topic: App & System Services SubTopic: Core OS Tags:
Jul ’25
Codesign -- force not signing 3rd Pty binaries
This math-educational 3D-graphics courseware utilizes Java3D, which sits on top of hardware-dependent JOGAMP binaries (which instruct at the GPU-level). This code signing command applied to the installer .dmg: codesign -s myName --force --options runtime ~/DFG2D_MacOS_Manufacturing/MacOSInstallers/DFG2D_Mac_J1602_x86/DataflowGeometry2D-1.0.300.dmg is supposed to force signing of all the embedded binaries, BUT the notary tool finds about 25 jogamp-fat dynamic libraries (/ *.dylib) UNSIGNED. Processing complete id: 23d81a99-4087-48d2-a567-8072dd2820fe status: Invalid pierrebierre@Pierres-iMac ~ % xcrun notarytool log 17d2fe94-f38a-47d4-9568-cf4dc65f24c9 --apple-id xxxxxxxxxxx --team-id XXXXXXXXX --password pwpwpwpwpw { logFormatVersion: 1, jobId: 17d2fe94-f38a-47d4-9568-cf4dc65f24c9, status: Invalid, statusSummary: Archive contains critical validation errors, statusCode: 4000, archiveFilename: DataflowGeometry2D-1.0.300.dmg, uploadDate: 2025-07-13T21:28:21.147Z, sha256: 57320c4ad4a07f144336084152bf7e33
Topic: Code Signing SubTopic: General
9
0
394
Jul ’25
Keychain Access won't let me Export to a .p12 file
I've successfully distributed a Java-based app .dmg from my intel iMac, but am trying to port over the signing authority ( Certificate and Identity) to an M2. I'm following the backup your Identities recipe to make a .p12 file, but I can't complete the Export. The .p12 file format option is greyed out (while .pem and .cer are offered). What could be causing this? I can sign my .dmg installers from this computer, so codesign is happy with what it is seeing in the Keychain.
Topic: Code Signing SubTopic: Certificates, Identifiers & Profiles
6
0
508
Jul ’25
Command CodeSign failed with a nonzero exit code - OpenGL
Hey, So i am trying to setup OpenGL on my mac. Specs : M2 Pro, 15.5 (24F74) Now i have setup the entire project properly as far as i know. GLFW, GLAD and the OpenGL framework. the build libraries are also reference and everything. I have also included the glad.c file in the folder. i have also kept it to run locally in signing tab. its still giving me Command CodeSign failed with a nonzero exit code All the ss are provided
Topic: Code Signing SubTopic: General
1
0
449
Jul ’25
Notarization accepted, but the staple and validate action failed! Error 65.
Hi guys, I am new to publishing apps on Apple Store. I used python, pyside6, torch, pyinstaller to build an app for Apple Store. For codesigning, I used the correct Developer ID Application to sign the code. When I validate the .app file (codesign -vv --strict ), I got the following my_app.app: valid on disk my_app.app: satisfies its Designated Requirement Next, I used ditto to ditto -c -k --sequesterRsrc --keepParent my_app.app my_app.zip to zip it. Then, I submitted this my_app.zip file for notarization with xcrun notarytool submit ... and got the following accepted message. Received new status: Accepted Current status: Accepted............... [20:08:54.530Z] Info [API] Submission in terminal status: Accepted Processing complete After that, I want to staple it with xcrun stapler staple my_app.app, but I got the following Could not validate ticket for my_app.app The staple and validate action failed! Error 65. To further investigate it, I ran spctl -a -vvv my_app.app and got my_app.app: rej
Topic: Code Signing SubTopic: Notarization Tags:
1
0
331
Jul ’25
Reply to Codesigning in Europe still doesn't work with IPv6
[quote='848428022, intown, /thread/792209?answerId=848428022#848428022, /profile/intown'] Is there anyway I can get some assistance. [/quote] It’s hard to say without knowing more about the problem you’re experiencing. If this is a technical problem, then I recommend that you open a new thread here on the forums with the details [1]. Please pay careful attention to the topic, subtopic, and tags you choose, because many of us use that info to find relevant questions. For more info on how to use the forums effectively, see Quinn’s Top Ten DevForums Tips. OTOH, if this is a non-technical problem then the Apple Developer Forums might not be the right option. In that case, post a short summary of the issue here and I’ll see if I can offer a path forward. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] Unless the problem happens to be about codesigning timestamps on IPv6 networks in Europe, but that seems unlikely. But, hey, if it doe
Topic: Code Signing SubTopic: General Tags:
Jul ’25
Reply to Correct formatting of webcredentials app id
I want to be clear about terms here: A bundle ID is how the system uniquely identifies your app. It’s typically in reverse DNS format, for example, com.apple.iWork.Pages. An App ID is composed of an App ID prefix and a bundle ID. For example, 74J34U3R6X.com.apple.iWork.Pages. The App ID prefix is typically your Team ID, but iOS previously used to require unique App ID prefixes, where you allocate a prefix that’s different from your Team ID. The apple-app-site-association file is expecting App IDs. There’s no ambiguity there. For any given App ID, the prefix is either the Team ID or a unique value. There are plenty of ways to determine your App ID but my preferred option is: Using Xcode, build your app for the device. Using Terminal, dump its entitlements: % codesign -d --entitlements - /path/to/your.app Look for the application-identifier entitlement (com.apple.application-identifier for Mac apps). If your app is currently using a unique App ID prefix, there are good reasons to convert it to use your
Topic: App & System Services SubTopic: General Tags:
Jul ’25
Reply to Signing a daemon with the Endpoint Security entitlement
fidelisevents % syspolicy_check distribution ./bin/FidelisEvents.app/Contents/MacOS/fidelisevents App passed all pre-distribution checks and is ready for distribution. fidelisevents % syspolicy_check distribution ./bin/FidelisEvents.app App passed all pre-distribution checks and is ready for distribution. And yes, I did this after removing the negative flags in the entitlement: codesign -d --entitlements :- ./fidelisevents.app Executable=/Users/darrelburns/devel/fidelisevents/bin/FidelisEvents.app/Contents/MacOS/fidelisevents warning: Specifying ':' in the path is deprecated and will not work in a future release Current Status: I’ve followed all documented Apple and forum guidance for deploying a non-system-extension Endpoint Security client as a Developer ID app bundle. I have: Embedded a Developer ID Application provisioning profile with the Endpoint Security entitlement (confirmed by developer.apple.com, profile XML, and all tools). Used codesign, spctl, and syspolicy_check distribution (
Topic: App & System Services SubTopic: Core OS Tags:
Jul ’25
Signing Issues with VisionOS app
I am having an issue with signing and provisioning a Vision OS app. I have an iOS app and a VisionOS app. Everything works fine on the iOS but having issues with the VisionOS. First, I am having issues with xcodebuild -exportArchive. When I run it on an archive of my VisionOS app I get ** EXPORT FAILED ** error: exportArchive No Accounts error: exportArchive No profiles for 'X' were found Where X is my bundle ID. Meanwhile the iOS app succeeds. This is on a CI machine but I confirmed the distribution provision profile for the vision OS app is installed on the machine. Even if I change the value of the -exportOptionsPlist to the one I used for the iOS project I get this error. Is the issue in the archive itself? The archives are generated from building in Unity and archiving the xcodeproject with xcodebuild archive Second, as a workaround I archived a debug ipa on my machine and uploaded this ipa to my CI machine which has the credentials to sign for distribution. I use this script as an example as how to resi
Topic: Developer Tools & Services SubTopic: Xcode Tags:
0
0
143
Jul ’25
Reply to Signing a daemon with the Endpoint Security entitlement
After learning that Endpoint Security (ES) clients must be packaged in an “app-like” structure to use a provisioning profile, I followed Apple’s technical note and Quinn’s advice: Steps Taken App Bundle Creation Created a bundle named FidelisEvents.app, with standard macOS .app layout. Placed my universal Mach-O (x86_64/arm64) binary at FidelisEvents.app/Contents/MacOS/fidelisevents. Added an Info.plist at FidelisEvents.app/Contents/Info.plist with the correct CFBundleIdentifier and metadata (matching the provisioning profile/App ID). Provisioning Profile Embedded the provisioning profile at FidelisEvents.app/Contents/embedded.provisionprofile. Profile type: Developer ID Application for macOS. App ID and team identifier match the bundle and entitlements. Profile entitlements explicitly include: com.apple.application-identifier com.apple.developer.team-identifier com.apple.developer.endpoint-security.client Confirmed by extracting and inspecting the embedded profile. Entitlements Used an entitlements plist at
Topic: App & System Services SubTopic: Core OS Tags:
Jul ’25
Reply to Root issue is missing entitlement in NFC App
My initial post was not very clear, adding some supporting information below: Initial NFC session establishes successfully Failure occurs immediately on first APDU transmission Configuration & Verification: Xcode Capabilities: Near Field Communication Tag Reading is enabled in the target's Signing & Capabilities tab. entitlements File: com.apple.developer.nfc.readersession.formats is correctly set to an array containing only TAG. (Confirmed ISO7816 should NOT be directly in this array based on Apple documentation). com.apple.developer.nfc.readersession.formats TAG Info.plist Configuration: Privacy - NFC Scan Usage Description (NFCReaderUsageDescription) is present. com.apple.developer.nfc.readersession.iso7816.select-identifiers is correctly configured with an array of relevant YubiKey AIDs, including the OATH AID (A000000527210101) and others. codesign Output : After building the app, running codesign -d --entitlements :- /path/to/YourAppName.app explicitly confirms that the com.app
Topic: App & System Services SubTopic: Core OS Tags:
Jul ’25
Reply to Codesigning in Europe still doesn't work with IPv6
This is the line I was adding to /etc/pf.conf on every reboot: block drop from any to 2620:149:981:603::10 ETA: I want to be clear that the ridiculous part is that it's been going on for over a year, that I never got any response even after I mentioned in at least one forum comment that it was still occurring here, and that codesign after decades continues to give no error messages on failure. Oh, also that it doesn't clean up the .cstemp files it leaves behind, which admittedly were the only clue I had what was going on.
Topic: Code Signing SubTopic: General Tags:
Jul ’25