I’ve been having problems with MacOS builds. I’m making a release Appstore build and uploading it to Testflight. However when running it instantly crashes, and report screen shows the following: Current flow: I sign all files in PlugIns/ (we have a number of .bundle), and I’ve tried combinations of signing with/without --entitlements, as well as with/without --deep. After this I sign Frameworks/GameAssembly.dylib and Frameworks/UnityPlayer.dylib. Again, I’ve tried combinations of with/without --entitlements and --deep, also not signing them at all. After signing PlugIns and frameworks, I sign the .app, also tried this with/without --deep (always with --entitlements). Finally I make a .pkg and upload to Testflight. It’s not the game, as I can make an enterprise version that runs fine. We have some restricted entitlements, such as Apple Arcade. Building from an M1 mac, and architecture is Universal (Intel + ARM). Unity documentation says to use --deep, but Apple documentation highly recommend against it. So basically, my question is, how and in what order should I sign the files? Much obliged!

It'd be great if someone would give an overview of the steps to create a new app from an existing one. Can I copy my Xcode project to get started? After I copy my Xcode project, what do I need to do in Xcode? What do I need to do regarding certificate(s) and bundle id. Are there any steps where order is super important? Feel free, of course, to provide a link to an article and/or video on this as that'd be awesome if the information is current. What I've found online is typically out-of-date or more specific - not an overview.

I'm calling this command to export archive: xcodebuild -exportArchive -archivePath .build/XYZ.xcarchive -exportPath .build/XYZ.ipa -exportOptionsPlist Authenticator/ExportOptions.plist -quiet -allowProvisioningUpdates Here is my exportOptions file content <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>method</key> <string>app-store-connect</string> <key>signingStyle</key> <string>automatic</string> <key>teamID</key> <string>ABCD</string> </dict> </plist> Most of the time this command fail with this error: error: exportArchive No Accounts error: exportArchive No signing certificate "iOS Distribution" found What we found is that our Apple ID just disappear from Xcode and we need to add it again manually. So there are two questions here: Why Apple ID account dissapears and how I can fix this? Is there an option to not use Apple ID account in Xcode and for example to use -authenticationKeyID flags of xcodebuild? Just to mention this happens only on our CI machine and not locally.

Hey everyone, We’re running into a frustrating issue with Xcode Cloud builds submitted to App Store Review. After every build, we must manually delete all code signing certificates generated by Xcode Cloud; otherwise, the reviewers can’t open the exported App Store app. When they try to open it, they see the error: “Apple Information Security: A process was blocked from running and moved to Trash: [Our App Name]” Oddly enough, if we delete all Xcode Cloud-generated certificates and then trigger a new Xcode Cloud build, the problem temporarily disappears—until the next submission, where we have to repeat the process. Has anyone else encountered this issue? Any recommendations on how to prevent this from happening? We’d rather not keep trashing certificates after every build. Thanks!

We’re encountering a strange issue with our app submission to the App Review Team. It’s a paid macOS app with no in-app purchases. The App Review Team reports that the app fails to launch, displaying an “App is Damaged” dialog. In the Console app, they see the app exiting with code 173. We don’t have any receipt validation code. I’ve double-checked our code and dependencies, and I don’t see exit(173) being called anywhere. The same builds distributed through TestFlight work fine. Our builds are generated using Xcode Cloud, and the last build was successfully tested by the App Review Team. The only difference between this build and the last successfully tested build is a one-line bug fix—none of the settings or dependencies have changed. Both builds were created and submitted using Xcode Cloud. We’re completely stumped. Has anyone seen this behavior or have suggestions for further debugging? The problem is we can’t seem to reproduce this behaviour anywhere.

I am working on a macos application that uses NetworkExtension and works fine in the debug environment. However, when I use the Release package, I am always prompted that my description file does not contain NetworkExtension. I am sure that my description file does contain NetworkExtension. How to solve this problem

We have a macOS app that has a Photos Extension, which shares documents with the app via an app group container. Historically we used to have an iOS-style group identifier (group.${TeamIdentifier}${groupName}), because we were lead by the web interface in the developer portal to believe this to be the right way to name groups. Later with the first macOS 15 betas last year there was a bug with the operating system warning users, our app would access data from different apps, but it was our own app group container directory. Therefore we added a macOS-style group identifier (${TeamIdentifier}${groupName}) and wrote a migration of documents to the new group container directory. So basically we need to have access to these two app group containers for the foreseeable future. Now with the introduction of iOS-style group identifiers for macOS, Xcode Cloud no longer archives our app for TestFlight or AppStore, because it complains: ITMS-90286: Invalid code signing entitlements - Your application bundle’s signature contains code signing entitlements that aren’t supported on macOS. Specifically, the “[group.${TeamIdentifier}${groupName}, ${TeamIdentifier}${groupName}]” value for the com.apple.security.application-groups key in isn’t supported. This value should be a string or an array of strings, where each string is the “group” value or your Team ID, followed by a dot (“.”), followed by the group name. If you're using the “group” prefix, verify that the provisioning profile used to sign the app contains the com.apple.security.application-groups entitlement and its associated value(s). We have included the iOS-style group identifier in the provisioning profile, generated automatically, but can't do the same for the macOS-style group identifier, because the web interface only accepts identifiers starting with "group". How can we get Xcode Cloud to archive our app again using both group identifiers? Thanks in advance

There seems to be a problem to a specific Apple Developer Account regarding Xcode Cloud Distribution (Signing). The Xcode Cloud Error Invalid Signature. Code failed to satisfy specified code requirement(s). The file at path “XcodeCloudTest.app/XcodeCloudTest” is not properly signed. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate. Verify that the code signing settings in Xcode are correct at the target level (which override any values at the project level). Additionally, make sure the bundle you are uploading was built using a Release target in Xcode, not a Simulator target. If you are certain your code signing settings are correct, choose “Clean All” in Xcode, delete the “build” directory in the Finder, and rebuild your release target. For more information, please consult https://developer.apple.com/support/code-signing. Investigation Apple Developer Forums This issue seems to be known: https://developer.apple.com/forums/thread/746210 Debugging by ourselves We setup an example Xcode project from a default iOS Xcode app template to rule out any project issues. This example project failed with the same error as stated above. In the next step we tried the same example project with a different Apple Developer Account and it successfully distributed the example App through Xcode Cloud. Conclusion It seems like there is no setup issue on developer-side, because our example project works out-of-the-box on a different Apple Developer Account. Our only hope is that Apple will have a look on our Developer Account. Maybe there is some internal setting.

Hello, We use automatic signing and Fastlane on our CI. Fastlane uses xcodebuild to create an archive. xcodebuild -workspace ourApp.xcworkspace -scheme app-dev -destination generic/platform=iOS -archivePath app-dev.xcarchive -skipPackagePluginValidation -allowProvisioningUpdates -authenticationKeyID OurAppStoreConnectAuthKey -authenticationKeyIssuerID OurAppStoreConnectAuthKeyIssuerId -authenticationKeyPath /path/to/OurAppStoreConnectKey.p8 clean archive All works fine, but .... Why does Xcode 16 log out logged Apple ID and create a new every build? As a result, we have more and more Unknown Apple IDs in Xcode, and for each of them an error appears in log. Error: xcodebuild[3174:1804334] DVTDeveloperAccountManager: Failed to load credentials for 0A1DF15C-ETC-ETC: Error Domain=DVTDeveloperAccountCredentialsError Code=0 "Invalid credentials in keychain for 0A1DF15C-ETC-ETC, missing Xcode-Username" UserInfo={NSLocalizedDescription=Invalid credentials in keychain for 0A1DF15C-ETC-ETC, missing Xcode-Username} Of course, the originally logged-in Apple ID has an error corresponding to his non-logged-in state. xcodebuild[3174:1804334] DVTDeveloperAccountManager: Failed to load credentials for originally_logged-in_user: Error Domain=DVTDeveloperAccountCredentialsError Code=0 "Invalid credentials in keychain for originally_logged-in_user, missing Xcode-Token" UserInfo={NSLocalizedDescription=Invalid credentials in keychain for originally_logged-in_user, missing Xcode-Token} Why does this happen and how can it be fixed? Why does Xcode 16 log out its logged Apple ID?

Hey all, I'm experiencing an error, when trying to upload my app to the App Store using Transporter. I build my app with fvm flutter build ipa --release. When I try to upload this, I get the following error: I have already done a rebuild and checked my Provision Profile and certificate

Hi. We're writing Authorization Plugin and started with NullAuthPlugin compilation. When tried to run it on VM (Sonoma 14.6, SIP enabled), we're going into the following issue: `2025-03-08 13:38:20.699503-0800 0xdcb0 Error 0x0 0 0 kernel: (AppleMobileFileIntegrity) [com.apple.MobileFileIntegrity:library_validation_failure] Library Validation failed: Rejecting '/Library/Security/SecurityAgentPlugins/NullAuthPlugin.bundle/Contents/MacOS/NullAuthPlugin' (Team ID: ABCD12EF34, platform: no) for process 'SecurityAgentHel(2094)' (Team ID: N/A, platform: yes), reason: mapping process is a platform binary, but mapped file is not' As I understand, the platform binary is the one signed with Apple signature, which indeed is unavailable for us. How can we avoid this issue and run the plugin? Perhaps we're missing some build setting requirement?

I am signed into Xcode for automatic signing. Which works for a random amount of builds and then the Account/AppleID dissappears from Xcode. This is a vital part of our CI/CD processes and disrupts the workflow alot. MacOS version: Apple M2 15.3 (24D60) Sequoia related: https://developer.apple.com/forums/thread/724434 https://stackoverflow.com/questions/50252887/account-automatically-removed-from-xcode

I am developing a macOS app that requires the Associated Domains entitlement. The app will be distributed as a custom app. The app needs to be signed using Team A’s Developer ID Application certificate and packaged under Team A’s Team ID. Team A has a secure signing and packaging setup, but they do not provide access to their Developer ID Application Identity (cert) or their provisioning profile. I am part of Team B and have access to Team B’s Developer ID Application identity and provisioning profiles. I am thinking of doing the following: I create a provisioning profile under Team B that authorizes the Associated Domains entitlement. I sign the app using Team B’s Developer ID Application identity, ensuring the required entitlements are included. Then, I re-sign the app using Team A’s Developer ID Application identity, since Team A has also set up the same bundle ID with the Associated Domains entitlement and corresponding provisioning profile. Questions: Is this approach correct & does it have any drawback? Will the double signing process work without issues, given that Team A has the required provisioning profile for the same bundle ID? Are there better ways to handle this situation where signing must be done under Team A but access is limited? Thanks!

I have used XCode for decades as my default C/C++ programming IDE. I write code that I run locally on my Mac, via "Sign to run locally". Typically this has always "just worked". I am now using MacOS 14.7 Sonoma, and I suddenly find I cannot run my code projects because I cannot dynamically load unsigned libraries. "not valid for use in process: library load disallowed by system policy" BUT - it appears that to allow my local MacOS code to bypass this requires I have a bundle identifier to modify entitlements. Which in turn requires a developer account which I don't have. Is this all correct? Is there any way to have code run locally and use dynamic libraries as I've done previously? Any advice is much appreciated.

I can't upload my macOS app to app store connect. Each time i try to upload, i see this message: Provisioning profile failed qualification Profile doesn't support App Groups. An empty app without an app group uploads fine, but if i add an app group to it, it does not upload.

I am trying to get a PKG installer through the Apple codesign and notarytool process. When I submit the PKG installer I get a status message of "Invalid" and when I review the log file it has 2 errors. For "status summary" it says: "Archive contains critical validation errors", and for "message" it says" "The binary is not signed". The installer contains a flat file that is installed in the "Users/Shared" folder via the PKG installer. Here are the steps I've taken to get the installer through the codesign and notarytool process. codesign the file that's placed in the "Users/Shared" folder: codesign --options=runtime --sign 'Developer ID Application: XYZ' -v /Users/.../Documents/folder/"flat file" which I get a message saying "signed generic". Create the PKG installer with the signed "flat file". Sign the PKG installer containing the signed "flat file": codesign --options=runtime --sign 'Developer ID Application: XYZ' -v /Users/.../Documents/folder/"flat file" which I get a message saying "signed generic". Submit the PKG file with notarytool: xcrun notarytool submit /Users/.../Documents/folder/"flat file" --verbose --apple-id username --password password --team-id ID# --progress It completes and provides the submission ID. I check the status and get the error message that it's invalid. When I check the full details via the log I get the error messages mentioned above. What am I missing or failing to do?

I have a command line tool that zsh refuses to run when built for Apple Silicon or as a univerisal binary (the specific message is zsh: killed TOOL_NAME). I can only get it to run if I build it exclusively for Intel/Rosetta. Running/debugging from within Xcode works fine for any architecture. The tool is a very simple C/C++ unix command-line tool; it doesn't have any external dependencies beyond the C runtime and the C++ STL. I suspect something in code signing is going awry, but I've tried various team and certificate combinations without any luck. I've also tried enabling/disabling the app sandbox, also without any luck. (The app is not for distribution so it doesn't really need to be code signed at all.) Any suggestions?

I am having difficulty getting my container app with an embedded endpoint security extension to work on a virtual Mac. My virtual Mac has system integrity protection turned off. I have used spctl and System Settings to allow applications from anywhere. I am using the development entitlement profile to sign my container app. When I run my app, it crashes with Termination Reason: COODESIGNING 1 Taskgated Invalid Signature. I assume this has to do with the app being signed with my developer profile that contains a list of Macs that can run the software. How can test my endpoint security extension on a virtual Mac?

Xcode 16.2 Framework Signing Issues with Cloud Managed Developer ID in Automated Builds Issue Description After upgrading from Xcode 15.4 to 16.2, our macOS app's frameworks are failing notarization with the error "The binary is not signed with a valid Developer ID certificate" for embedded frameworks when building through fastlane. This worked correctly in Xcode 15.4. Importantly, manually archiving and notarizing through the Xcode GUI still works correctly - the issue only occurs during automated builds. Build Configuration We use fastlane to build and notarize our macOS app: build_mac_app( scheme: 'Runner', export_method: "developer-id", xcargs: '-allowProvisioningUpdates' ) This generates the following xcodebuild commands: Archive: xcodebuild -workspace ./Runner.xcworkspace -scheme Runner -destination 'generic/platform=macOS' -archivePath /path/to/archive -allowProvisioningUpdates archive Export with plist: xcrun -exportArchive -exportOptionsPlist '/path/to/plist' -archivePath /path/to/archive -exportPath '/output/path' -allowProvisioningUpdates Export options plist contents: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>installerSigningCertificate</key> <string>Developer ID Installer: Company Inc (1234567891)</string> <key>method</key> <string>developer-id</string> <key>signingStyle</key> <string>automatic</string> </dict> </plist> Notarization: ditto -c -k --rsrc --keepParent "My App.app" "My App.app.zip" xcrun notarytool submit "My App.app.zip" --output-format json --wait --key /path/to/key --key-id ABCDEFGHIJ --issuer 12345678-abcd-1234-5678-fc2d96b1735a Error Output Notarization fails with the following errors: { "severity": "error", "code": null, "path": "My App.app.zip/My App.app/Contents/Frameworks/some_package.framework/Versions/A/some_package", "message": "The binary is not signed with a valid Developer ID certificate.", "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721", "architecture": "arm64" } Key Details Using Xcode Cloud managed Developer ID certificates (not local certificates) ✅ Building, archiving, and notarizing through Xcode GUI works correctly Automatic signing is enabled Expected Behavior Frameworks should be automatically signed with the cloud managed Developer ID certificate during the export process, as they were in Xcode 15.4. Has there been a change in how framework signing is handled with cloud managed certificates in Xcode 16.2's command line tools? Any guidance on how to ensure frameworks are properly signed during automated builds when using automatic signing with cloud managed Developer ID certificates would be appreciated.

Hi all, reposting from here: https://unix.stackexchange.com/questions/789849/xattr-c-not-removing-com-apple-finderinfo-attribute I was trying to build my Xcode project, but ran into the error "resource fork, Finder information, or similar detritus not allowed." I was following the solutions from this stack exchange post, but xattr seems to not be working as expected. Basically, running xattr -cr . on my project directory successfully removes all xattrs except for com.apple.FinderInfo, which persists on all .xcodeproj and .xcworkspace files. I've tried everything under the sun, from xattr -d to sudo to dot_clean to tar to rsync and nothing can remove it. Is this just some kind of immortal attribute? It's preventing me from building my project. I'm at a loss here, this is my senior thesis project.