Hello We are developing an application which using System Extension and all works as excepted, exclude one important thing - during the application launch we receive a system notification that System Extension is Blocked and we need to Allow it via System Preferences -> Security & Privacy (it require an admin password). So the question: Does it possible to avoid this behaviour? It's really very annoying customers to perform this actions by themselves. Our distribution flow is typical: We distribute application as a PKG Before distribution we notirize PKG installer and App (zip it and send to Apple Notarization Service via terminal) - notirize is passed and archives approved by Apple We are using Developer ID and manual signature in XCode for all components of application (main app, extension, cli daemon app) I tried zip system.extension and send it to notirize service and staple it after that. I saw that it notirized successfully but on first launch when app trigger System Extension installation macOS show popup that "System Extension Blocked" When user allow this System Extension macOS will ask him that application would like to add proxy configuration - it's okay, but Blocked System Extension is a real problem. We want to provide a better user experience and if it's possible it will be good to solve this issue. If somebody can assist or give us an accurate explanation that it's not possible and System Extension will be blocked in all cases I will be really glad. I can provide any additional information, if it required. Our screenshot: P.S. As I know there are many applications have got the same problem, for example I am as a user have got this behaviour for Cisco AnyConnect - I need to allow it in System Preferences on first launch 😢

I'm trying to create a project to obtain the URL for my domain to start developing my first website. I started searching to learn how to find what I'm looking for in the documentation and found the URL in the Foundation at Fundamentals and want to know what project to create for the Run command to open the URL in Safari. Kind Regards

Good evening, I'm having problems with TestFlight that around 3 weeks ago started returning errors to me and all my testers saying that "the requested app isn't available or it doesn't exist". I'm trying to find a solution, and I was checking my profiles. I noticed I have so many, and some duplicates. How do I know which certificates I can delete and which ones I have to keep?

One of our pkgs has been put in notarization limbo a few times (slightly different builds each time) with the status "Processing delayed due to a service issue". The oldest instance it over 2 days old, so I'm not confident that it will ever complete.What can we do about this? I've read posts about long delays in notarization that seem to involve service outage, but this seems a bit different. Apple has inserted itself into our build/distribution process in a most inconvenient way.

We have multiple external vendors that have apps designed for customizing vs us building our own app. We found that creating certs to give them access just to their app works, but not at scale. The docs implied we could do this once, but it seems like we can create three. Does anyone have advice on how to do this?

Since updating to macOS 10.15.4 I am no longer able to launch applications. They fail with the error message "The signature could not be validated because AMFI could not load its entitlements for validation: entitlements cannot be parsed".I am not entirely sure what exactly the problem with the entitlements file is. The exact same entitlements file worked fine before, and running plutil -lint does not find any problems with it. I would be fine with updating the entitlements file in some way due to recent changes, but because the error message doesn't actually explain what the problem is this is kind of hard.https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/resolving_common_notarization_issues

Hi,I am in a bit of an double corner case here. I have a package which consists of ONLY command-line executables. This package is a number of Unix utilities AND it uses a traditional Unix style build system (autoconf/make). We used to distribute this as a gzipped tar file, but obviously this fails when it comes to Catalina and notarization. This package consists of a number of executables, some shared libraries those executables link against, and a few dylibs that those applications load at runtime using dlopen(). Our plan is to provide a traditional MacOS installer package going forward.I have honestly been trying to do my homework, and I think I've got most of the mechanics down. I have an Apple Developer certificate, and I've been able to codesign executables and shared libraries, and ship them off to be checked by the notarization service, and that works. I have read all of the guides I can find about codesigning and notarization, including Signing a Mac Product For Distribution (thank you for that!). But I haven't QUITE seen something that covers my specific case, in that I am building a package OUTSIDE of Xcode AND it is not an application bundle (the build system is large and incorporating it into Xcode is just TOO much of a heavy lift right now). So I am trying to understand everything that I need to do.Specifically, my questions are:Do I need to compile an Info.plist into every bit of code? I understand HOW to do that, using the -sectcreate option to the linker, but it wasn't clear to me if that is required. Is it only required for executables, or both executables and libraries? The implication that I need to compile an Info.plist came from here https://eclecticlightdotcom.files.wordpress.com/2019/06/notarizecmdtool.pdfThere is a warning in the codesign man page under the --identifier option that says, "It is a very bad idea to sign different programs with the same identifier". Okay, fine. But it ALSO says that either gets the identifier from the Info.plist or the filename if that option isn't present. I am concerned that if I compile in the SAME Info.plist into every bit of code then all of the code gets the same identifier, and that would be "very bad". Obviously I can add the --identifier and --prefix options to codesign, but it wasn't clear if there were any implications in doing that.I was originally under the impression that I had to bundle up the binaries separately to get notarized, but it SOUNDS like that all I need to do is once I create the installer package, with everything signed inside of it, AND I sign the installer package, I can just submit the installer for notarization and that will cover everything?I know I can use spctl to check the status of executables, but it doesn't seem like that works for dylibs. Is that correct?Thanks for any help you can provide.--Ken

Hi,We package an Open Source database system called PostgreSQL. This is signed and notarized by us. PostgreSQL is designed to be user extensible, and has various hooks to allow additional functionality to be loaded from shared libraries, which are dynamically loaded at runtime.We compile the PostgreSQL sources on macOS Mountain Lion (10.8) using MacOSX10.9.sdk with -mmacosx-version-min=10.9. The codesigning is done on the macOS Mojave (10.14) using a Developer ID Application certificate.When linking with the hardened runtime, the loading of third-party extensions is blocked on macOS Catalina because they are not signed by either Apple or with the same team ID used for PostgreSQL itself. How can we resolve this such that our builds of PostgreSQL are able to load third-party extensions? We used the entitlement "com.apple.security.cs.disable-library-validation" already on the command line option for the codesign binary while signing the app bundle.Awaiting your feedback. Thanks.

Hello, I was planning to create custom profiles with the Apple Configurator and sell them as a digital product to make small customizations etc. easier for non-techies. Since I wanted to sign them so they look and feel more serious and do not say before installation "Profile not signed" I wanted to get an Apple Certificate for these. But I'm not sure if this would be prohibited for the use of the Apple Certificate since these profiles are not apps and would be sold on my own website. I already read the terms and conditions regarding the Apple Certificate but I'm still not sure about this since these are not Apps that would be sold on my website. Does anyone has experience with this and can let me know if I would violate the terms and conditions with my idea? Please note that I've never used or worked with the Apple Certificate before so please be gentle with me. 😅 I'm looking forward to your feedback!

Hi,I want my app to be able to run /usr/bin/ibtool.However when my app is sandboxed, it won't allow me to run it.Does anyone know what entitlement I need to give my app so that I can run ibtool - from within my app?Thanks!Chris

Hello, I cannot add my developer account to XCode but I can add to VisualStudio for Mac. After some attempts, after the installation of the required tools, I managed to add my Apple developer account to VisualStudio for mac. I entered the id and the password and then received the two-step verification code on my smartphone. I entered the code and the operation completed. How could I export this kind of account profile from VisualStudio to Xcode? Or is it possible that the two-step verification is not working from Xcode itself? I need to upload the release build executable of my SwiftUI app for review. Thanks

Hello, how should I change the name with which the apps are signed, my first and last name appears but I want the name with which we make the apps to appear

Hi people! Since awhile I am not able to open up my own built apps anymore from my device. When trying to open it I get the message: "My App Name" Is No Longer Available. Xcode console gives the following: Attempted to launch an untrusted application scene sceneID:com.mycompany.myname I think it has something to do with my just extended Apple Developer account and the certifications, but I'm not so familiar with it that I could tell what exactly.... I have a ton of apps and old builds on my device, so rebuilding them will be a huge task. Hopefully you can help me out!

i have a macOS app that uses Game Center. how do i make it available to beta testers? i understand that TestFlight is available to developers running macOS v12. but my testers are normal users who are running macOS v11. my first thought was to sign with a Developer ID and let testers download the app. except that Game Center is not supported in Developer ID apps. Can I sign and upload to App Store Connect and somehow offer the binary to testers?

Hello, Our macOS app includes a Password AutoFill extension and both the host app and extension have the entitlement for AutoFill Credential Provider. We have found that in Xcode 13 RC, when we attempt to archive our app using xcodebuild we receive this error: Cannot create Developer ID provisioning profile for "our.app.ID" The AutoFill Credential Provider capability is not available for Developer ID provisioning profiles. Disable this feature and try again. And a similar message for our extension's app id. We believe this to be a bug as building/archiving/submitting using Xcode 12 worked fine with this same entitlement. Otherwise, are non-Mac App Store apps now being excluded from including Password AutoFill capability? We've been shipping this feature to our customers in our Developer ID signed app since it first became available in macOS Big Sur. We'd appreciate it if someone could look into this right away, we have filed a feedback report: FB9634952.

We use the apple notary service to notarize our binaries and we’d like to be able to get slack notifications in the case that there are notary service outages and those affect our pipeline builds. We find ourselves spending time inspecting the issue / bug to find out that it is apple service outage. It would be really nice to be able to get notifications that there are outages occurring so we don’t spend the extra time figuring out why builds are timing out. Currently there is no rss feed on the developer systems page where we can easily add to slack as part of their connect tool service. Is there anything on the timeline to add an rss feed to the system status page? Or will the apple status page potentially be added to Statuspage? (Atlasssian product)

One of my App's targets produces a .saver module, but I have failed to figure out how to notorize it, is this possible?

I am trying to run an app on my iPhone and am running into an error: Signing for "Galavant" requires a development team. So I set my development team by setting my signing & capabilities to "Automatically manage signing" to true. I also go to my Build Settings --> Signing --> Development Team for both debug and release to any SDK. The issue is when I go to set "Team" under Signing & Capabilities and drop down to my account...is snaps back to "none". I can see the connected accounts when I drop down but it won't let me select them. Any idea why this is happening?

There's a certificate listing in my "Certificates" list with "EXPIRATION" indicating "Pending Approval". The only option to this item is "Revoke". If I click it, I'll got an error "The specified resource does not exist". How to remove this non-exist resource?

I've been trying and googling and forum-reading this for a couple of days, and ... am either missing something obvious, or am simply dumb. I'd prefer to simply be ignorant, and so I ask. 😄 I've got a personal, paid account. I've got some projects, and I've got some git repos. I'd like to allow some other people to check out a repo and then build the associated project. Only they can't, because the bundle identifier conflicts. The bundle identifier is, e.g., com.kithrup.filterTest. In my Xcode, the selected team is me. And that works, which isn't surprising because I did create it after all. I've tried using App Store Connect to invite someone, and they do show up there. But they can't build either, again due to the bundle identifier conflict. (Also they can't find any provisioning profiles, which makes sense given everything else not working.) This is a remarkably basic question for someone who's been developing on the Mac for... oh my, coming up on 20 years in a month. Of course, I managed to avoid Xcode for much of that time, by simply doing unixy stuff. Help?