Currently, I have implemented a project that includes network extension and system extension entitlements. When I create the profile using the development method, I get exactly the right entitlement matching. For example: create app id (identifier) create a profile, associate with the corresponding app id, generate the profile and download it locally. In xcode, fill in the corresponding app id in Bundle Identifier, such as com.***.test.app, and fill in the corresponding development profile in Provisioning Profile. At this point I was able to achieve a complete and correct program compiling and running. Now, I want to distribute this app by developer id. According to https://developer.apple.com/developer-id/ , I have several questions remain: I followed this method https://developer.apple.com/help/account/create-certificates/create-developer-id-certificates/ to create a distribution certificate and created two new profiles (distribute- developer id), which is associated with the existing bundle ID (com.***.test.app, com.***.test.extension). But when I import the corresponding provisioning profile in xcode, it shows error: Provisioning profile "***" doesn’t match the entitlement file’s value for the com.apple.developer.networking.networkextension entitlement. But isn't the corresponding entitlement information already selected when the app id is set? Why is the profile of the development type feasible, but the profile of the developer id is not feasible? I have made relevant settings according to this method https://developer.apple.com/documentation/xcode/preparing-your-app-for-distribution/, and I don’t seem to need the hardened runtime and sandbox related content, so I don't have any settings. Maybe apple events in hardened runtime is necessary? Submitting software to apple notarization seems to be a more trustworthy behavior for users, but at this stage I just want to simply implement distribution for program testing, so I chose export in archives-distribute app-developer id, and in the follow-up The same error as in question 1 appeared in the profile selection of the profile: Profile doesn't match the entitlements file's value for the com.apple.developer.networking.networkextension entitlement. So, overall: One is how to create the correct developer id profile? My two entitlements files are as follows: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.developer.networking.networkextension</key> <array> <string>content-filter-provider</string> </array> <key>com.apple.developer.system-extension.install</key> <true/> <key>com.apple.security.app-sandbox</key> <false/> <key>com.apple.security.files.user-selected.read-only</key> <true/> </dict> </plist> <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.developer.networking.networkextension</key> <array> <string>content-filter-provider</string> </array> <key>com.apple.security.app-sandbox</key> <false/> <key>com.apple.security.application-groups</key> <array> <string>$(TeamIdentifierPrefix)com.example.app-group</string> </array> </dict> </plist> Second, is Apple notarization necessary?

HOla Alguien sabe como cambiar el nombre cuando publico alguna App por error puse mi nombre personal, pero me gustaria cambiarlo... es el nombre del creador de la App

This is a solved problem, but a detail not in any docs I could find and I could only get answered from support. Figured I'd add it to the index.App-specific passwords are not supported with Managed Apple ID created through Business Manager. You will simply not see the option to create an app-specific password even if you do have two-factor authentication turned on.

HiI have a flat pkg that I sucessfully notarised but when I come to staple the ticket I get the following error:"Although we wrote the ticket, the written data did not validate. Please restore thefile.pkg from backup to try again.The staple and validate action failed! Error 73."I did not touch the pkg in teh few minutes it took to receive the confirmaton email. The pkg itself looks notarised when I check it. Strange...

Trying to notarize and AppleScript app following the instructions at Der Flounder (that are based on an Automator app).Code Signing works fineNotarization work fine.However when trying to stape the successful notarization the response to:xcrun stapler staple "/Volumes/HardDrive/MyApp.app"is:Processing: /Volumes/HardDrive/MyApp.app CloudKit query for MyApp.app (2/936578f9cf6dff6314bdebeba427cac9dab3f7e8) failed due to "record not found". Could not find base64 encoded ticket in response for 2/936578f9cf6dff6314bdebeba427cac9dab3f7e8 The staple and validate action failed! Error 65.

Hello! I am having trouble with a Developer ID Application certificate that I have clearly added to the Keychain with Keychain Access not being recognized by codesign or DMG Canvas. Here is the command that DMG Canvas uses to see if there are any certificates for signing: $ /usr/bin/security find-identity -p codesigning Policy: Code Signing Matching identities 0 identities found Valid identities only 0 valid identities found This shows that no certificates are found but there definitely are some. I installed this cert to both the System and login keychains, I tried to the Local Items keychain but this failed with an error I will display below. This image (names redacted) clearly shows the certs are there, valid, and not expired (behind the error) and also shows the error popup for when I try to add the cert to the Local Items keychain: Essentially I am asking why does Keychain Access say that I have the certificates but nothing can find it in order to sign applications. Thank you!

I've read just about everything I can regarding this but no one seems to offer any simple steps to resolve this situation. I'm guessing that the original developer certificates were created by an employee who is no longer with our company and his laptop is no longer accessible - it's been wiped. I deleted all the certificates from my keychain and recreated new developer certificates so that we can code sign apps - not for any of the app stores just for distribution on our website. However, none of them have a private key so I need to be able to create private keys for them. Does anyone know how to do this? Every thing I've tried has failed.

How to remove the "Developer ID Application" type certificate? A maximum of 5 such certificates can be created. There is no remove button on the certificate detail page. Is there any way to delete it?

I found in my keychain this certificate under system roots: "Developer ID Certification Authority" and it seems like only available for developers, but I never applied as developer nor did I developed anything. Can someone please explain, why this happened and if I should/can delete this certificate?

Hi, I'm building a MacOS app that will be published outside of the AppStore (Using an installer). In the app we have an option to sign-in with Apple & Google. While trying to archive the app and distribute with a Developer ID, xcode presented us with this error, and once the entitlements were removed the sign-in with Apple/Google stopped working. Is there a way to archive the app and distribute with Developer ID and also support sign-in with Apple/Google? Thanks!

We have a DMG for our Mac desktop app that has notarized OK, but on stapling we get the error below. The DMG and its contained app are signed (prior to Catalina this was sufficient.) The .app folder is directly constructed in our build process (not using XCode or similar); the .dmg is by DMGCanvas. The app only contains the UI; the libs and command-line tools are in a sibling folder, laid out much as they are on our other *nix builds. (When installed, everything is placed in a dedicated folder inside /Applications to keep it all in one place.)Searching for the error "Certificate authority pinning mismatch" almost entirely links to cssmapple.h, which implies not many other people have run into this?OS: 10.15.1Xcode: 11.1xcrun: 48Notarization:Request Identifier: 71c0468a-2a58-46ae-b699-22462e8593b0Stapling:Properties are { NSURLIsDirectoryKey = 0; NSURLIsPackageKey = 0; NSURLIsSymbolicLinkKey = 0; NSURLLocalizedTypeDescriptionKey = "Disk Image"; NSURLTypeIdentifierKey = "com.apple.disk-image-udif"; "_NSURLIsApplicationKey" = 0; } Codesign offset 0xcee4caf length: 9556 Stored Codesign length: 9556 number of blobs: 3 Total Length: 9556 Found blobs: 3 Props are { cdhash = {length = 20, bytes = 0xfb512617c5c078595f7a2ab6f74c73d7fa00a73c}; digestAlgorithm = 2; flags = 0; secureTimestamp = "2019-09-12 15:10:53 +0000"; signingId = "FICO Xpress 8.7.0 for Mac Installer"; teamId = KL84GEX7ZW; } JSON Data is { records = ( { recordName = "2/2/fb512617c5c078595f7a2ab6f74c73d7fa00a73c"; } ); } Headers: { "Content-Type" = "application/json"; } Domain is api.apple-cloudkit.com Certificate trust evaluation did not return expected result. (5) [leaf AnchorApple ChainLength IntermediateMarkerOid] Certificate trust evaluation for api.apple-cloudkit.com did not return expected result. Certificate authority pinning mismatch. Certificate trust evaluation did not return expected result. (5) [leaf AnchorApple ChainLength IntermediateMarkerOid] Certificate trust evaluation for api.apple-cloudkit.com did not return expected result. Certificate authority pinning mismatch. Could not establish secure connection to api.apple-cloudkit.com Response is (null) error is Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLStringKey=https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup, NSLocalizedDescription=cancelled, NSErrorFailingURLKey=https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup} Size of data is 0 CloudKit's response is inconsistent with expections: (null) The staple and validate action failed! Error 68.

I'd like to share a screensaver I developed (for OSX) but I couldn't find a way to code-sign it. Without it, it is almost impossible to install on other machines due to 'Gatekeepr' warnings. (right click & `open` works, but most people don't know about it.)Any ideas on code-signing or distribution alternatives? I'm simply sending the .saver bundle at the moment

Hi, I manage an app for The Unity Center. I've only been doing this for about 3 years, I've never had to create a certificate for our app on my own, so I need help with doing this, please. I tried to do it on my own but I don't think I'm doing it correctly because my mac doesn't seem to be able to create a new certificate without a CSR. And I don't know how to create a CSR. Here are the screenshots I took of what I tried to do and the link to instructions I have been following: https://help.apple.com/xcode/mac/current/#/dev154b28f09. I have also asked my company's tech person to help me because his tech knowledge is beyond mine and might be able to assist me with this on my computer. If he can't help me though maybe one of you can. Also this is the email I had sent to apple about this issue: "I have hit a tech roadblock that is beyond my tech capabilities. I don’t know how request a new certificate for our app from Apple for The Unity Center. I have taken screenshots of what I’ve tried to do so far. Can you help me please? I haven’t done this before for my job so I’m new at this. I have been managing our app with Apple Developers for the past 3 years through Subsplash. I’m not sure what to type in the location area because I’ve tried The Unity Center with the member ID but that doesn’t work."

Hello, I am trying to distribute a macOS app directly to consumers. Recently I came across this article titled 'Cloud-managed certificates', which details that Apple will sign apps by authorizing you via you Developer program membership, but would like to see if this is usable from the command line or thirdparty tools. To confirm that this article does what it says, I created a new generic SwiftUI app on a new Mac that does not have any existing "Developer ID Application" certificates in keychain. In the signing tab, it shows With this, when I 'archive', the Xcode Organizer appears. If I click distribute, then 'Developer ID', 'Upload', 'Automatically manage signing', it correctly displays "Certificate: Cloud Managed Developer ID Application" and then gives me the option to notarize it. Now, this was all done via the Xcode Organizer via an Xcode-managed app. I was wondering if it would be possible to use this cloud-managed signing service from the CLI, so that I can integrate it with existing tooling and CI/CD pipelines.

I want to sign a macApp using the Cloud managed Developer ID certificate. With the help of this forum discussion and the official documentation, I have tried to sign it using the following steps. Make sure "Access to Cloud Managed Developer ID Certificate" is enabled Remove all Developer ID certificates from the keychain. In Xcode, click Products > Archive. Click "Distribute App > Developer ID > Export" (selecting "Upload" will give the same result) Select "Automatically manage signing" The following text will appear and the signing process will stop. "The following errors occurred while locating and generating signing assets. Xcode is unable to resolve these issues automatically." Communication with Apple failed. You are not allowed to perform this operation. No signing certificate "Developer ID Application" found. Why do I get these errors? Restarting PC, xcode, or re-signing in to the Apple Developer account in Xcode settings did not contribute to resolving this issue. And our Account Holder is suffering from the same error. Xcode:14.3 macOS:13.2.1 PC:MacBookPro M1 2020 My Role: Admin Best regards.

I want to sign an application that I have maintained for years. It compiles, passes its own tests, and runs without error on Mac OSX. It is a variant of an upstream project that is properly signed. I want to sign my own application, using the upstream build chain. The upstream build chain is a bash script that calls for several values to perform signing with codesign: DEVELOPER_ID= KEYCHAIN= KEYCHAIN_PASSWORD= NOTARIZATION_BUNDLE_ID= NOTARIZATION_USER= NOTARIZATION_PASSWORD= For a start, I'm stuck at DEVELOPER_ID. The value is meant to be a hash, but from the XCode documentation and various third-party explainers, I've been unable to figure out how to acquire that value. In codesign, the upstream script applies it like so: /usr/bin/codesign --force --options runtime \ --entitlements "$entitlements_file" \ --sign "$DEVELOPER_ID" \ <path_to_application> (The entitlements file is provided in the source.) I don't have any experience working in XCode, and I've been unable to solve this problem. Apple Developer Support have pointed me back at the documentation, where I had been unable to find the answer. I'm stuck. Any advice or pointers would be extremely helpful at this stage.

I am trying to export a Catalyst app using Developer ID as distribution method. However I am unable to do it because xcode complains about Apple Sign in capability not being included in the profile (which clearly is, see attached - https://www.icloud.com/iclouddrive/0T4Qf6NuPPtD97uLJ_dCxh-3w#Image_1-14-21_at_7.43_AM). Any solutions or workarounds? Thank you.

How can I restore a certificate?

I'm working on distributing a MAC App, and I'm also a complete beginner. During deployment, the following was confirmed in the apple log: Provisioning Profile Validation: profile 'teamid.Bundleid' is not provisioned for this device () embedded provisioning profile not valid: file:///Applications/SystemExtensions.app/Contents/embedded.provisionprofile error: Error Domain=CPProfileManager Code=-212 "Provisioning profile does not allow this device." UserInfo={NSLocalizedDescription=Provisioning profile does not allow this device.} Disallowing "BundleID" because no eligible provisioning profiles found The app is notarized and runs normally, but when it runs, the app fails to start and ends with the error. So I decided to create a Developer ID provisioning file. Go to the Apple Developer site. Since you already have a "Developer ID Applications" certificate and a Bundle ID is registered, you only need to create a provisioning file. On the Profile tab, on the Distribution tab, choose Developer ID and choose app Id. Then it will show no certificate as below screen. Actually, there are two Developer ID Application certificates as shown below. How do I create it?

I want to use NSTask to run a shell script that resides in Resouces directory. The script performs some operations on files in the app's Data directory.But I am concerned that Apple could refuse my app for some reasons. Can anyone confirm if this approach is safe. Thanks.