Hi! I've been using some old technologies(not using Xcode) to maintain some old apps but now the old mac that i've been using is getting to be too slow so I got a new one. I have exported Apple ID and Code Signing assets in Xcode on the old mac and imported in Xcode on the new Mac. Logged in with my Apple ID. Built new .ipa files from Terminal and added them to Transporter without any errors. When trying to upload I get the following message in Transporter: Asset validation failed (90034) Missing or invalid signature. The bundle 'com.dev.appid' at bundle path 'Payload/MyAppMobile.app' is not signed using an Apple submission certificate. (ID: c7cfcbee---****-aca042fd4d2e). Also tried to create ad-hoc builds but they won't install. Are there more steps to migrating the certificates to a new Mac? Do I need to export-import more things perhaps?

I am thrilled to be apart of apple. Coming from place where I had to work with so many people in over the years the fun and yes the challenges that we in each project made us better as a team. Thank you so much for allowing me to be apart of the program. I look forward to working with you all.

Is it true that signing should always over-write any existing code-signing?I ask because I've had a recent case where this was done in SD Notary. The signing (of a framework) succeeded and notarization succeeded, although the app then failed when it tried to load the framework. I checked the logFileURL and there was an issue saying the framework was not signed.I repeated the exercise, this time starting with an un-signed version of the framework, and all went well. (I have no idea how the previous version was signed -- it was from a user).

Hi,My software installs frameworks in the local domain (/Library/Frameworks) that are accessed from third-party apps. Some of these apps are simply code-signed, others are sandboxed. They are obviously signed by other companies, and so far there have been no problems on the part of DYLD in loading and executing code inside our frameworks. The loader is happy to continue looking for our framework outside the app container, in the case of sandboxed apps.What changes are necessary to ensure that our frameworks remain accessible from hardened apps? Hardened Runtime, to the best of my understanding, only allows executables to load code that has been code-signed by the same team, or by Apple. I also think that hardened runtime affects only executables, and yet when I enable the ENABLE_HARDENED_RUNTIME setting in Xcode on my framework targets (via xcconfig) it clearly influences the way they are signed, and suddenly these "hardened frameworks" fail to be loaded by third-party apps, even if these apps aren't yet hardened themselves. In what its perhaps the key to solving this issue, how can one mark non-app targets to enable the library-validation exception? Why would a non-hardened app fail to load code whose only difference may be a simple flag (kill,runtime) in its signature?Maybe I'm wrong to assume that non-app targets deserve any special treatment, but the fact remains that when I enable hardened runtime, our code simply stops being "seen" and loaded by DYLD, with all other variables remaining identical.Thank you!Gabe

mkdir -p /Users/username/action-runner/system-code/system-code.app/moderms/MacOS +mkdir -p /Users/username/action-runner/system-code/system-code.app/moderms/Resources +cp -p /Users/username/action-runner/system-code/EM-6.0/resources/res/em.icons/ /Users/username/action-runner/system-code/system-code.app/moderms/MacOS +cp -p /Users/username/action-runner/system-code/Supplement /system-code.sh/res/em.icons/ /Users/username/action-runner/system-code/system-code.app/moderms/MacOS/system-code codesign -f -s ‘’ -v /Users/username/action-runner/system-code/system-code.app error: The specified item could not found in the keychain. -script failed with code : 1 Running install script failed with exit code 1 On the host machine terminal “codesign -f -s ‘’ -v /Users/username/action-runner/system-code/system-code.app” command works

I'm developing an open source GPL macOS app for the amateur radio community and I want to know how to 'archive' it so uses can download a compiled bundle from my GitHub page for free. I have an Apple Developer account, but I haven't enrolled or paid any money. Is this possible?

I just upgraded to macOS 12.5, installed XCode 13.4.1, built a .DMG installation file for my app (using Qt Creator), and proceeded to use my Apple Developer status for the first time (ta-da!) to acquire a Developer ID Installer certificate. That certificate is now visible in Keychain Access. However, it is noted as 'certificate is not trusted'. I did read that old intermediary certificates could be the cause of this but I also read that new versions of XCode automatically updates those intermediary certificates. Questions: (1) How do I check that the necessary intermediate certificates are OK? (2) Am I missing some action I need to do in XCode? So far I did nothing but launch XCode and close it again. (3) Given that I will get my certificate trusted at some point, what are the steps I should go through (in XCode or in Terminal) to codesign my .DMG file, so that it will install without warnings on another Mac computer? I have found it impossible to find instructions for this straightforward task. -- I am not going to use the App Store.

Hi, I have a little trouble with the project I'm workin on. We are 3 developers who are working on the same project. Since a couple of months once a day I need to delete my developer certificate and download it again because it result invalid on the KeyChain. This issue are in common with the other two developers too. Do some one have or had the same issue? What can I check to solve this issue? Thanks a lot in advance

IMPORTANT This post is now obsolete, having been replaced by: Code Signing Resources Trusted Execution Resources App Sandbox Resources Notarisation Resources App Sandbox: App Sandbox Design Guide Gatekeeper and notarisation: Developer ID landing page Signing a Mac Product For Distribution Manual Code Signing Example Testing a Notarised Product --deep Considered Harmful Update to Notarization Prerequisites (23 Dec 2019) Notarize Your Mac Software for macOS Catalina (3 Oct 2019) Notarizing Your Mac Software for macOS Catalina (3 Sep 2019) New Notarization Requirements (10 Apr 2019) Notarizing Your App Before Distribution Customizing the Notarization Workflow WWDC 2019 Session 701 Advances in macOS Security WWDC 2019 Session 703 All About Notarization Safely open apps on your Mac (from Apple Support) Share and Enjoy — Quinn “The Eskimo!” Apple Developer Relations, Developer Technical Support, Core OS/Hardware let myEmail = "eskimo" + "1" + "@apple.com" Change history: 5 Jun 2015 — First posted. 25 Mar 2020 — Updated with a bunch of notarisation resources. Changed the title to About App Sandbox, Developer ID, Notarisation. 30 Mar 2020 — Add a link to Manual Code Signing Example. 18 May 2020 — Added a link to --deep Considered Harmful.

I have a question regarding why I cannot see/import our new "Developer ID Installer" cert in keychain. I created an Install cert a month or two back no issues. There is 1 difference this time - I am no longer the Account Holder, so steps followed were:- I created CSR from my keychain. I asked new Account Holder to use my CSR to create the Developer ID Installer certificate on Developer Portal. Account Holder downloaded and shared the .cer file with me. I imported the .cer file to my keychain. I tried both double clicking the .cer file and also tried by using the import option on keychain. I restarted Keychain and Mac but still the new cert is not showing in either My Certificates or Certificates. I used the above steps for other cert types and it works fine, i.e. User 1 created CSR and User 2 creates iOS Distribution cert from User 1 CSR. In this case I can import the .cer fine in User 1 keychain - no issues. Can you advise if Dev ID Installer cert is different and why I cannot import to my Keychain. Maybe it is importing but I just cannot view it ? Appreciate any advice.

I did not save Private Keys. I lost Mac profile and had to reset my Mac Machine. So after this, my Developer ID certs are not working and my account reached limit of certificates. Now only left option for me is to delete or Revoke Developer ID certs. Apple support replied to my email saying that they can't revoke and approach Apple forums for help. Please advise. Since from 3 weeks, I have been struggling to get this resolved. Thanks, Anand

We have an application written in C and C++ that runs on Windows, Linux, and Mac. Recently a customer trying to install it on macOS Monterey received a message saying "cannot be opened because it is from an unidentified developer". To deal with this my company has joined the Apple Developer Program. So my question is how do we make use of that membership to get past this problem? Of the three platforms mentioned above, Mac accounts for the fewest customers, so we're not Mac experts. The software is built using Xcode but with makefiles that directly invoke clang or clang++. The finished product is packaged into a .dmg file. Note that we're not intending to put this software into the App Store.

Hi. I'm in the process of making changes to a MacOS SwiftUI project in order to have it be deployed using Developer ID. The project is a VPN using a packet tunnel provider so I'm converting the NetworkExtension to the SystemExtension equivalent. I run the exported app from the Applications folder and it starts up fine but I get a log saying that the current bundle does not have a SystemExtensions directory. When I check the contents of the package, it has put the extension in the Plugins folder instead, which tells me that the extension is still being treated as an app extension rather than a system extension. When I try to run the extension from my app, I get a log saying "Provider is an app extension and therefore cannot be signed with a Developer ID certificate" I have followed all steps listed here: https://developer.apple.com/forums/thread/125508 I have packet-tunnel-provider-systemextension in the Network Extensions array in the entitlements for both the main app and the extension. I've got Network Extension entitlements on both identifiers and and System Extension on the main app identifier I've created and imported provisioning profiles for both. No errors on either. In the extension's info.plist, I have made sure to set the bundle type to SYSX The product name for my extension matches it's bundle identifier The extension's wrapper extension is systemextension Can anyone think of anything I have missed which would cause Xcode to continue packaging it as an appex rather than a sysex? Or is there possibly somehow something I need to change in the swift code which Xcode will pick up on when packaging? Let me know if you need more info from me. Thanks in advance

I send a Requesting a Developer ID Certificate for Signing Kexts. But there was no response in the past two months. How can I know the progress?

The issue around CERTIFICATES and their RANDOM REVOCATION is one that I just can’t get my head around, as hard as I may try. I’ve read “Certificate Signing Requests Explained” and most others that one would consider relevant and I’d like to say “I get it” except…I don’t. At least not well enough to prevent what I’m encountering. I have a developer account (at the moment it needs to be renewed) and a dev team (me) that lets me do whatever in Xcode. I’ve compiled several apps for macOS, each of which runs fine, for a time. Then, after a random interval of days or sometimes weeks I get the DREADED EMAIL from Apple that reads: "Your Certificate Has Been Revoked. You have revoked your certificate, so it is no longer valid", and they don’t! Any attempt to start them generates the warning "[This App] will damage your computer. You should move it to the Trash." Each needs to be recompiled with what is apparently a valid certificate courtesy of Xcode to get them to run again, which they do, until the next email from Apple shows up and they don’t. Let me stipulate that I have done nothing overtly to revoke these certificates (6 revocations since April 22) nor have I done anything but use Xcode to automatically manage the creation of new ones. So the ask: what I do I need to do to keep this from happening? PS: I have read numerous places to ignore these emails which I have done without consequence. Only now after I am using several apps that I've created has this become problem.

I have an application for macOS that uses core data to save data. I switched to CloudKit so I can sync that data with its iOS counterpart. This is on Xcode 13.4. Even since I did that I get the error: When I try to submit it for a distribution with "Developer ID" I have been going in circles for the last two days. I have tried all the stuff several articles here at SO mentioned (e.g. this one), or the Apple Dev Forums (for example this one). I have tried deleting certs, regenerating them, adding them again, downloading "manual profiles" again, going to the building settings and changing certs and options... It doesn't matter. It goes nowhere. Here's the thing, if I go back to the version without iCloud, all is good. Same with any iOS app that uses iCloud. All builds, and all goes to Apple without any issues. It's only this app. For the sake of testing I created a new macOS app, and from the get go I enabled CloudKit. Same error. So, what's missing? Is there any special foo or incantation I need to utter to get an macOS app to use iCloud and be able to be distributed? Thanks

Our product is distributed as a Mac installer package, and it is only distributed by us, not via the Mac App store. Thus, we have Developer ID certificates to sign both the actual software components within the installer package (Developer ID Application With KEXT - since we have a KEXT), and the installer package itself (Developer ID Installer). Our Developer ID certificates are set to expire next month, so we just created new ones which we are switching to. However, we also maintain an archive of older product installer packages on our website for users that need to run earlier releases for some reason (running on older OS, etc). It sounds like we may need to re-sign those older installers with the new Developer ID Installer cert, as the info here makes it sound like those installers will no longer run after the cert expires: https://developer.apple.com/support/certificates/ https://developer.apple.com/support/developer-id/ We’re trying to get a definitive answer on what we need to do, before it’s too late to do it, but some of the behavior of this certificate stuff is a little confusing (also, I did file a DTS request to get clarification on this, and ultimately they referred me to posting here on the dev forums). Let’s assume all those older installers were signed with our old Developer ID Installer cert, and let’s say that cert expires on 6/1/22. My questions are: 1 ) I assume those installers will now cease to run after 6/1/22, correct? But any installs that ALREADY happened with those installers will continue to work after 6/1/22? This is what the links above suggest, but we specifically want to make sure this is the case for the KEXT, which in those older installers is signed with the older Developer ID Application With KEXT cert which also expires on 6/1/22. [Related question, is there any reliable way to test this? I assume it would be more complicated than just setting the system date on a test machine past 6/1/22…] 2 ) Assuming it is the case that those old installers will no longer run after 6/1/22, do we just need to re-sign those installer packages with our new Developer ID Installer cert? OR, do we additionally need to re-NOTARIZE the installer packages (assuming they need to run on Catalina or later)? [Logically it seems like we need to re-notarize after re-signing, and one test seemed to confirm that, while another similar test done by another developer had different results. I think what happened there was that the developer re-signed the installer with the new cert and saved that off (testA.pkg), then uploaded that installer to the notarization service and saved the result w/stapled ticket as a differently named file (testB.pkg). We figured that when running the “only re-signed" installer (testA.pkg), we would get the gatekeeper error, but we didn’t (also spctl reported it as passing notarization). I assume this is because the same binary installer had already been uploaded for notarization, and something in the OS was able to talk to the notary service and detect that this installer (testA.pkg) was the same as the one that had been uploaded for notarization, hence reporting it passed. I guess that is why the note here about testing notarization mentions testing with network connectivity disabled: https://developer.apple.com/forums/thread/130560] 3 ) Assuming we do need to re-notarize the old installers, do we need to do that before the cert that was used to sign the software components within them expires on 6/1/22? I.e. will the process of notarizing a .pkg look inside the package for executable code bundles, and then fail if a bundle was signed with a now-expired cert? For various reasons it would be difficult to break apart these old installers, re-sign their individual software components with the new Developer ID Application cert, and re-package them. Thanks for any insight!

Hi everybody. I got stuck with the problem. I want to use "Sign in with Apple" capability in application signed with Developer ID certificate. I enable this entitlement in my App Store Connect for my App ID, generate the provision profile, download it in Xcode but it writes me that my provision profile does not support "Sign In with Apple" capability. Please clarify my anybody, is it possible to use "Sign in with Apple" capability in applications signed with Developer ID certificate?

After uploading a new App to the App Store Connect i receive an e-mail stating:ITMS-90034: Missing or invalid signature - The bundle '...' at bundle path 'Payload/...' is not signed using an Apple submission certificate.The App don't use any capability.I've used Xcode to upload, as in a previous App which now is on the App Store.All the apps use the default configuration: "Automatically manage signing", Provisioning profile "Xcode Managed Profile", Signing Certificate Apple Development: ############The requested Signing Certificate is present in the keychain in 3 versions, the last one is valid (the older 2 are revoked).What I should correct?

Created two requests and got certificates, Developer ID Application and Developer ID Installer and now the country in the subject field is "US" instead of "FI" that was in the requests. The previous certificates had country correctly set to "FI".Is there any place I can affect to get the country right in the certificates as the process does no obey the request in this respect? Our country info is unchanged and correct in our Apple dev account.Or, does Apple give a possibility to reissue (or something else) a certificate, changing the country?