Hi there, thanks in advance for the help. Two of my code signing certificates (Installer & Developer ID) and an app-specific password were part of a data breach of a CI platform. I have revoked the app-specific password. As I understand it, the risk is that someone in control of a private key and certificate can sign code in my name, which would be detrimental to my reputation as a developer. I was wary of handing over my certificate and private key to the platform, so I created 2 new certificate and private key pairs (Developer ID & Developer ID Installer) for use on the platform. So far, none of my software has been signed with these certificates. All software currently in distribution has been signed with certificates that I have kept offline. Do I need to revoke all my certificates or just those that were breached? What risks am I exposed to currently? Thank you.

I am very new to this, so apologies if this is a noob question. I am creating a package using Packages. I have a Developer ID certificate that expires in 2027. If I set my project to use that certificate before building in Packages, the build fails. So I am certifying after using terminal. However, in both the Terminal certification and running the installer for my .pkg, it says that the certificate is expired. I don't understand how a certificate that expires in 2027 can already be expired. Any ideas out there? I found a post with the same problem from 7 years ago and there were no responses. Thanks all!

Whenever I launch my system preference pane application i am getting console message (Only shows in Mac OS X Catalina):com.apple.xpc.launchd[1] (ouc.plist): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.com.apple.xpc.launchd[1] (ouc.plist[16059]): Service exited with abnormal code: 126Its runs the app but its take long time to run.Could anyone help how this generated and what ouc.plist is?

I have an app development agency, and I am attempting to set up an app for a client that wants to have their own App Store Connect+Developer account. They added me as an admin under their App Store Connect Account. I was going to create an app, but I am only able to access Certificates, Identifiers & Profiles under my company's account, not the client account that I am trying to create the app for. Under App Store Connect, I can switch to the client's team, but under Apple Developer, I cannot switch my team. The client is operating under a personal team for now since they had an issue with their DUNS number. I'm not sure if that's an issue

So I was basically trying to test my application on my own phone and then it was requesting authorization to the Apple Developer keychain with the certificate. I didn't know the password so I reset the entire login keychain's passwords which resulted in a new private key. Then I didn't know how to solve that issue and then deleted ALL of my certificates in hope it would somehow fix itself. They're all listed as untitled with a missing private key on my apple developer account, what should I do in order to restore these certificates? Thank you for the help.

Hello, I want users to be able to download an electron app from my website and install this on their Mac, Windows or Linux computer. I would like to be able to sign the application so that macOS will allow the installation to take place and not complain about an unknown app/ potential security issue. Do I need an Apple Developer account in order to do this and if so, which version of the Developer account would I need? I am not currently looking to make the app available in the Apple App store however this may well change in the future so it would be good also to have the possibility of being able to submit the application to the apple app store if things change in the future. Currently, I am not sure what my options would be with regard to this - I understand there is a $99 developer account option and a $299 option, but I am not sure which, if any, would allow me to digitally sign my application so that it can be installed without flagging security warnings on macOS when downloaded from my website, and which would also allow me to submit the app to the apple app store at a later date if needs be... Thanks in advance for any help, tips or pointers you can give!

I have created a package installer for MacOS with "productbuild" command line and adding the postinstall script in the package through command. And even I have changed the file mode to executable "chmod a+x" before using it in "productbuild" command. Here is what I am using for command line and in postinstall script and I have name the file to "postinstall.sh". command line:- productbuild --component "$appDir" "/Applications" --scripts "../Scripts" --sign "Developer ID Installer: $DEVNAME" "$appName.pkg" postinstall.sh:- #!/usr/bin/env bash open -n -a /Applications/appname.app exit 0 when package is created and I try to install the application on my mac, Installation runs smooth and app is install under application folder but postinstall script does not for some reason. please advise if I have missed out something or anything on running the postinstall script would be appreciated. Thanks in advance Note : This app is generated by Unity engine.

I am using Codemagic, through a low-code tool, to deploy my app to the App Store. It has worked great up until a few days ago when the deployment stopped working. Their support suggested deleting and re-adding my app's Identifiers (the app is already published and being used). However, after searching around, it appears these IDs cannot be re-used, specifically the Bundle ID that is associated with the Developer ID, even if that Developer ID is deleted. Is that true? I am having trouble fully understanding the differences between Certificates and Identifiers, but it is okay to delete an ID and re-add the exact same information (Bundle ID, Description, ect.)? Also, do Identifiers expire like Certificates do?

If the organization name is changed but not the team name and bundle ID, is there anything a developer or a build process (CI) side has to do, such as re-creating certificates or provisioning profiles? What factors impact the product regarding this change?

I send a Requesting a Developer ID Certificate for Signing Kexts.  But there was no response in the past four months. How can I know the progress?

Hi! I've been using some old technologies(not using Xcode) to maintain some old apps but now the old mac that i've been using is getting to be too slow so I got a new one. I have exported Apple ID and Code Signing assets in Xcode on the old mac and imported in Xcode on the new Mac. Logged in with my Apple ID. Built new .ipa files from Terminal and added them to Transporter without any errors. When trying to upload I get the following message in Transporter: Asset validation failed (90034) Missing or invalid signature. The bundle 'com.dev.appid' at bundle path 'Payload/MyAppMobile.app' is not signed using an Apple submission certificate. (ID: c7cfcbee---****-aca042fd4d2e). Also tried to create ad-hoc builds but they won't install. Are there more steps to migrating the certificates to a new Mac? Do I need to export-import more things perhaps?

I am thrilled to be apart of apple. Coming from place where I had to work with so many people in over the years the fun and yes the challenges that we in each project made us better as a team. Thank you so much for allowing me to be apart of the program. I look forward to working with you all.

Is it true that signing should always over-write any existing code-signing?I ask because I've had a recent case where this was done in SD Notary. The signing (of a framework) succeeded and notarization succeeded, although the app then failed when it tried to load the framework. I checked the logFileURL and there was an issue saying the framework was not signed.I repeated the exercise, this time starting with an un-signed version of the framework, and all went well. (I have no idea how the previous version was signed -- it was from a user).

Hi,My software installs frameworks in the local domain (/Library/Frameworks) that are accessed from third-party apps. Some of these apps are simply code-signed, others are sandboxed. They are obviously signed by other companies, and so far there have been no problems on the part of DYLD in loading and executing code inside our frameworks. The loader is happy to continue looking for our framework outside the app container, in the case of sandboxed apps.What changes are necessary to ensure that our frameworks remain accessible from hardened apps? Hardened Runtime, to the best of my understanding, only allows executables to load code that has been code-signed by the same team, or by Apple. I also think that hardened runtime affects only executables, and yet when I enable the ENABLE_HARDENED_RUNTIME setting in Xcode on my framework targets (via xcconfig) it clearly influences the way they are signed, and suddenly these "hardened frameworks" fail to be loaded by third-party apps, even if these apps aren't yet hardened themselves. In what its perhaps the key to solving this issue, how can one mark non-app targets to enable the library-validation exception? Why would a non-hardened app fail to load code whose only difference may be a simple flag (kill,runtime) in its signature?Maybe I'm wrong to assume that non-app targets deserve any special treatment, but the fact remains that when I enable hardened runtime, our code simply stops being "seen" and loaded by DYLD, with all other variables remaining identical.Thank you!Gabe

mkdir -p /Users/username/action-runner/system-code/system-code.app/moderms/MacOS +mkdir -p /Users/username/action-runner/system-code/system-code.app/moderms/Resources +cp -p /Users/username/action-runner/system-code/EM-6.0/resources/res/em.icons/ /Users/username/action-runner/system-code/system-code.app/moderms/MacOS +cp -p /Users/username/action-runner/system-code/Supplement /system-code.sh/res/em.icons/ /Users/username/action-runner/system-code/system-code.app/moderms/MacOS/system-code codesign -f -s ‘’ -v /Users/username/action-runner/system-code/system-code.app error: The specified item could not found in the keychain. -script failed with code : 1 Running install script failed with exit code 1 On the host machine terminal “codesign -f -s ‘’ -v /Users/username/action-runner/system-code/system-code.app” command works

I'm developing an open source GPL macOS app for the amateur radio community and I want to know how to 'archive' it so uses can download a compiled bundle from my GitHub page for free. I have an Apple Developer account, but I haven't enrolled or paid any money. Is this possible?

I just upgraded to macOS 12.5, installed XCode 13.4.1, built a .DMG installation file for my app (using Qt Creator), and proceeded to use my Apple Developer status for the first time (ta-da!) to acquire a Developer ID Installer certificate. That certificate is now visible in Keychain Access. However, it is noted as 'certificate is not trusted'. I did read that old intermediary certificates could be the cause of this but I also read that new versions of XCode automatically updates those intermediary certificates. Questions: (1) How do I check that the necessary intermediate certificates are OK? (2) Am I missing some action I need to do in XCode? So far I did nothing but launch XCode and close it again. (3) Given that I will get my certificate trusted at some point, what are the steps I should go through (in XCode or in Terminal) to codesign my .DMG file, so that it will install without warnings on another Mac computer? I have found it impossible to find instructions for this straightforward task. -- I am not going to use the App Store.

Hi, I have a little trouble with the project I'm workin on. We are 3 developers who are working on the same project. Since a couple of months once a day I need to delete my developer certificate and download it again because it result invalid on the KeyChain. This issue are in common with the other two developers too. Do some one have or had the same issue? What can I check to solve this issue? Thanks a lot in advance

IMPORTANT This post is now obsolete, having been replaced by: Code Signing Resources Trusted Execution Resources App Sandbox Resources Notarisation Resources App Sandbox: App Sandbox Design Guide Gatekeeper and notarisation: Developer ID landing page Signing a Mac Product For Distribution Manual Code Signing Example Testing a Notarised Product --deep Considered Harmful Update to Notarization Prerequisites (23 Dec 2019) Notarize Your Mac Software for macOS Catalina (3 Oct 2019) Notarizing Your Mac Software for macOS Catalina (3 Sep 2019) New Notarization Requirements (10 Apr 2019) Notarizing Your App Before Distribution Customizing the Notarization Workflow WWDC 2019 Session 701 Advances in macOS Security WWDC 2019 Session 703 All About Notarization Safely open apps on your Mac (from Apple Support) Share and Enjoy — Quinn “The Eskimo!” Apple Developer Relations, Developer Technical Support, Core OS/Hardware let myEmail = "eskimo" + "1" + "@apple.com" Change history: 5 Jun 2015 — First posted. 25 Mar 2020 — Updated with a bunch of notarisation resources. Changed the title to About App Sandbox, Developer ID, Notarisation. 30 Mar 2020 — Add a link to Manual Code Signing Example. 18 May 2020 — Added a link to --deep Considered Harmful.

I have a question regarding why I cannot see/import our new "Developer ID Installer" cert in keychain. I created an Install cert a month or two back no issues. There is 1 difference this time - I am no longer the Account Holder, so steps followed were:- I created CSR from my keychain. I asked new Account Holder to use my CSR to create the Developer ID Installer certificate on Developer Portal. Account Holder downloaded and shared the .cer file with me. I imported the .cer file to my keychain. I tried both double clicking the .cer file and also tried by using the import option on keychain. I restarted Keychain and Mac but still the new cert is not showing in either My Certificates or Certificates. I used the above steps for other cert types and it works fine, i.e. User 1 created CSR and User 2 creates iOS Distribution cert from User 1 CSR. In this case I can import the .cer fine in User 1 keychain - no issues. Can you advise if Dev ID Installer cert is different and why I cannot import to my Keychain. Maybe it is importing but I just cannot view it ? Appreciate any advice.