Dear apple developer community... I am facing the problem on creating my own pushPacakge and .p12 webpush certificates file for safari push notifications. I follow all steps carefully on an official document here with my team. And also try to follow some tutorials on some blogs which corresponding to its. But it still doesn't work. Here's how my problem looks like I've got .p12 file then I've test to upload it into some push service like oneSignal, truePush and etc. It's able to upload the file but the push service still doesn't work. But if I used a provided .p12 from their service, the notification will working properly. I try to use my .p12 to generate a push package (pushPackage.zip). But the api log on my webServiceUrl keep showing me "{ logs: ['Signature verification of push package failed'] }". Even if I try all versions of AppleWWDRC (G1-G6) downloaded from here. And even I use an official php script (createPushPackage.php) file from apple apn document downloaded from here on the top right corner at companion file Here's what I've done so far to get my own .p12 file... Generate my own CSR file from mac keychain application Noted1: My appleId on my mac is an Admin role only on apple developer account (Not a Admin, Account Holder role) Noted2: I've try to enter an apple id with role Admin, Account Holder on a User Email Address field but it still doesn't work Login into an apple developer account console on apple developer site Go to identifier tab and create new webPushId identifier Enter description and webPushId(reverse domain name style which is web.com.herokuapp.kkwebpush) Come back to certificates tab and create new certificate (select webPushId radio button and click create) Choose webPushId that already created on step 4 from dropdown list then click on continue Upload CSR file that generated on step 1 into its Download .cer file Click on the downloaded .cer file from step 9 and generate .p12 file by keychain Here's how I create pushPackage.zip file Create folder to store all files needed ( reference from here ) which are AppleWWDRCA.cer Certificates.p12 (Generated from step 9 above) createPuchPackage.php (Official script from apple which already edit the path to Certificates.p12 and enter private key match with my Certificates.p12 password) intermediate.pem (Generated from export AppleWWDRCA.cer on keychain as intermediate.pem) pushPackage.raw (folder that contain both icon.iconset and website.json that already set matched webPushId and webServiceUrl inside website.json) So, the folder structure now look like this Then I start to run php createPushPackage.php inside this folder. After that I've got an unreadable format result on my terminal .But I still get a pushPackage.zip file stored at /tmp folder (At this point I think it might be fine with that unreadable format) . Head over to my tmp folder to move that pushPackage.zip file into my webServiceUrl endpoint directory for send a pushPackage when apple api model was called on window.safari.pushNotification.requestPermission ( Already set these 4 parameters below) url as my web service url to my endpoint websitePushID as my web site id registered on apple developer console userInfo as empty object {} callback as function as a callback function FINALLY MY FINAL QUESTIONS ARE... Are there any steps that I've missed? Why I keep getting { logs: ['Signature verification of push package failed'] } on my web service url log errors endpoint? Does my certificate is invalid? (If yes, what are all possible causes) Why I can't use my own .p12 file on other push services (oneSignal, truePush and etc.) that support custom upload .p12 file for safari push notification? * When I used a provided .p12 from their service, everything works fine (safari permission popup can appear). On the other hands, If I use my own .p12, I can upload its to their services but safari permission popup don't show up)? Any solution please? Thanks

During build process, I have been encountering an error "error: The specified item could not be found in the keychain." for the code signing process. My apple ID joins a developer program of my company. I have 2 macbook - 1 for my personal, and 1 for my company. I can build apps with my personal macbook, but failed with my company one. I have exported the developer account from xcode of my personal macbook, and also imported to the company macbook's xcode. Both macbooks are macOS Monterey, and both xcode are the same version 13.2.1 For building an app, I've chosen "Automatically manage signing"

Hi, I'm a font designer and making pkg installers for my fonts. Before, I was using Hancock app to code sign my pkg files easily though using my old MBPro (15inch- mid2014). Now almost a month ago, I bought a new MacBook Pro (16-inch, 2019) and renew my subscription to Apple Developper program, when I downloaded my .cer file from "Certificates, Identifiers & Profiles" then import my .cer file through Keychain Access, It get loaded ok but it does not show on "My Certificates" even it's there at "Login" level. So Hancock app won't find it except if it's under "My Certificates" level... and I'm lost, I struggle to copy paste again to "My Certificates" but no way.... Thank you very much in advance for your kind help. Here is my website:  https://norfonts.ma  I'm also selling my fonts through NC :  https://www.notationcentral.com Thanks for you kind help, —Nor Eddine Bahha (Jazz Piani st & Font Designer)

I am currently working with XCode 13.3.1 on OSX Monterey 12.3.1 on a Mac Mini M1. I have written some programs in Swift for personal use using a personal team certificate. I haven't paid the $99. Every couple of weeks or so, some of my programs will pop up a message saying "This Program Could Harm Your Mac" and won't let me run it when I try to launch them. It seems I have to recompile it and then it will work for a few more weeks. Other programs have run for several months. The programs are using Sandbox and Hardened runtime. Someone suggested that I try compiling the program without a certificate. I did that last night and the program ran. But this morning when I launched the program, I got a message that the program had unexpectedly quit. The "report" message said something about a code signature. FWIW, I am copying the program to my Applications folder.

When opening a pkg file on Mojave and Catalina I'm seeing following Package Authoring Errors in Installer log (/var/log/install.log):Package Authoring Error: <background> has an unsupported MIME type: image/data Package Authoring Error: <background_scaling> has an unsupported MIME type: X-NSObject/NSNumber Package Authoring Error: <background_alignment> has an unsupported MIME type: X-NSObject/NSNumber Package Authoring Error: <layout-direction> has an unsupported MIME type: X-NSObject/NSNumberwhich is weird because background is defined in pkg Distribution XML as:<background file="background.tiff" alignment="bottomleft" scaling="none" mime-type="image/tiff"/>based on specification of Distribution file in https://developer.apple.com/library/archive/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.htmlSimilar problems can be seen even on pkg installers that contain no background XML element. That also includes pkg files downloaded from Apple website.Is there any explanation where these errors are coming from?

I have a framework that I am trying to embed in an application.The framework uses cmake to build itself, and I can rebuild as needed to fix this problem.When I include the library in my application, with Code Sign On Copy checked, the step fails with a file not found. Tracing the output, it is trying to sign a library at Versions/A. The library should have a version of 1.10.0, and when doing otool it reports the version numbers as 1.10.0.So, where does xcode get that A for the version when trying to sign the library? What can be changed so it has the right version number?

In one of the applications that I develop, since version 9.3 of Xcode, an embedded target binary that is launched from the main application using NSTask now fails to launch with the following error message:Sandbox: [AppName(App PID)] deny(1) forbidden-sandbox-reinitI couldn't find much information about it and it's not clear what change happened in Xcode 9.3 (also happens in 9.4 beta 1) that causes this to fail.

i have a mac app,like simpholders app,to find and manager simulator's sandbox and gouse NSTask exe command:/usr/bin/xcrunwill show errorxcrun: error: cannot be used within an App Sandbox.

Hi, Created new "Dev ID Application" certificate and it shows in my local Keychain where I created CSR as "Certificate is not trusted". I also see some Push Notification certs created recently have the same warning. Items tried. Installed new Intermedate certs as recommended in post https://developer.apple.com/forums/thread/672933 :- WDRCA-G3 expiring 20-Feb 2030 installed on (Login -> Certifcate) WDRCA expiring 7-Feb 2023 installed on (Login -> Certifcate) Deleted and reinstalled both of the above WDRCA certs Restarted Keychain & Mac several times. The same warning is seen on each of Mac nodes that I have installed the new certs on. Does anyone know how to resolve or have any suggestions on how I can debug this problem.

Hi all, I'm attempting to distribute a notarized expiring demo variant of my Mac App Store app (TypeMetal) directly to potential customers as a download on our website, using the procedure documented here: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution I successfully complete the 9 steps listed in "Notarize Your App Automatically as Part of the Distribution Process", including choosing "Developer ID (Distribute directly to customers)" and "Upload (Send to Apple notary service)", and successfully download the resultant .app bundle, but I'm unable to run the app. It looks to me as if the system is attempting to obtain an App Store receipt for the app, when what I want is for this variant of the app to be treated as distinct from the purchased Mac App Store version, and be runnable without purchase. I have tried changing the app's bundle identifier and removing the LSApplicationCategoryType (in the Xcode target's settings, before building), but neither seems to affect these results. I'm left wondering how the system is determining that this is an .app that requires App Store sign-in/receipt-checking. When I copy the downloaded, notarized .app to a different macOS user account, log in as that user, and attempt to launch it there, the system presents a panel, prompting for the user to sign in with their Apple ID: When I attempt to launch the app in my own user account (the one I build and develop in), the system presents the same prompt in a slightly different form: Whether or not I provide a valid Apple ID sign-in in either case, the launched app then terminates with a fatal alert. (Same result in a separate user account as in my own development account.) I would like for the distributed app to be runnable by customers without requiring an App Store receipt. I have verified that my own App Store receipt-checking code is being omitted, as I intend, from the build I that submit for notarization. Is there something I need to do differently to make this work? The notarized app has passed the checks described here: Resolving Common Notarization Issues https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721 I can provide the outputs of the codesign and spctl checks recommended on that page, if that would be helpful. The .app contains one embedded framework (OpenSSL.framework) and one command-line executable (tidy), but I believe they are correctly code-signed. I'm testing this on a 2020 M1 MacBook Air running macOS 12.3.1 (21E258), using Xcode 13.3.1 (13E500a) to do the build, upload for notarization, and export of the notarized result. Thanks very much in advance for any insight you can offer. Troy Stephens Coherence Labs, LLC

I'm trying to get a pkg file notarized.The notarization process worked fine for me until some day ago.Now, when I run the altool command, I get this error : *** Error: To use this application, you must first sign in to iTunes Connect and sign the relevant contracts. (1048)I have checked https://developer.apple.com/account/ and https://appstoreconnect.apple.com/agreements/ too see if you have any pending agreement, but there is nothing there.The command I use is 'xcrun altool --notarize-app --primary-bundle-id $MYBUNDLEID --username $MYUSERID --asc-provider $MYTEAMID --password $MYAPPPASSWORD --file $MYPKGFILE'The last time the altool command worked for me was on the 29 May.Any idea what is going wrong here?

Hi,Is it possible to distribute an app which is bundled with a custom DAL plugin (CoreIOMedia plugin) in the Mac App Store? For installations outside the app store the installer copies the plugin to the "/Library/" folder.Regards,

So I've enabled Hardened Runtime on my app but want to test it actually does what it is meant to do.So I put in a simple couple of calls to location services on a button: CLLocationManager* locMan = [CLLocationManager new]; [locMan startUpdatingLocation];and expected my app to crash on Mojave since I hadn't ticked the "Location" option in the "Resource Access" section of the Hardened Runtime capabilities.Instead it carried on as normal and I saw the Location StatusItem show up in the menu bar with my app listed as something that was using Location services.So now I'm wondering if Hardened Runtime is really turned on for my app or not. Or am I misunderstanding its usage?FYI - My app is distributed via Developer ID provisioning, not the App Store.

Hello. According to Apple documentation, Developer ID Installer Certificate (Mac applications): If your certificate expires, users can no longer launch installer packages for your Mac applications that were signed with this certificate. https://developer.apple.com/support/certificates/ However, using installer signed before expiration, I can still install the application, even after certificate has expired and installer even shows it as Expired but valid. Could you please clarify if the quote above is true? Or how is it possible that I can still install the application? Thank you, Jakub

If my Mac app is using some private APIs and I can't publish it to the app store, can I still notarize this Mac App? Will Apple reject it?

We have an app company.app and it is loading dynamic library from a thirdparty vendor - let's call it vendor.dylib.company.app is signed by our organisation's developer ID certificate. We have notarized company.app with hardened runtime enabled.vendor.dylib is signed and notarised by vendor's certificate.Now, when company.app tries to load the dylib using dlopen, we get an error "not valid for use in process using Library Validation: mapping process and mapped file (non-platform) have different Team IDs"I read about disabling library validation entitlement https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-library-validation?language=objc and https://forums.developer.apple.com/thread/126895I added this in the info.plist file <key>com.apple.security.cs.disable-library-validation</key> <true/>After building the app and notarising it, i can still see the value com.apple.security.cs.disable-library-validation set to true in the final app's Info.plist.Yet, i get the same error "not valid for use....... mapped file have different Team IDs". It's as if 'disabling library validation entitlement' didn't take effect.Any pointers how to go about this?Note : I cannot opt for a solution where we take vendor.dylib and sign it with our certificate because even though it does seem to solve the loading problem, the vendor's code itself is doing some checksum verification which breaks if vendor.dylib is re-signed with our cert.

I have gone through this section related to Developer ID. But I'm not very clear about the role of developer id provisioning profile toward the expiration date of the Mac App. It says app that don't utilize the developer id provisioning profile will not expire even though the cert expire after the app installation of the app. Then it says apps that utilize advanced capabilities of provisioning profile will not work after the expiration of provisioning profile even though the cert is not expired. So what is meant by "Apps that don't utilize PP" and "Apps that utilize advance Capabilities of PP" Can we signed developer ID app with and without provisioning profiles? How we know that whether the PP is affect on the expiration date of Mac App or not?

Hello, I've searched for other posts on this topic but I haven't found anything that provides an answer.Here's my test program snippet, using the Xcode Mac Application Obj-C starter project:- (void)applicationDidFinishLaunching:(NSNotification *)aNotification { // Insert code here to initialize your application char const * dyld_library_path_original = getenv("DYLD_LIBRARY_PATH"); char dyld_library_path_new[1024]; strcpy(dyld_library_path_new, "/Applications/MATLAB_R2020a.app/bin/maci64:"); strcat(dyld_library_path_new, dyld_library_path_original); int rc = setenv("DYLD_LIBRARY_PATH", dyld_library_path_new, 1); NSLog(@"DYLD_LIBRARY_PATH=%s, rc=%d", getenv("DYLD_LIBRARY_PATH"), rc); void * handle1 = dlopen("libeng.dylib", RTLD_NOW); NSLog(@"Test 1: dlopen(libeng.dylib) = %p, err=%s", handle1, dlerror()); void * handle2 = dlopen("/Applications/MATLAB_R2020a.app/bin/maci64/libeng.dylib", RTLD_NOW); NSLog(@"Test 2: dlopen(libeng.dylib) = %p, err=%s", handle2, dlerror()); }As you can see, I'm trying to dlopen a dylib in the installed MATLAB application. But I don't think the specific dylib matters. What matters is that I'm dlopening it using just the leaf name of the path, after setting DYLD_LIBRARY_PATH at runtime to include MATLAB's dir (Test 1). This fails.But when I dlopen it with the full path (Test 2) it works. Here's the output:DYLD_LIBRARY_PATH=/Applications/MATLAB_R2020a.app/bin/maci64:/Users/hecht/Library/Developer/Xcode/DerivedData/TestML-droybqyctybedebamivvyiixjhnn/Build/Products/Debug:/usr/lib/system/introspection, rc=0 Test 1: dlopen(libeng.dylib) = 0x0, err=dlopen(libeng.dylib, 2): image not found Test 2: dlopen(libeng.dylib) = 0x6000039041a0, err=(null)I have Hardened Runtime enabled, with these entitlements turned on:Allow DYLD Environment VariablesDisable Library ValidationThe second one is doing its job, because without it, Test 2 fails also.But the first one doesn't help in allowing me to modify DYLD_LIBRARY_PATH at runtime. If I set the environment variable before launching (Xcode > Product > Scheme > Edit Scheme > Arguments > Environment Variables) then Test 1 works. Is there a way to get dyld to honor changes to this environment variable made at runtime?

Hello, I have a electron app. I want to notarize this app. But there is a problem about python module.In my case, some user will use it offline, so I need prepare common python modules for them.When I try to notarize app, Apple will return failed, and logs tell to me that python module (.so files) does not cotains a valid signature or a secure timestamp signature. What can I do to make app notarized with python module?Can I let apple ignore these python module in app or Is there a way to signature these python modules ?