Trying to notarize and AppleScript app following the instructions at Der Flounder (that are based on an Automator app).Code Signing works fineNotarization work fine.However when trying to stape the successful notarization the response to:xcrun stapler staple "/Volumes/HardDrive/MyApp.app"is:Processing: /Volumes/HardDrive/MyApp.app CloudKit query for MyApp.app (2/936578f9cf6dff6314bdebeba427cac9dab3f7e8) failed due to "record not found". Could not find base64 encoded ticket in response for 2/936578f9cf6dff6314bdebeba427cac9dab3f7e8 The staple and validate action failed! Error 65.

Submit my app to Mac App Store. workflow: Sign with cert: Developer ID Application ---> Success Notarize ---> Success Sign with cert: 3rd Party Mac Developer Application ---> Success productbuild with cert: 3rd Party Mac Developer Installer, and get .pkg artifact---> Success Transporter upload ---> Success TestFlight notify, and app update to the latest version ---> Success Click open, and then the ERROR comes like the screenshot photo So I'm confusing which step's wrong. And I believe my account certificates, profiles are all configured with no problem. Anybody have any clues? I've been here for many days.

Hi, I have a signed and notarized .pkg file. When I distribute this to my users, they're prompted if "Installer" can access files in the Downloads folder. Most of them click "OK", so that this installer can succeed, however those that click "Don't allow" can never install the .pkg file again. I've checked the following to no obvious resolution: Quarantine flags (no obvious flags were found) System Preferences, Security, Files and Folders (Installer.app is not listed) spctl --list (The .pkg shows there, but nothing obvious about it being blocked) A workaround is to copy this .pkg file to the Desktop folder. When run, the same prompt will appear again, except for the "Desktop" folder. If you click "OK", it succeeds. Since this behavior prevents the .pkg from running from Downloads ever again, how can this be reverted/fixed?

I have my macOS app, which I'm distributing outside the MAC App Store through Notarizing the App. When my end-user unzipped my App (which they downloaded from a shared URL path) and opened it, It crashed after the first time opening (by clicking on the Gatekeeper check popup: "Chrome downloaded this file today at 11:10 AM. Apple checked it for malicious software and none was detected. ") In my macOS app (distributing outside the MAC App Store through Notarizing the app), though I removed AppSandbox capability, I am still not able to read/write to the Resource folder. Error ESPlus-2023-06-28-173050_ips.txt Error Domain=NSCocoaErrorDomain Code=513 "You don’t have permission to save the file “SupportTextFiles” in the folder “Resources”." UserInfo={NSFilePath=/x.app/Contents/Resources/SupportTextFiles, NSUnderlyingError=0x6000030e3c00 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}

Hi, I distribute my app for macOS outside AppStore. I implemented Auto Update function which worked perfectly up to Ventura 13.0. And it was broken since Ventura 13.1+ The old version of my app downloads a ZIP arhive with a new version to temporary folder and unpack it to User's Library > Application Support > My AppFolder. The new unpacked version gets attribute com.apple.quarantine and the old app cannot run it. Before Ventura 13.1 the new unpacked app could be run successfully and it closes the old version and replaces the old APP bundle in Applications. And then a copy of new app in a temporary folder is being deleted. In fact, the new APP could work as an agent to perform the update of my app. Both apps (old and new) are signed and notarized by one team (the same signature).

from some reason after some time my application dmg was signed and worked perfectly fine i started to get "cannot be opened because the developer cannot be verified." when clicking on the application after it was installed. when running the signing process i get Current status: Accepted...............Processing complete when checking the Submission ID received at apple it also showed approved what other issues might it be?

Hi, in the video wwdc2022-10096 at about 05:45 it is explained how to allow other software to update your software by adding team-idetifiers an signing-identifiers to an Info.plist. I would need a few more details. Which Info.plist file do I have to change? I use pkgbuild to build the packages and productbuild to combine them. pkgbuild --analyse --root generates an .plist-file for every single package. Do I have to add the Information there? productbuild --sythesize generates an xml-file discribing the whole thing. This would refer better to the installer as a whole, but it is not an info.plist. How and where exactly to add the information? I tried to use plutil, but it doesn't like array-names to start with numbers as team-identifiers often do. Also it crashes quite often. The .plist-files generated by pkgbuild either contain an empty array or several unnamed items. [ ] Do I even need to add something threre? The other one contains several Items: [   0 => {     "BundleIsRelocatable" => 0     "BundleIsVersionChecked" => 1     "BundleOverwriteAction" => "upgrade"     "NSUpdateSecurityPolicy" => {       "AllowProcesses" => {         "123ABC" => [           0 => "com.example.pal.about"         ]       }     }     "RootRelativeBundlePath" => "Library/PreferencePanes/XXX.prefPane"   }   1 => {     "BundleIsRelocatable" => 0     "BundleIsVersionChecked" => 1     "BundleOverwriteAction" => "upgrade"     "NSUpdateSecurityPolicy" => {       "AllowProcesses" => {         "123ABC" => [           0 => "com.example.pal.about"         ]       }     }     "RootRelativeBundlePath" => "Library/Frameworks/XXX.framework"   }   2 => {     "BundleHasStrictIdentifier" => 1     "BundleIsRelocatable" => 0     "BundleIsVersionChecked" => 1     "BundleOverwriteAction" => "upgrade"     "NSUpdateSecurityPolicy" => {       "AllowProcesses" => {         "123ABC" => [           0 => "com.example.pal.about"         ]       }     }     "RootRelativeBundlePath" => "Applications/XXX.app"   } ] Should it look like this? A more detailed example would be great. Thanks!

I am developing a new pam module in Monterey [12.6], where I have a dynamic library [.so file] (usage external curl & openssl library) which is referenced from PAM. More specifically, this is a setup to allow Multi factor Authentication to be used for all authentication.it simply calls some apis. When I added this module for sudo authentication in /etc/pam.d/sudo file as auth sufficient /usr/local/lib/security/pam_google_authenticator.so It logs "Library Validation failed: Rejecting 'pam_google_authenticator.so' (Team ID: XXXXXXX, platform: no) for process 'sudo(2498)' (Team ID: none, platform: yes), reason: mapping process is a platform binary, but mapped file is not" but it still loads my pam module and everything is working fine. But when I added this module for lock screen into /etc/pam.d/screensaver same as above, it logs "Library Validation failed: Rejecting 'pam_google_authenticator.so' (Team ID: XXXXXXXX, platform: no) for process 'loginwindow(15839)' (Team ID: none, platform: yes), reason: mapping process is a platform binary, but mapped file is not" and took back to logon window[not sleep window] I have code signed pam_google_authenticator.so with codesign --force --deep --sign "Developer ID Application: --------------(XXXXXXX)" /usr/local/lib/securitypam_google_authenticator.so For your reference I can here are the logs in console app crash report System Integrity Protection: enabled Crashed Thread: 3 Dispatch queue: com.apple.loginwindow.auth Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 Exception Codes: 0x0000000000000001, 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFY Termination Reason: Namespace SIGNAL, Code 11 Segmentation fault: 11 Terminating Process: exc handler [25964] I have found other references to this error but those seem to involve application bundles. In my case I have a single .so library (plus the two others) I wish to invoke. The library is from https://github.com/google/google-authenticator-libpam Again, this works fine in the three previous OS versions. What do I need to change to make it work here? Advice most appreciated, please. Thank you!

I have signed Safari app using product-> archive with automatic sign option using developer ID and notarised to distribute out side of App Store. Finally , I have observed that Safari is showing extension only in develop mode by selecting allowing unsigned apps option. why safari treating properly signed as unsigned ? Is my understanding correct?

I noticed jq (installed from Homebrew) has an ad hoc signature and is rejected by spctl but runs fine. I don't remember ever being prompted by my Mac as to whether this binary should be allowed to run. I repeated the experiment with another binary (aescrypt) downloaded from Homebrew. Should Gatekeeper prevent these binaries from executing until I intervene? Is there any online documentation explaining the conditions that allow some binaries that are rejected by spctl and have no signature chain rooted at Apple to execute? (Or am I just not understanding how to use Gatekeeper and spctl?) codesign analysis: % codesign -vvd /opt/homebrew/bin/aescrypt Executable=/opt/homebrew/Cellar/aescrypt/0.7/bin/aescrypt Identifier=aescrypt Format=Mach-O thin (arm64) CodeDirectory v=20400 size=545 flags=0x20002(adhoc,linker-signed) hashes=14+0 location=embedded Signature=adhoc Info.plist=not bound TeamIdentifier=not set Sealed Resources=none Internal requirements=none And checking spctl analysis: % spctl --assess -vvv /opt/homebrew/bin/aescrypt /opt/homebrew/bin/aescrypt: rejected

We have a DMG for our Mac desktop app that has notarized OK, but on stapling we get the error below. The DMG and its contained app are signed (prior to Catalina this was sufficient.) The .app folder is directly constructed in our build process (not using XCode or similar); the .dmg is by DMGCanvas. The app only contains the UI; the libs and command-line tools are in a sibling folder, laid out much as they are on our other *nix builds. (When installed, everything is placed in a dedicated folder inside /Applications to keep it all in one place.)Searching for the error "Certificate authority pinning mismatch" almost entirely links to cssmapple.h, which implies not many other people have run into this?OS: 10.15.1Xcode: 11.1xcrun: 48Notarization:Request Identifier: 71c0468a-2a58-46ae-b699-22462e8593b0Stapling:Properties are { NSURLIsDirectoryKey = 0; NSURLIsPackageKey = 0; NSURLIsSymbolicLinkKey = 0; NSURLLocalizedTypeDescriptionKey = "Disk Image"; NSURLTypeIdentifierKey = "com.apple.disk-image-udif"; "_NSURLIsApplicationKey" = 0; } Codesign offset 0xcee4caf length: 9556 Stored Codesign length: 9556 number of blobs: 3 Total Length: 9556 Found blobs: 3 Props are { cdhash = {length = 20, bytes = 0xfb512617c5c078595f7a2ab6f74c73d7fa00a73c}; digestAlgorithm = 2; flags = 0; secureTimestamp = "2019-09-12 15:10:53 +0000"; signingId = "FICO Xpress 8.7.0 for Mac Installer"; teamId = KL84GEX7ZW; } JSON Data is { records = ( { recordName = "2/2/fb512617c5c078595f7a2ab6f74c73d7fa00a73c"; } ); } Headers: { "Content-Type" = "application/json"; } Domain is api.apple-cloudkit.com Certificate trust evaluation did not return expected result. (5) [leaf AnchorApple ChainLength IntermediateMarkerOid] Certificate trust evaluation for api.apple-cloudkit.com did not return expected result. Certificate authority pinning mismatch. Certificate trust evaluation did not return expected result. (5) [leaf AnchorApple ChainLength IntermediateMarkerOid] Certificate trust evaluation for api.apple-cloudkit.com did not return expected result. Certificate authority pinning mismatch. Could not establish secure connection to api.apple-cloudkit.com Response is (null) error is Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLStringKey=https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup, NSLocalizedDescription=cancelled, NSErrorFailingURLKey=https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup} Size of data is 0 CloudKit's response is inconsistent with expections: (null) The staple and validate action failed! Error 68.

I had a process for generating an app using JPackage that was working well in Catalina. The signing process worked and generated apps that could be downloaded from my website and run without problems. When my users had Ventura they could install from the dmg, but running the app gave "can't be opened because Apple cannot check it for malicious software". This is the error I used to get on Catalina before signing. I updated my development computer to Ventura in the hopes that building using that OS version would clean up the problem, but no such luck. The app runs without problems when I run it from the build location. I just get the above error when the dmg is downloaded from the internet. The setting to allow applications from trusted developers is correct on my system. I'm using: Java 17 (though Java 20 does behaves the same) Xcode 14.3 is installed (jpackage uses it under the hood) My signing certificate shows as "this certificate is valid" in the system keychain using "codesign -vvv --deep --strict" on the dmg and app claims "satisfies its Designated Requirement" (though I don't know what that means and there's no other information given) Attempting to run codesign to sign the app tells me "already signed" The code I have is pure Java, but does use JavaFX There are no warnings or errors from jpackage when building I would really appreciate suggestions on why the signing doesn't appear to be working any longer. Thank you!

I'd like to share a screensaver I developed (for OSX) but I couldn't find a way to code-sign it. Without it, it is almost impossible to install on other machines due to 'Gatekeepr' warnings. (right click & `open` works, but most people don't know about it.)Any ideas on code-signing or distribution alternatives? I'm simply sending the .saver bundle at the moment

Hi, I've succesfully notarzied an OSX app using xcode (see attached image). But when running " %spctl -a -vvv -t install Meetverse_UTFSM_MAC_v091.app" I get Meetverse_UTFSM_MAC_v091.app: rejected source=Unnotarized Developer ID %codesign -v --verbose Meetverse_UTFSM_MAC_v091.app shows : Meetverse_UTFSM_MAC_v091.app: valid on disk Meetverse_UTFSM_MAC_v091.app: satisfies its Designated Requirement When I try to open the app in other computers Gatekeeper shows "Can't be opened , Apple cannot check for malicious software" I've tried exporting several times the notarized app, with different builds. Any help would be appreciated, thank you.

Hello, I am trying to distribute a macOS app directly to consumers. Recently I came across this article titled 'Cloud-managed certificates', which details that Apple will sign apps by authorizing you via you Developer program membership, but would like to see if this is usable from the command line or thirdparty tools. To confirm that this article does what it says, I created a new generic SwiftUI app on a new Mac that does not have any existing "Developer ID Application" certificates in keychain. In the signing tab, it shows With this, when I 'archive', the Xcode Organizer appears. If I click distribute, then 'Developer ID', 'Upload', 'Automatically manage signing', it correctly displays "Certificate: Cloud Managed Developer ID Application" and then gives me the option to notarize it. Now, this was all done via the Xcode Organizer via an Xcode-managed app. I was wondering if it would be possible to use this cloud-managed signing service from the CLI, so that I can integrate it with existing tooling and CI/CD pipelines.

I have a setup (working in 10.1[345]) which now fails in Big Sur, where I have a dynamic library (which calls another external library which in turn calls another) which is referenced from PAM. More specifically, this is a setup to allow PIV smartcards to be used for "sudo" authentication. Thus, I have a line in /etc/pam.d/sudo which calls /usr/local/libexec/pam_ssh_agent_auth.so. This library calls a perl script which does a network LDAP lookup for the current user. I have code-signed the pam_ssh_agent_auth library as well as the non-system library it references (as seen by "otool -L") and the non-system library that the intermediate one calls. These are all located in /usr/local/libexec as well. When I run a sudo command now, e.g., "sudo date", the command simply hangs. The error I see in Console is: Library Validation failed: Rejecting '/usr/local/libexec/pam_ssh_agent_auth.so' (Team ID: 82A95CK2HC, platform: no) for process 'sudo(16107)' (Team ID: none, platform: yes), reason: mapping process is a platform binary, but mapped file is not. I have found other references to this error but those seem to involve application bundles. In my case I have a single .so library (plus the two others) I wish to invoke. The library is from https://github.com/jbeverly/pam_ssh_agent_auth/releases Again, this works fine in the three previous OS versions. What do I need to change to make it work here? Advice most appreciated, please. Thank you!

Hi, I created an app in Electron and I'm using electron forge to make the app and pkg file. Each time I make the project the .app and .pkg files are created with no errors. When I run the "spctl -a -vvv -t install" command on the .app file, it says that the app is accepted. However, when I run the command on the .pkg file it says that it is rejected with "source=Unnotarized Developer ID" and the "origin=Develop ID Installer: " is the valid certificate that I created. Is someone able to help me troubleshoot this issue?

Hi, I'm at the the end of the whole codesign, notorize, staple deployment journey and testing the installation of my app that I've downloaded from Google Drive. It is a zip file that contains just the app. When I double click to open, I get the "My App" is an app downloaded from the internet....prompt. It says it has checked it for malicious software and none has been detected. When I click on Open, the app runs but the UI doesn't present - no windows are open. Quit doesn't work, I have to Force Quit. If I drag it to another folder it opens OK. I realise that most third party apps have DMG installer, so the user has to drag the app as a matter of course, but I like the simplicity of using a .zip file. I'd appreciate if someone could explain why this is happening (even after the user has granted approval to open) and if there is a way to open the app directly from where it has been downloaded to? Thanks, Stewart

I am trying to modify an existing bundle so that I can notarize it. Here its organisation: graps.app Contents MacOS prelaunch <-- main applauncher grasp <-- auxiliary binary calling the libraries Here the original DYLD_LIBRARY_PATH: DYLD_LIBRARY_PATH="." DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:/Applications/MATLAB/MATLAB_Runtime/v911/runtime/maci64" DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:/Applications/MATLAB/MATLAB_Runtime/v911/bin/maci64" DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:/Applications/MATLAB/MATLAB_Runtime/v911/sys/os/maci64" export DYLD_LIBRARY_PATH and the RPATHs that mimic it: install_name_tool -add_rpath "/." grasp install_name_tool -add_rpath "/Applications/MATLAB/MATLAB_Runtime/v911/bin/maci64" grasp install_name_tool -add_rpath "/Applications/MATLAB/MATLAB_Runtime/v911/runtime/maci64" grasp install_name_tool -add_rpath "/Applications/MATLAB/MATLAB_Runtime/v911/sys/os/maci64" grasp install_name_tool -add_rpath "/Applications/MATLAB/MATLAB_Runtime/v911/extern/bin/maci64" grasp Note that it is not enough to add RPATHs to the auxiliary binary "grasp". They must also be added to the main binary "prelaunch". But why ? 1- Unsigned application using DYLD_LIBRARY_PATH set RPATHs set DYLD_LIBRARY_PATH not set DYLD_PRINT_LIBRARIES ### App running ### 2- Unsigned application with lib tracking set RPATHs set DYLD_LIBRARY_PATH set DYLD_PRINT_LIBRARIES ### App hangs after loading 894 libraries (MatLab has more than 3000 libs and uses many macOS libs) ### The terminal output is a total of 119594 characters. ### Is this more than allowed by `DYLD_PRINT_LIBRARIES`? ### As a consequence the check cannot be completed. Too bad !!! 3- Unsigned application using RPATHs set RPATHs not set DYLD_LIBRARY_PATH set or not DYLD_PRINT_LIBRARIES ### Error: Could not find version 9.11 of the MATLAB Runtime. ### Attempting to load libmwmclmcrrt.9.11.dylib. <-- it does not say "not found"! 307 libs are loaded before this error message occurs 59 are MatLab libs all from /bin/maci64 but the following one is from /runtime/maci64 libmwmclmcrrt.9.11.dylib is the 13th lib loaded and the 6th MatLab one: dyld: loaded: <11D060E5-13C3-34EE-96C9-A7EA2A7E34B3> /Applications/MATLAB/MATLAB_Runtime/v911/runtime/maci64/libmwmclmcrrt.9.11.dylib Note that MacOS does not say "not found" Thus RPATH does not seem to behave exactly as DYLD_LIBRARY_PATH did but why? How can "ignoring DYLD_LIBRARY_PATH" break a library loading ? How can I debug this ? This is very disappointing since, otherwise, the application would easily sign and notarize. I have exhausted all the tracks I knew and found on the internet. Alain

I'm trying to notarise a command line tool (DuckDB) so people can download it from the web, double-click on it and it opens in Terminal.app just like it does locally. However, despite signing and notarising properly (I think) I cannot get the dialog where "open" is allowed, saying that it cannot be opened because "the identity of the developer cannot be confirmed". Here's what I'm doing: We start with a "raw" universal binary (called duckdb), pretty much what is in this file: https://github.com/duckdb/duckdb/releases/download/v0.7.1/duckdb_cli-osx-universal.zip I code-sign this like so: codesign --all-architectures --force --options runtime --sign "..." duckdb` This seems to work: codesign --verify -v duckdb  bin/duckdb: valid on disk bin/duckdb: satisfies its Designated Requirement Then, I create a ZIP archive and submit the binary for notarisation zip -j duckdb.zip duckdb xcrun notarytool submit --apple-id [...] --team-id[...] --keychain-profile [...] --wait --progress duckdb.zip This succeeds with status "Accepted". The notarization seems to have worked codesign -vvvv -R="notarized" --check-notarization   duckdb  duckdb: valid on disk duckdb: satisfies its Designated Requirement duckdb: explicit requirement satisfied Because I cannot staple the notarization to a ZIP file or a binary (I think), I am creating a DMG with the binary in it, sign it, notarise it again, and then staple the new notarisation (the one from the DMG) to that. But alas, when I download that DMG onto another computer, I still get the issue about the identity. Any ideas here? Is it just not possible to notarise a "raw" command line tool that opens in Terminal?