General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi everyone, I am developing an iOS companion app with an integrated watchOS component (a golf swing tracking tool using CoreMotion). I have run into an issue where the watchOS app gets stuck indefinitely in the "Installing..." state and never finishes installing on the physical Apple Watch. Environment (All on latest public releases): Xcode Version: Latest release (Xcode 18.x) macOS Version: Latest release (macOS Sequoia / latest version) iOS Version: Latest release (iOS 20.x) watchOS Version: Latest release (watchOS 13.x on Apple Watch Ultra 2) Deployment Target: Matched to latest minimum deployments Signing: "Automatically manage signing" enabled with an active Apple Developer Program account Steps to Reproduce: Connect the iPhone to the Mac via a physical cable. Select the iOS target in Xcode and successfully run/install the companion app onto the iPhone. Launch the stock Watch app on the paired iPhone. Scroll down to the "Available Apps" section, locate the development app, and tap "Install". The circular progress indicator starts spinning with the status "Installing...", but it remains in this state indefinitely (waited over 2 hours) without ever completing, timing out, or surfacing an error alert on either the iPhone or the Apple Watch. Troubleshooting Already Verified: Bundle ID Hierarchy: iOS App: com.company.appname Watch App: com.company.appname.watchkitapp Both targets share the exact same Development Team, signing certificate, and provisioning profiles. Developer Mode: Explicitly enabled and rebooted on the Apple Watch (Settings -> Privacy & Security -> Developer Mode). Also verified as enabled on the host iPhone. Connectivity & Cache: Cleared Xcode DerivedData (rm -rf ~/Library/Developer/Xcode/DerivedData). Performed hard reboots on both the iPhone and the Apple Watch to terminate any hung background sync daemons (installd / CoreDevice). Ensured both devices and the Mac are on the same Wi-Fi network with Bluetooth turned on. Questions: Under the current CoreDevice architecture, is installing local debug builds via the iPhone's stock Watch app still supported, or does it silently fail because the physical Apple Watch's UDID is not directly provisioned during an iOS-only build? Which subsystem in macOS Console.app (e.g., com.apple.dt.CoreDevice, com.apple.StreamingExtractor, or installd) is best for tracking the exact error/timeout code when the watch installation hangs? What is the currently recommended workflow to deploy and debug a paired watchOS target directly onto physical hardware? Any insights from the team or community would be greatly appreciated!

I'm asking about how to ask for an addition to a managed entitlement, where we already have a grant of that entitlement (with a different value) and we already have other managed entitlements granted. This post https://developer.apple.com/forums/thread/789176 tells me I can request entitlements at the Requests tab here: https://developer.apple.com/account/resources/, which leads me to this form: https://developer.apple.com/contact/request/system-extension/ The form URL doesn't specify a particular App Identifier, but is the Identifier implied with this form submission? Or, put another way, is the entitlement we're asking for attached only to the Team ID, or also to the bundle ID of the app which is going to use the entitlement? So if I made another app which talks to my dext, I'd have to ask again for userclient-access to the same dext, but from a different bundle ID? The form says "Which DriverKit entitlements do you need" and "select all that apply", but I'm unclear about whether I need to request ALL the DriverKit entitlements we need for all our apps, or only for the specific App Identifier I reached this form from. It also isn't clear if I need to check both the USB Transport and the UserClient Access boxes in my case. We already have UserClient Access granted for at least one bundle ID, and I want to add another. We already have USB. Transport granted for two different vendor IDs. Do I need to mention that in my request here, and also check the USB Transport box, although I'm not requesting any new vendor ID values? I don't want to end up with new profiles which break new builds of existing apps which were relying on previously-granted entitlements that are now missing from the newly-generated profiles. Here: https://developer.apple.com/forums/thread/822652 user JackLongbow submitted a request for UserClient Access for two bundle IDs, presumably in the form of a simple two-line string like this: com.turing.TuringTouch com.turing.TuringTouch.TouchDriver but the resulting provisioning profile was malformed, it contained this value under com.apple.developer.driverkit.userclient-access <string>com.turing.TuringTouch com.turing.TuringTouch.TouchDriver</string> the Forum post said that the approved entitlement looks like this: <array> <string>com.turing.TuringTouch</string> <string>com.turing.TuringTouch.TouchDriver</string> <string>com.turing.TuringTouchDriver</string> <string>com.turing.virtualpad</string> <string>com.turingdraw.DigidrawTouch.DigidrawDriver</string> </array> Should I be formatting my request as above, as a chunk of xml, or is a plain text list of bundle IDs, one per line, acceptable? Is there a way for us to get a summary of all the managed entitlements already granted to our team? At present, it seems like I have to pick a particular profile, download it, and QuickLook at it - but not all profiles contain all entitlements, just as apps don't have to claim all the entitlements the profile offers .

Every App Store Connect upload I sign with my Cloud Managed Apple Distribution certificate is rejected with ITMS-90035 ("Code failed to satisfy specified code requirement(s)") for the app binary and its widget extension. It happens from Xcode Cloud and from a manual Organizer upload alike. I think I have found the cause, and it looks like a Unicode normalization bug in cloud-managed signing. The certificate holder's name contains an umlaut: "Apple Distribution: Jonathan Thorsten Müller (…)". In the certificate the "ü" is precomposed (NFC, UTF-8 c3 bc). In the designated requirement that the export writes into the signature it is decomposed (NFD, "u" + U+0308, UTF-8 75 cc 88): certificate subject CN ... 4d c3 bc 6c 6c 65 72 ... ("Müller", NFC) designated requirement leaf CN ... 4d 75 cc 88 6c 6c 65 72 ... ("Müller", NFD) The bytes differ, so the signature can never satisfy its own designated requirement. It reproduces with Xcode 27.0's App template, unmodified, and without uploading anything: Archive for a generic iOS device. With no distribution identity in the local keychain, export for App Store Connect to a folder (export options: method app-store-connect, destination export, signingStyle automatic). DistributionSummary.plist shows "Cloud Managed Apple Distribution". xcodebuild -exportArchive -archivePath MyApp.xcarchive -exportPath out -exportOptionsPlist ExportOptions.plist -allowProvisioningUpdates Verify the exported app: codesign --verify --strict -vv Payload/MyApp.app Result: "valid on disk", then "does not satisfy its designated Requirement". Compare the requirement with the certificate's subject: codesign -d -r- Payload/MyApp.app codesign -d --extract-certificates Payload/MyApp.app openssl x509 -inform DER -in codesign0 -noout -subject -nameopt RFC2253,-esc_msb | xxd The same archive exported with a regular Apple Distribution certificate (same name, private key in my keychain) writes the NFC form, verifies, and App Store Connect accepts that upload. That works for manual uploads only. Xcode Cloud always signs with the cloud-managed certificate, so I cannot distribute from Xcode Cloud at all. Setup: Xcode 27.0 (27A266a) locally and in Xcode Cloud, automatic signing, one team, no custom code-signing flags. Product name, bundle IDs and file names are plain ASCII. Questions: Is this a known issue with cloud-managed signing and non-ASCII certificate names? Is there a supported way to have Xcode Cloud sign without hitting it in the meantime? If you see ITMS-90035 on Xcode Cloud and your name (or your team's) has an accent or umlaut in it, you may be hitting the same thing: run step 3 on an exported IPA and check.

Hi, I have a hard time renewing my certificates. The double click on the .cer file just opens the Keychain Acces but doesn't install anything. I'm missing a step. Thanks in advance for your help.

I am new to macOS development and presently tearing my hair out trying to get a driverkit extension to build. I have tried following the instructions here: https://developer.apple.com/documentation/driverkit/communicating_between_a_driverkit_extension_and_a_client_app namely, disabling SIP, but I am still unable to get my extension to build. The instructions say to set the code signing identity to "Sign to Run Locally" for all three targets, but this is not listed as an option for the driver extension.

Hello, I am experiencing persistent ITMS-90034 when trying to upload the first iOS app from a newly enrolled Individual Apple Developer Program account. The exact error is: Validation failed (409) Missing or invalid signature. The bundle at "Payload/[App].app" is not signed using an Apple submission certificate. (ID: 90034) I have already performed extensive signing checks and troubleshooting: Apple Developer Program membership is active. A valid Apple Distribution certificate is installed in Keychain together with its private key. security find-identity -v -p codesigning reports both Apple Development and Apple Distribution as valid identities. The correct Team and Bundle ID are selected. Automatic signing is enabled in Xcode. Provisioning profile caches and DerivedData were deleted, profiles were downloaded again, and a completely fresh archive was created. Xcode's App Store Connect export review explicitly shows: Certificate: Apple Distribution App Store provisioning profile for the correct Bundle ID get-task-allow = false beta-reports-active = true I then exported the IPA locally using Xcode's App Store Connect distribution workflow and independently inspected the actual exported binary with codesign. The main application reports: Identifier=[Bundle ID] Authority=Apple Distribution: [Name] ([Team ID]) Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA TeamIdentifier=[Team ID] I also separately checked the embedded Capacitor.framework and Cordova.framework. Both are signed with the same Apple Distribution identity and Team ID and show the same WWDR -> Apple Root CA trust chain. I checked Keychain as suggested in similar forum discussions. The Apple Distribution certificate has its private key, the WWDR intermediate certificates are present and valid, and certificate verification reports: "...certificate verification successful." Despite all of the above, a fresh upload from Xcode Organizer still consistently fails with the same ITMS-90034. This appears very similar to other recent reports involving newly enrolled Individual Developer accounts where correctly signed binaries are rejected by App Store Connect. I also opened an Apple Developer Support case (case 20000149684934). So far I have received general signing/troubleshooting documentation, but the issue remains unresolved. At this point, is there any additional local signing verification I should perform, or could this indicate an account/team-level App Store Connect signing validation issue that needs to be investigated on Apple's side? I would especially appreciate guidance from Apple DTS on what diagnostic information would be useful to distinguish a local certificate-chain issue from an App Store Connect/account-side validation issue. Thank you.

When trying to develop an Apple Shortcut, the shortcut doesn't appear (after many open, quit, adding permissions, etc.). My only Apple Account is my name associated with an Apple ID of QZ99..... However, when I try to check one (of many reasons) why it does not show up with Terminal: codesign -dv --verbose=4 "/Applications/My App.app" etc, it shows something "rejected" Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA Signed Time=Aug 25, 2026 at 1:26:38 PM Info.plist entries=22 TeamIdentifier=QZ99... Runtime Version=26.5.0 Sealed Resources version=2 rules=13 files=4 Internal requirements count=1 size=204 /Applications/Write Create Date from Original.app: rejected origin=Apple Development: My Account (K533...) The K533... is different than my Team ID of QZ99... Could that be a reason my app is not registered with Shortcuts? Is that expected functionality? I guess I expected my Team ID to appear everywhere even after I deleted my account in Xcode, removed a current and expired certificate associated with K533 in Keychain, and then added my account back, and let Xcode regenerate a certificate.

Installing a development build on a physical iPhone fails with: 0xE8008018 - The identity used to sign the executable is no longer valid. On the same Mac, same iPhone, same codebase and same Xcode, switching to a free personal Apple ID team installs and runs with no error. Only builds signed with our paid organisation team fail. Nothing else changes between the two runs. We have already regenerated certificates and provisioning profiles, deleted the profiles folder, cleared DerivedData, removed old identities from the keychain, trusted the profile on device, and tried both automatic and manual signing. None of it changes the result. We have also gone through the existing threads on this error and none of the suggested fixes apply. The build validates locally but the device rejects the identity. Since the signing team is the only variable between success and failure, what should we be looking at? A support case is open with Developer Support but we have not had a technical response yet.

To rule out anything stuck on the original App ID, I created a completely new Bundle ID (br.com.minhapecuaria.ios2) from scratch: New App ID registered in the portal, Sign In with Apple capability enabled. New App Store provisioning profile generated and installed, tied to that Bundle ID. New app record created in App Store Connect for it. Manual signing in Xcode, explicitly selecting the new Distribution certificate + new profile. Verified via codesign/security cms -D: Apple Distribution identity, get-task-allow: false, no device list — a genuine App Store signature. Uploaded via Xcode Organizer → same result: error 90034 ("Missing or invalid signature... not signed using an Apple submission certificate"). Since this Bundle ID never existed before, there was nothing "stuck" on it — no stale provisioning history, no cached signing decision tied to that specific App ID. The fact that the error persists identically rules out anything project-specific and points squarely at the account/Team level (Team ID 395DDXTXHC). I've also opened a support case (20000125779862) with this exact evidence, but so far only received generic first-line responses (certificate basics, Feedback Assistant suggestions) that don't address the account-level nature of the issue. Posting here in case anyone has seen this specific pattern — same 90034 across two independent Bundle IDs/certs/profiles under the same Team.

Hello, I’m experiencing a persistent App Store Connect upload issue that seems unrelated to my project. Every upload is rejected with: Validation failed (409) Missing or invalid signature. The bundle is not signed using an Apple submission certificate. (Error 90034) What I have already verified: Apple Developer membership is active. I am the Account Holder. Apple Distribution certificate exists and is valid. App Store provisioning profile was recreated. Automatic signing is enabled. Archive is exported using “App Store Connect” distribution. The exported IPA is signed with Apple Distribution (verified with codesign). I tested both Xcode Organizer and Transporter. I created a brand new native Xcode “Hello World” project, and it fails with exactly the same error. The project contains no frameworks, no CocoaPods, no Swift Packages, no Flutter, no React Native, and no embedded binaries. Since even a brand new Xcode project fails, I believe this is related to my Apple Developer account or App Store Connect validation infrastructure rather than the project itself. Has anyone experienced this before or knows what else can be verified? Team ID: 395DDXTXHC Thank you.

There are currently 2 active certificates in the Apple enterprise developer account. One certificate belongs to one application is going to expire in a week, when I try to create a new certificate the option 'In-house and adhoc' is disabled with error text 'Maximum number of certificates generated'. This is the first time I encountered this issue. There was a 3rd certificate also, I have revoked 3 days back as that certificate not required, still displaying the same error. If anyone faced the similar issue in the past, please share how this can be solved.

Hi, I’m trying to submit my iOS app Minha Pecuária to App Store Connect, but Apple consistently rejects the build with: Validation failed (409) Missing or invalid signature. The bundle ‘br.com.minhapecuaria.ios’ is not signed using an Apple submission certificate. Error 90034. I have already verified that: The app is signed with an Apple Distribution certificate. The App Store provisioning profile is linked to the correct Distribution certificate and Bundle ID. Automatic signing is enabled in Xcode. The exported IPA was independently checked and shows Apple Distribution as the signing authority. The same error occurs through both Xcode Organizer and Transporter. I also reproduced the problem with a clean/new project. Could anyone from Apple or anyone who has experienced error 90034 confirm what could cause Apple’s server to reject a binary that is correctly signed with Apple Distribution? Thanks!

Hello, We already have an existing iOS app on this Apple Developer team that successfully uses Sign in with Apple. However, Sign in with Apple consistently fails for our second and newer App ID, com.siremo.flare, before any Apple credential or identity token is returned. Both apps belong to the same Apple Developer team and have equivalent Sign in with Apple configurations. App information: Affected app: Flare Affected Bundle ID: com.siremo.flare Working existing Bundle ID: com.siremo.aily Team ID: JYGN9K53XA Distribution: iOS Simulator and TestFlight TestFlight build: 0.2.3 (2) Developer Support case: 102947765951 Symptoms: In the iOS Simulator, the Sign in with Apple sheet becomes unresponsive after entering the Apple ID password. In TestFlight on physical devices, the system sheet displays “Sign Up Not Completed”. No Apple credential or identity token is returned to the app. Firebase Authentication and our backend authentication code are never reached. Console output from a reproduction using Apple’s native SwiftUI SignInWithAppleButton: Authorization failed: Error Domain=AKAuthenticationError Code=-7003 "(null)" UserInfo={AKClientBundleID=com.siremo.flare} ASAuthorizationController credential request failed with error: Error Domain=com.apple.AuthenticationServices.AuthorizationError Code=1001 "(null)" The user did not cancel the authorization request. What we have verified: Sign in with Apple is enabled for com.siremo.flare in Certificates, Identifiers & Profiles. Apple Developer Support confirmed that Sign in with Apple is enabled for this App ID under case 102947765951. We removed and re-added the Sign in with Apple capability in Xcode and the Developer Portal. We regenerated the provisioning profile, created a new Archive, and distributed a new TestFlight build. The issue persists. We inspected the entitlements embedded in the actual archived Flare app: application-identifier = JYGN9K53XA.com.siremo.flare com.apple.developer.applesignin = [Default] The embedded provisioning profile contains the same application identifier and Sign in with Apple entitlement. The issue reproduces with multiple Apple ID accounts and multiple physical devices. Flare is our second app and newer App ID on this Apple Developer team. Our existing app, com.siremo.aily, successfully completes Sign in with Apple using: the same Apple Developer team the same physical device the same Apple ID an equivalent native Sign in with Apple implementation an equivalent entitlement and provisioning configuration Only the newer App ID, com.siremo.flare, fails with AKAuthenticationError -7003 and AuthorizationError 1001. We reproduced the same failure using Apple’s native SwiftUI SignInWithAppleButton. This rules out our custom ASAuthorizationController delegate, controller retention, presentation-anchor implementation, and custom button implementation. Our diagnostic logging confirms that the failure occurs before the Apple authorization callback succeeds and before an identity token is issued. Firebase Authentication and our backend are downstream of this callback and are therefore not involved in the failure. The combination of: AKAuthenticationError -7003 AKClientBundleID=com.siremo.flare AuthorizationError 1001 without a user cancellation the “Sign Up Not Completed” system message an existing App ID on the same team working correctly only the second and newer App ID failing the failure reproducing with Apple’s native SignInWithAppleButton appears similar to other reports where existing App IDs continue to work while newly registered App IDs fail, despite having valid Sign in with Apple capabilities, entitlements, and provisioning profiles. Could an Apple engineer please compare the server-side Sign in with Apple registration state of: Working: JYGN9K53XA.com.siremo.aily Failing: JYGN9K53XA.com.siremo.flare and verify whether the newer App ID was correctly registered and propagated in the Sign in with Apple backend? If the registration is incomplete, stuck, or inconsistent, could it be repaired or re-provisioned on Apple’s side? We can provide reproduction timestamps, Archive entitlement dumps, provisioning profile details, screenshots, and additional diagnostic logs if needed. Thank you.

I have a newly enrolled individual Apple Developer Program account (Team ID 798MLWU9L7) and I cannot upload my first build to App Store Connect. Every attempt fails with: Error 90034 — "Missing or invalid signature. The bundle 'com.gestaolocadoras2k.app' at bundle path 'Payload/....app' is not signed using an Apple submission certificate." I have already verified and ruled out everything on my side: The build is signed with a valid "Apple Distribution" certificate (a regular one, NOT a "Distribution Managed" cert). Entitlements show get-task-allow = false and beta-reports-active = true. I use a manually created App Store provisioning profile bound to that Apple Distribution certificate. WWDR intermediate certificates (G3 and G6) are present and valid in my keychain. I recreated the distribution certificate and the provisioning profile from scratch. It fails identically through BOTH Xcode Organizer AND Transporter (same error, Validation failed 409 in Transporter). My Developer Program membership is Active (renews July 2027). The "Free Apps" agreement is Active in App Store Connect; there are no pending agreements and no pending License Agreement banner. Apple System Status shows all relevant services operational (no outage). The account is ~6 days old and I have waited several days. Since the signature is valid and two independent tools reject it the same way, this looks like a backend account-activation issue rather than a signing problem. Could an Apple engineer please check my account? Team ID: 798MLWU9L7 Bundle ID: com.gestaolocadoras2k.app App Store Connect app ID: 6794145294 Thanks in advance.

Our iOS app fails to install via Ad Hoc or Development distribution with error: 0xe8008018 (The identity used to sign the executable is no longer valid). Environment: macOS 15.6.1, Xcode 16.0 Team ID: 8CJTVD465A Tested on iPhone 8 (iOS 16.7 + iOS 16.2) What works: TestFlight ✅, App Store ✅ What fails: Ad Hoc ❌, Development ❌ Key evidence: OCSP returns "good" for all certificates Brand new certificate (created today) → same error Install succeeds in Airplane mode but app shows "not available" at launch 4 different certificates, 3 profiles, 2 Xcode versions, 2 devices → all fail codesign --verify passes locally Full cert chain verified: Leaf → WWDR G3 → Apple Root CA This indicates Apple's online verification service is rejecting our team's signatures. Has anyone seen this or know how to resolve?

Am on Mac Tahoe, and have the WWDR G4 cert in my login keychain, however, all the certificates am generating are coming out as not trusted. what else should I do? I have tried all the troubleshooting tips to delete all WWDRs if it exists. Any helpful suggestions will be appreciated.

Hello, I have been unable to install any development-signed app on any physical device for five months. Builds succeed, code signing passes locally, but every device rejects the app at install time with: Failed to verify code signature of .../extracted/MyApp.app : 0xe8008018 (The identity used to sign the executable is no longer valid.) ApplicationVerificationFailed The app installs briefly, then iOS immediately removes it. This started right after my account (Team ID MB4DXDTDMT) was reinstated following a duplicate-account flag. Background: I had a personal account that was converted to a business account (Wakeout LLC), then created a new personal account, which Apple flagged as a duplicate and later reinstated. The signing failure began immediately after that reinstatement. Isolation already done (this is not a local-setup problem) I have run the full isolation sequence — including every step DTS typically asks for — and the result points squarely at the account/team, not my machine: New blank Xcode project, automatic signing, new bundle ID → same 0xe8008018. Brand-new macOS user account → same failure. Multiple Macs, fresh Xcode installs → same failure. Multiple iOS devices (iPhone 17 Pro, iPhone 15 Pro, others) → same failure. Different Apple ID / different developer team on the same Mac + same device → installs fine. This is the decisive one: the local environment is healthy; only Team MB4DXDTDMT is rejected. Xcode Cloud builds for this same team install fine. Apple's cloud signing trusts MB4DXDTDMT; the device-verification backend does not. That gap can only exist server-side. I have also: revoked/regenerated all certificates multiple times, deleted/recreated all provisioning profiles, cleared ~/Library/MobileDevice/Provisioning Profiles, cleared DerivedData and CoreDevice, removed device pairing records, re-paired devices, confirmed Developer Mode and correct system time. Simulators work. codesign --verify --deep --strict passes. Profile certificate SHA-1 matches the signing cert exactly. Entitlements match. Why I'm posting here This is the same failure documented in thread 755762, where Quinn concluded: "this seems to be tied to your primary developer account and only DevPrograms has access to those details." That matches my evidence exactly: the problem isolates cleanly to one team, and only DevPrograms can see the account-side state. I've already gone through Developer Support on this — an open case has been with them for about five months without a resolution, which is what convinced me the fix isn't something I can reach from the support side. I'm posting here in case a DTS engineer can confirm the diagnosis and point me to the right path. Question for any DTS engineer: given that the failure isolates to a single team — different teams sign and install fine on the same Mac and same device, and Xcode Cloud builds for this same team install fine — can you confirm this is an account-side signing-trust state that has to be reset by Apple, and what's the most direct way to get that reset actioned? Happy to attach a sysdiagnose, full console output, or codesign -dvvv dumps on request. Thank you.

I've been trying to notarize an installer (.pkg file) on a new laptop. Previous versions have been notarized successfully on a previous Mac. However, in spite of having the required certificates (same as the old Mac, generated for the new Mac) the submission gets stuck at "In Progress". Doing it multiple times (even hours apart) doesn't help. Is there a FAQ / suggested list of steps to help resolve this issue? Here's what I see: xcrun notarytool history --keychain-profile "(my profile name)" results in (problem started with v4, the first version I've tried on this new Mac): createdDate: 2023-10-17T01:34:36.911Z id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name: xxxxxxxxxx-v4.pkg status: In Progress -------------------------------------------------- createdDate: 2023-10-17T01:33:59.191Z id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name: xxxxxxxxxx-v4.pkg status: In Progress -------------------------------------------------- createdDate: 2023-10-16T21:01:25.832Z id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name: xxxxxxxxxx-v4.pkg status: In Progress -------------------------------------------------- createdDate: 2023-10-16T19:57:44.776Z id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name: xxxxxxxxxx-v4.pkg status: In Progress -------------------------------------------------- createdDate: 2023-10-02T14:17:34.108Z id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name: xxxxxxxxxx-v3.pkg status: Accepted -------------------------------------------------- createdDate: 2023-09-28T14:04:46.211Z id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name: xxxxxxxxxx-v2.pkg status: Accepted -------------------------------------------------- createdDate: 2023-09-20T17:28:46.168Z id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name: xxxxxxxxxx-v1.pkg status: Accepted -------------------------------------------------- xcrun notarytool log xxxxxxxxxxxxxxxxxxxx --keychain-profile "(my profile name)" results in: Submission log is not yet available or submissionId does not exist id: xxxxxxxxxxxxxxxxxxxxxxxx

Hello, about a month ago, the Apple Store account of my former company was closed. I was already registered as a developer, so there's no problem with that. Was my personal account also closed when this company account was shut down? I contacted Apple support about this, and they said they would investigate. I still haven't received a response. Was my account closed? Or is there another issue? Nobody is explaining why this happened.

I requested "DirverKit UserClient Access" Entitlement, But I Distribute App failed. I don't know the reason. I think when I request "DirverKit UserClient Access" I make a mistake. I fill in two Bundle ids in the "Request a System Extension or DriverKit Entitlement" form's "UserClient Bundle IDs" item. The reason is when I Add "DirverKit UserClient Access" Capability in the project of Xcode. The .entitlements file is like this: <string>com.turing.TuringTouch com.turing.TuringTouch.TouchDriver</string> But in "Signing" of Xcode's "Bundle Identifier" can fill in only on "Identifier" therefore they do not match. So I can't Distribute App. I reapply "DirverKit UserClient Access" Entitlement. But decline. The result is "decline". Please help me. Please tell me, how should can I do now? Thank you very much.