Signing Certificates

RSS for tag

A signing certificate is a digital identity used for code signing during the build and archive process.

Posts under Signing Certificates tag

158 Posts
Sort by:

Post

Replies

Boosts

Views

Activity

App not showing on XCode - Can't sign my app
Hello everyone, I was added to an organization account, and I was given app owner access. I can see the created app on my dashboard, but I can access it on my XCode. I can only see my Personal team Here's the screenshot below: I can't see the team I was added to because that was where the app was created. Here's the app on my dashboard Can anyone help please? Thanks in advance
1
0
321
Feb ’24
Developer cert says revoked on one Mac but not on another
I've installed the same developer certificate onto three different Macs. When viewed in the keychain (or in Xcode) on one Mac it says its revoked, on another it says its not trusted, but on a third there's no issue reported. How could there be a difference between the three Macs? (Both Macs have the date/time set to be the same). Can 3rd party software, VPNs etc. interfere in this at all?
1
0
374
Feb ’24
Xcode 15.0.1 app verification issue
I am having a very weird issue with Xcode 15.0.1. If you are running an app that was built with XCode 14 and install the new version of the app with XCode 15 it works fine. If you delete the XCode 14 build of the app, and install the XCode 15 build of the app you get "This app cannot be installed because its integrity could not be verified" error message on launching the app. Then when we rebuild the app again with XCode 14 the app works fine with no issues. I have tried multiple solutions that I have found on various forums, but with no luck. Anyone have any suggestions on how to fix this issue.
8
0
1.5k
Feb ’24
New provisioning profile : Failed to export archive (code: 70)
Hello everyone, Due to a change in our development team we had to revoke some certificates and regenerate new one. I have generated a Development Mobile profile including needed certificates etc. Also, in Xcode 15 i have disabled "automatically manage signing" and everything look okay as I can see the generated provisioning profile, my team, my certificate etc. Build is working correctly. We are using App Center as a CI to build/archive.. our iOS app. During the last step of the archive export I have the following error which I cannot resolve : [command]/usr/libexec/PlistBuddy -c Print CFBundleIdentifier /Users/runner/work/1/output/build/archive/OurStagingApp.xcarchive/Products/Applications/OurStagingApp.app/Info.plist com.OurStagingDomain.OurStagingApp [command]/usr/libexec/PlistBuddy -c Add provisioningProfiles:com.OurStagingApp.OurStagingApp string toktokdoc provisioning profile development _XcodeTaskExportOptions.plist [command]/usr/bin/xcodebuild -exportArchive -archivePath /Users/runner/work/1/output/build/archive/OurStagingApp.xcarchive -exportPath /Users/runner/work/1/output/build/export/_XcodeTaskExport_OurStagingApp -exportOptionsPlist _XcodeTaskExportOptions.plist 2024-02-08 14:21:05.218 xcodebuild[18640:56463] [MT] IDEDistribution: -[IDEDistributionLogging _createLoggingBundleAtPath:]: Created bundle at path "/var/folders/r0/ztvld9wd66bfpv_g6h3ksl000000gn/T/OurStagingApp_2024-02-08_14-21-05.213.xcdistributionlogs". 2024-02-08 14:21:05.370 xcodebuild[18640:56463] [MT] IDEDistribution: -[IDEDistributionMethodManager orderedDistributionMethodsForTask:archive:logAspect:]: Error = Error Domain=IDEDistributionMethodManagerErrorDomain Code=2 "Unknown Distribution Error" UserInfo={NSLocalizedDescription=Unknown Distribution Error} error: exportArchive: exportOptionsPlist error for key "method": expected one of {}, but found development Error Domain=IDEFoundationErrorDomain Code=1 "exportOptionsPlist error for key "method": expected one of {}, but found development" UserInfo={NSLocalizedDescription=exportOptionsPlist error for key "method": expected one of {}, but found development} ** EXPORT FAILED ** ##[error]Error: /usr/bin/xcodebuild failed with return code: 70 I tried to regen certificates, regen provisioning profile, use automatically signed.. Also this is the logs of the last working build : DEV PROV PROFILE TokTokDocRCX [command]/bin/rm -f _xcodetasktmp.plist [command]/usr/libexec/PlistBuddy -c Print CFBundleIdentifier /Users/runner/work/1/output/build/archive/OurStagingApp.xcarchive/Products/Applications/OurStagingApp.app/Info.plist com.OurDomain.OurStagingApp [command]/usr/libexec/PlistBuddy -c Add provisioningProfiles:com.OurDomain.OurStagingApp string DEV PROV PROFILE TokTokDocRCX _XcodeTaskExportOptions.plist [command]/usr/bin/xcodebuild -exportArchive -archivePath /Users/runner/work/1/output/build/archive/OurStagingApp.xcarchive -exportPath /Users/runner/work/1/output/build/export/_XcodeTaskExport_OurStagingApp -exportOptionsPlist _XcodeTaskExportOptions.plist 2023-08-02 11:20:01.234 xcodebuild[19044:64264] [MT] IDEDistribution: -[IDEDistributionLogging _createLoggingBundleAtPath:]: Created bundle at path "/var/folders/cn/nkrr6l5n0jz01kq9jbtb9tg00000gn/T/OurStagingApp_2023-08-02_11-20-01.233.xcdistributionlogs". Exported OurStagingApp to: /Users/runner/work/1/output/build/export/_XcodeTaskExport_OurStagingApp ** EXPORT SUCCEEDED ** I have replaced some logs with "OurStagingApp". Also when trying to build the archive via xcode 15 the button validate is disabled. In my podfile: target.build_configurations.each do |config| config.build_settings['ENABLE_BITCODE'] = 'NO' config.build_settings['CODE_SIGNING_ALLOWED'] = 'NO' config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '14.0' config.build_settings['BUILD_LIBRARY_FOR_DISTRIBUTION'] = 'YES' config.build_settings['SKIP_INSTALL'] = 'NO' end Thanks for your help
0
0
497
Feb ’24
Build signing on Sonoma virtual runner
I've tried to implement the steps suggested for configuring code signing https://docs.github.com/en/actions/deployment/deploying-xcode-applications/installing-an-apple-certificate-on-macos-runners-for-xcode-development on runners However, I could not sign my app build when I was using Virtual Runner. Is it a limitation coming from the Apple virtualization framework restriction (for signing in with Apple ID), or did I miss some configuration for Xcode? I was trying both manual and automatic signing but never succeeded (
1
0
380
Feb ’24
Xcode 15 iOS 17 Failed to install app on the device
Hi all, I've spent 3 of my 'coding-time' sessions already on trying to figure this one out. But I wasn't successful. I'm a hobby dev, so not too experienced with signing of anything code-wise. So time to head to the forums for help. My SwiftUI app runs fine on the simulator. My app also runs fine when downloaded from the store. But I cannot: Build the item from Xcode to my new iPhone 15 Build and distribute an archive, so that I can release a new version of my app What I did so far: Removed and reinstalled my Pods via Terminal Removed and reinstalled my packages through Xcode Removed trusted devices from my iPhone Removed trusted devices from my Macbook Added my new iPhone to my Apple Developer account via https://developer.apple.com/account/resources/devices/list Removed my old iPhone Restarted everything at least 5 times I keep getting this error after building, but immediately upon installing: Failed to install the app on the device. Domain: com.apple.dt.CoreDeviceError Code: 3002 User Info: { DVTErrorCreationDateKey = "2023-10-16 11:47:42 +0000"; IDERunOperationFailingWorker = IDEInstallCoreDeviceWorker; NSURL = "file:///Users/jorritgernaat/Library/Developer/Xcode/DerivedData/WalkApp-fukevcszpwufbzavuluhlbvhsaaa/Build/Products/Debug-iphoneos/WalkApp.app/"; } -- Paaltjesroutes moet worden bijgewerkt Domain: IXUserPresentableErrorDomain Code: 17 Failure Reason: Deze app moet door de ontwikkelaar worden bijgewerkt om te kunnen werken met deze iOS-versie. Recovery Suggestion: Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.UleUN5/extracted/WalkApp.app/Frameworks/FirebaseFirestore.framework : 0xe8008029 (The code signature version is no longer supported.) -- Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.UleUN5/extracted/WalkApp.app/Frameworks/FirebaseFirestore.framework : 0xe8008029 (The code signature version is no longer supported.) Domain: MIInstallerErrorDomain Code: 13 User Info: { FunctionName = "+[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:]"; LegacyErrorString = ApplicationVerificationFailed; LibMISErrorNumber = "-402620375"; SourceFileLine = 78; } -- Event Metadata: com.apple.dt.IDERunOperationWorkerFinished : { "device_isCoreDevice" = 1; "device_model" = "iPhone15,4"; "device_osBuild" = "17.0.3 (21A360)"; "device_platform" = "com.apple.platform.iphoneos"; "dvt_coredevice_version" = "348.1"; "dvt_mobiledevice_version" = "1643.2.4"; "launchSession_schemeCommand" = Run; "launchSession_state" = 1; "launchSession_targetArch" = arm64; "operation_duration_ms" = 1864; "operation_errorCode" = 17; "operation_errorDomain" = "com.apple.dt.CoreDeviceError.3002.IXUserPresentableErrorDomain"; "operation_errorWorker" = IDEInstallCoreDeviceWorker; "operation_name" = IDERunOperationWorkerGroup; "param_debugger_attachToExtensions" = 0; "param_debugger_attachToXPC" = 1; "param_debugger_type" = 3; "param_destination_isProxy" = 0; "param_destination_platform" = "com.apple.platform.iphoneos"; "param_diag_MainThreadChecker_stopOnIssue" = 0; "param_diag_MallocStackLogging_enableDuringAttach" = 0; "param_diag_MallocStackLogging_enableForXPC" = 1; "param_diag_allowLocationSimulation" = 1; "param_diag_checker_tpc_enable" = 1; "param_diag_gpu_frameCapture_enable" = 0; "param_diag_gpu_shaderValidation_enable" = 0; "param_diag_gpu_validation_enable" = 0; "param_diag_memoryGraphOnResourceException" = 0; "param_diag_queueDebugging_enable" = 1; "param_diag_runtimeProfile_generate" = 0; "param_diag_sanitizer_asan_enable" = 0; "param_diag_sanitizer_tsan_enable" = 0; "param_diag_sanitizer_tsan_stopOnIssue" = 0; "param_diag_sanitizer_ubsan_stopOnIssue" = 0; "param_diag_showNonLocalizedStrings" = 0; "param_diag_viewDebugging_enabled" = 1; "param_diag_viewDebugging_insertDylibOnLaunch" = 1; "param_install_style" = 0; "param_launcher_UID" = 2; "param_launcher_allowDeviceSensorReplayData" = 0; "param_launcher_kind" = 0; "param_launcher_style" = 99; "param_launcher_substyle" = 8192; "param_runnable_appExtensionHostRunMode" = 0; "param_runnable_productType" = "com.apple.product-type.application"; "param_structuredConsoleMode" = 1; "param_testing_launchedForTesting" = 0; "param_testing_suppressSimulatorApp" = 0; "param_testing_usingCLI" = 0; "sdk_canonicalName" = "iphoneos17.0"; "sdk_osVersion" = "17.0"; "sdk_variant" = iphoneos; } -- System Information macOS Version 14.0 (Build 23A344) Xcode 15.0 (22265) (Build 15A240d) Timestamp: 2023-10-16T13:47:42+02:00``` It seems to somehow involve Firebase, but that can also be because that's simply the only 3rd party stuff I use. Help me get back to writing code and shipping app updates :)
8
0
13k
Feb ’24
Key Storage Provider (KSP) macOS equivalent
Hi, I successfully developed a key storage provider (KSP) under Windows that allows me to digitally sign from 3rd party application (typically Acrobat Reader but not only). Now I'm trying to port the key storage provider to macOS, but I cannot find an equivalent technology under this OS. I've tried different solutions: API hooking/method swizzling/dll interposing: It doesn't look officially supported plus easily blockable (with hardened runtime); Endpoint security framework: It looks basically for watch-only purposes plus minimal blocking capabilities; Is there any supported way to implement a KSP macOS equivalent? Any suggestion? Something else to explore? Thanks a lot, max
1
0
390
Feb ’24
Revoke and generate distribution certification will existing apps available still?
Hello all professions, I'm now facing an problem with distribution certification expiration for the enterprise account. We're using enterprise account for publishing some internal apps for our organization without uploading to AppStore but by other platforms, but both cert and profile have 1 year expiration and now it's about to expire. So we're going to extend the app expiration date now. Read some articles that the best practice is renewing cert before it expired, for some reasons that we CANNOT add new certifications if we're not revoking any of existing certs, so what we are going to do is: We will revoke the cert first let's say certA, and then create a new cert with all configurations as same as certA let's say certB and then distribute new app version by certB. If we're going to do so, then the question comes: Will the existing installed apps distributed by certA still available? (if it has couple months to be expired for certA) Continue with question1, if no, all existing apps will not be available anymore, then what's the best practice for us to manage certs and app for the users without cert renewing downtime? Will there be any issue if we user another cert let's say certC just create now to distribute new app version without revoking current certA? such as it will be recognized a brand new app, etc thanks all
1
0
439
Jan ’24
CloudKitDaemon [804] Indentity Error
Hello, I build my app on Unity 2021 using the service Unity Cloud Build. I enabled iCloud key-value storage and it correctly show up in the entitlement file. Whenever I try to make a cloud save, Unity Logs says that the process was successful but it didn't save anything on the cloud. I had a look to the logs on my device and I found this strange error: cloudd(CloudKitDaemon)[804] <Error>: Identity set <private> was expected to have a current key set <private>. Error Domain=securityd Code=-25300 UserInfo={NSLocalizedDescription=<private>} cloudd(CloudKitDaemon)[804] <Error>: Identity set <private> does not have a current key set. Not using it. cloudd(CloudKitDaemon)[804] <Error>: Didn't get a service identity from the PCS framework I searched online but I couldn't find anything informative. Any suggestions?
3
0
476
Jan ’24
Error in installing enterprise build from XCode15 beta to iOS 17 beta OS device
After updating the os to iOS17 beta, not able to install the enterprise app through ipa, it throws error Error installing '//Downloads/-Internal-Appstore-23.6.5-1.ipa', ERROR: Error Domain=com.apple.dt.CoreDeviceError Code=3002 "Failed to install the app on the device." UserInfo={NSUnderlyingError=0x600019bcc750 {Error Domain=com.apple.dt.CoreDeviceError Code=3000 "The item at -Internal-Appstore-23.6.5-1.ipa is not a valid bundle." UserInfo={NSURL=file:////Downloads/-Internal-Appstore-23.6.5-1.ipa, NSLocalizedDescription=The item at -Internal-Appstore-23.6.5-1.ipa is not a valid bundle., NSLocalizedFailureReason=Failed to read the bundle.}}, NSLocalizedDescription=Failed to install the app on the device., NSURL=file:///Downloads/-Internal-Appstore-23.6.5-1.ipa} Kindly update on this. Do any code side changes have to be done for this to fix these issue?
35
11
22k
Jan ’24
App cannot be verified
We are using an iPhone app distributed as an AdHoc app, but an error message saying "App cannot be verified" was displayed. The error screen says, "Internet connection is required to verify the credibility of developer "Apple Distribution:●●●● CO.,LTD.(QQQ29B8GG2)"." When using this app, We are connected to the LAN, but not connected to the Internet. If you temporarily connect to the Internet and start the app when the error screen appears, the error screen will disappear. After that, when I switched from connecting to the Internet to connecting to LAN, it worked normally for a while, but after about 2 months, the same error screen appears again. Please tell me how to resolve this error.
3
0
485
Jan ’24
Signing applications with jpackage: Is a distribution certificate sufficient, and, if so, how do I use it?
I've developed a Java application for ad hoc distribution, not intended for the Apple Store. Using the jpackage utility and the parameters... --mac-sign --mac-signing-keychain --mac-signing-key-user-name ...I'm able to point the software to a signing certificate. My problem is that jpackage requires a certificate with a "Developer ID Application" type/prefix, and I'm not authorized to create a certificate of this type, as "This operation can only be performed by the account holder." I thought it might be sufficient to create a "Distribution" certificate, since this allows a developer to "Sign your iOS, iPadOS, macOS, tvOS, watchOS, and visionOS apps for release testing using Ad Hoc distribution or for submission to the App Store." However, there doesn't appear to be any way to get jpackage to accept anything other than a "Developer ID Application" -prefixed certificate. I gather from this, and the fact that the Developer ID Application certificate is described as "This certificate is used to code sign your app for distribution outside of the Mac App Store," that this is the only type of "legitimate" security certificate Apple will accept when launching out-of-store apps. I'm not certain of this, however, and I'd like to be certain before pestering my client about it. My questions are: Is a "Developer ID Application" certificate specifically required, or can I sign the app using, e.g., a "Distribution" certificate without issues? If a "Developer ID Application" certificate is required, is it possible for my client (the "Account Holder") to grant me access to download it and use it? If a "Developer ID Application" certificate is required, what exactly is a "Distribution" certificate good for? Why isn't it sufficient to distribute software? If I can sign the app using a Distribution certificate, is there a way to force jpackage to do this, or do I have to it manually using, e.g., codesign ex post facto? Note that this issue has cropped up before on this thread, but the developer there ultimately found his developer ID certificate and the discussion was abandoned before any answers were forthcoming.
2
1
592
Jan ’24
How to codesign CLI tool so that I can read CNContact.note field?
I want to build a CLI tool (using SwiftPM - without XCode) to read the contacts on my mac. The end goal is to use the notes field or maybe custom fields to build a simple CRM (customer relationship tool) to keep track of some things. It especially means reading the NOTE field, and also writing it back. But... as mentioned on com.apple.developer.contacts.notes | Apple Developer Documentation reading the note field requires the com.apple.developer.contacts.notes. How do I do that? If it runs locally only on my machine I am happy. I wrote an entitlements.plist: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.developer.contacts.notes</key> <true/> </dict> </plist> And do # build swift build --configuration release --disable-sandbox --arch arm64 Building for production... [2/2] Linking contacts Build complete! (0.29s) #sign codesign --sign - --entitlements entitlements.plist --deep .build/release/contacts --force .build/release/contacts: replacing existing signature But upon running, I get: ./.build/release/contacts fish: Job 1, './.build/release/contacts' terminated by signal SIGKILL (Forced quit) Without signing I get: *** Terminating app due to uncaught exception 'CNPropertyNotFetchedException', reason: 'A property was not requested when contact was fetched.' *** First throw call stack: ( 0 CoreFoundation 0x000000018b1cc570 __exceptionPreprocess + 176 1 libobjc.A.dylib 0x000000018acbdeb4 objc_exception_throw + 60 2 CoreFoundation 0x000000018b1cc460 +[NSException exceptionWithName:reason:userInfo:] + 0 3 Contacts 0x000000019f8f9b74 -[CNContact note] + 152 4 contacts 0x0000000104879e04 $s8contacts3CliV3runyyKF + 436 5 contacts 0x000000010487a0c8 $s8contacts3CliV14ArgumentParser15ParsableCommandAadEP3runyyKFTW + 12 6 contacts 0x000000010487a160 contacts_main + 96 7 dyld 0x000000018acf90e0 start + 2360 ) libc++abi: terminating due to uncaught exception of type NSException fish: Job 1, './.build/release/contacts' terminated by signal SIGABRT (Abort) I am new to Swift and SwiftPM and the world of code signing. I currently am NOT a member of the Apple Developer program but if needed I am (reluctantly) willing to pay 99$ to be able to sign/notarize/.. but since the goal is to only run it for myself I hppe there is a way to self-sign. Do I need so sign my cli? Is it even possible to codesign command line tools (i've seen comments that it is not)? How would I do that? What am I missing? Cheers, Oliver
2
0
311
Jan ’24
Code signing on macOS using com.apple.webinspector.allow entitlement
I'm working on a macOS app that uses a JSContext and I want to debug it with the Safari Web Inspector. According to Session 402 at WWDC 2016 the following entitlement is required: <key>com.apple.webinspector.allow</key> <true/> This is easy enough to add, but it causes the app to crash at launch with a code signing issue. The console shows that taskgated-helper is reporting just before the crash: Unsatisfied entitlements: com.apple.webinspector.allow For anyone who finds this, here's what you need to know: https://webkit.org/blog/13936/enabling-the-inspection-of-web-content-in-apps/ Basically, there's now a inspectable property on both the WKWebView and JSContext. Unfortunately, there's no mention of the old entitlement in the WebKit blog post, so it's impossible for folks using the old technique to find. Hopefully this post will bridge this gap. It also might be something for @eskimo to add to his (always helpful) code signing documentation. -ch
1
0
332
Jan ’24
How backup certificate
Hi, I have upgraded my Mac to Sonoma and for some reason I get lost now when backup up a certificate. As I wasn't able to import my old certificate (exported as p12, but this is another issue) I started from scratch. I have created from KeyChain a new CertificateSigningRequest. Then I've uploaded it to the Apple Developer Portal and created a new certificate, that I have successfully downloaded as cer file. Now, I would like to save the certificate, including the private key. From KeyChain, I don't get a Reveal option to be able to export the private key of my certificate. Was it available in old versions of KeyChain, and now not anymore? Or my certificate doesn't have the private key? (imo this doesn't make sense at all) So I right click on the certificate but I can't export as p12 file, with the private key: Can please anyone refer me to the official documentation about this? (I have searched for it, but unable to find anything)
2
0
389
Jan ’24
Certificates : Problem with Convert a CER file to a P12 file !!
I have a strange problem and I don't know what's causing it A year ago, I purchased this account and created a certificate and it was working successfully, but its time expired on 1/8/2024, and I want to create a new one in order to update my applications. So I went to create a new certificate of type (iOS Distribution) and it was downloaded successfully, and when I called it in the (Keychain access) program in order to convert it to (.P12) instead of (.cer). But the program refuses to recall it, and I choose the (Local Item) section. thus : But when the file is dragged or double-clicked while I am standing in the (Login) section, the certificate is summoned successfully, and here the real problem begins. It is assumed that in order for me to convert the certificate from (cer) to (p12), there must be an arrow next to the certificate so that the key appears so that it can be pressed. Right-click, then we choose Export, and then we choose (p12). This happens because there is no arrow next to the certificate, and also when I By clicking on the certificate to export it, I am not allowed to choose (p12). How can I convert the file successfully because I want to update my applications, which is very important.
2
0
938
Jan ’24