Mac App Store app crashing with EXC_CRASH (Code Signature Invalid)

Mac apps that use an entitlements require that the use of that entitlement be ‘blessed’ by a provisioning profile. Your options here are:

• temporarily disable the entitlement for your beta testers

• add your beta testers to your provisioning profile

The Exporting Your App for Testing (Mac) section of the App Distribution Guide covers this second option.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

For my Beta testers, I build a "debug" version of my app, find the result in the Xcode build area, compress/zip it, and send it to them to run on their machine. (No receipt parsing done for debug builds and/or Beta testers.) I just sent out a new Beta version to 2 testers and the application is "crashing", or really being killed with:

Exception Type: EXC_CRASH (Code Signature Invalid)
Exception Note: EXC_CORPSE_NOTIFY

I've looked around and seen some problems with entitlements, however I have not changed my entitlements recently.

Thanks eskimo for the fast response. But of course I have some followup questions :-)

temporarily disable the entitlement for your beta testers

So there is no way to select "no" Provisioning Profile, so would I leave it at automatic?

If, under "Code Signing" -> "Code Signing Entitlements" I blank out the file entry for the Debug scheme, how does that effect the needed permissions for my Beta testers? So, they may not be able to use Apple Maps, but also the lesser entitlements like sandbox? usb? serial? bluetooth? files?

add your beta testers to your provisioning profile

So for my own edification, is paying attention to the provisioning profile on the Mac something that was added to OS X 10.11? If my Beta testers were running say 10.10 or 10.9, would this be needed? Would I be even running into this problem with previous OS versions? Reason being, I tried doing this several years ago and it didn't work at all which is why I needed to come up with a different scheme. I have changed to 10.11 and Xcode 7 since my last Beta testing and so I'm just wondering what changed a long the way that my old system stopped working.

So, they may not be able to use Apple Maps, but also the lesser entitlements like sandbox? usb? serial? bluetooth? files?

Ah, yes, sorry I was unclear there. Some entitlements (like Maps and iCloud) must be whitelisted by the provisioning profile. Some entitlements (all the ones related to sandboxing) can be used without such whitelisting. I don’t know of a single document that lists which is which but for any given entitlement you can determine whether it needs whitelisting by looking in the Capabilities tab in Xcode. For example, the App Sandbox pane say:

Add the “App Sandbox” entitlement to your entitlements file

Whereas the Maps pane says:

• Link MapKit.framework

• Add the “Maps” entitlement to your App ID

• Add the “Maps” entitlement to your entitlements file

It’s the reference to the App ID that’s key. Entitlement settings in your App ID flow into the provisioning profiles that you create using that App ID. That has two effects:

• The provisioning profile is combined with your entitlements file to set the entitlements in your built binary. Technote 2415 Entitlements Troubleshooting describes the mechanics of that.

• If your built binary has any must-be-whitelisted entitlements, the OS validates those entitlements via the provisioning profile.

So for my own edification, is paying attention to the provisioning profile on the Mac something that was added to OS X 10.11?

No. AFAIK it’s been in place since we started introduced must-be-whitelisted entitlements to the Mac.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

> It’s the reference to the App ID that’s key.

That was a key point for me. So there *are* greater and lesser entitlements.

Following up then, I tried buiding a version with NO entitlement file and an automatic provisioning profile and the tester still got a "Code Signature Invalid" crash. Just cause, I tried manually choosing the wildcard Mac Team Provisioning Profile (ie: no App ID) and still a crash.

So then I duplicated my Target and for the new Target created a new Entitlement file without Apple Maps, but still had all the other (lesser) entitlements. And this worked. To be clear, I was still using the same App ID though, so the App ID still has Apple Maps "on", but the Entitlement file has it off, and this version the tester was able to run.