Not able to install enterprise build in iOS 15 beta version

We ran into the same error with a couple of our enterprise apps that were released last September/October, but not with any released this year since March. I watched the console when intune was trying to install the app and saw this error:

Failed to verify code signature of Prices.app : 0xe8008029 (The code signature version is no longer supported.)

We renewed the app's provisioning profile, resigned the IPAs, and the app launches now.

Hope that helps.

When testing iOS 15 beta we found that this occurred when code signing on a macOS Catalina system. Code signing on a macOS Big Sur system resolved this issue.

I haven't seen any official documentation on what has caused this and what the requirements are, but I would love to know more.

Good luck!

This is most probably the issue discussed in Using the Latest Code Signature Format.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

We're also affected by this, but the "Using the Latest Code Signature Format" article only mentions needing to code-sign with 10.14 or later.

We build and codesign on 10.15, but when I do look at the output of codesign -dv, I do indeed see the version of 20400.

Is it possible this article needs to be updated? I'm confused why the version would be still 20400 on Catalina while the article suggests that signing on 10.14 or later should produce a v20500 CodeSignature format.

Also since I evidently read the article a bit too fast: it says "For any value of v less than 20400, you’ll need to re-signed [sic] your app."

Signing on Big Sur (Xcode 12.1, still) seems for me to generate v20400.

Hey @timothy-sutton, The Apple documentation on this subject is incorrect I believe (but could be wrong).

If you are code signing from the command line you will need to include the below as an option where [options] and [more options] should be replaced with the options you would use.

codesign [options] --options runtime [more options]

Once you include this you will see the Code Directory updated to the latest one available for your Xcode version.

I have had a Feedback open for Apple to correct the Documentation at the below URL for some time now but it hasn't been addressed.

https://developer.apple.com/documentation/xcode/using-the-latest-code-signature-format

Hopefully this helps!

It still doesn't work for me :(

I used the --options runtime flag in Xcode 12.2 on macOS Catalina and I can't install the app on an iOS 15 device.

If I do the resign on a mac with BigSur and Xcode 13, it works.

With the flag. Before resign:

❯ codesign -dv /Users/ndr/Downloads/Payload/MyApp.app
Executable=/Users/ndr/Downloads/Payload/MyApp.app/MyApp
Identifier=com.test.rd
Format=app bundle with Mach-O thin (arm64)
CodeDirectory v=20500 size=19389 flags=0x10000(runtime) hashes=597+5 location=embedded
Signature size=4736
Signed Time=7 Jul 2021 at 10:32:12
Info.plist entries=37
TeamIdentifier=XXXXXXXXXX
Runtime Version=14.2.0
Sealed Resources version=2 rules=10 files=112
Internal requirements count=1 size=192

After resign:

❯ codesign -dv /Users/ndr/Downloads/Payload/MyApp.app
Executable=/Users/ndr/Downloads/Payload/MyApp.app/MyApp
Identifier=com.test.rd
Format=app bundle with Mach-O thin (arm64)
CodeDirectory v=20500 size=19453 flags=0x10000(runtime) hashes=597+7 location=embedded
Signature size=4736
Signed Time=7 Jul 2021 at 10:42:56
Info.plist entries=37
TeamIdentifier=XXXXXXXXXX
Runtime Version=14.2.0
Sealed Resources version=2 rules=10 files=112
Internal requirements count=1 size=192

We had something similar happen with an Enterprise App. I'm not sure which one of the following steps or a combination of these steps resolved the issue, but it's now installing on iOS 15 beta.

1. Updated from Catalina to Big SUR
2. Updated from Xcode 12.4 to 12.5.1
3. Raise deployment target from iOS 13.2 to iOS 14.5

As noted on this thread already, you can resolve the error for The code signature version is no longer supported, by re-signing your app. To check if you need to re-sign your app, use the codesign utility to take a look at the version contained on your app's CodeDirectory. Note that this will be output with something like:

$ codesign -dvvvvv MyApp.app
Executable=/path/to/myapp/MyApp.app/Contents/MacOS/MyApp
Identifier=com.example.mycompany-samplecode.myapp
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=949 flags=0x10000(runtime) hashes=20+5 location=embedded

And if you see a version with v=20500 on it then you should be good here. If you see a version less that 20400 here then you'll need to re-sign your app.

Another case could be that you previously re-signed your app and the CodeDirectory is 20400 or higher, but the app does not install on iOS properly. If this is the case then you may need to re-sign your app including the DER entitlements. To check if you need to re-sign using the DER entitlements, run the following command to take a look at the hash values in the signature'sPage size:

codesign -dvvvvv MyApp.app

...
Page size=4096
    -7=4ade7be00e0a7b6db853edc4843e7ece1eea646f6f13d1809f78fc50d8db461f
    -6=0000000000000000000000000000000000000000000000000000000000000000
    -5=1dfa58bd8ac3c4fb42142c1c4d28c436128b3a7460186a44526194fb690112bc
    -4=0000000000000000000000000000000000000000000000000000000000000000
    -3=ef08dbe5a7c355336e1fb571604b683ce1c54536cb59a6155a1d18387fd23f6e
    -2=5b730fa46ffd405fd88da9606d82eda9af7f460f6049047afc176163326f5a7f

If -5 contains a value and -7 has a zero value, or is not present at all, then you will need to re-sign your app with DER entitlement. One way to do this is to add this into your Xcode Build Settings by setting the --generate-entitlement-der for OTHER_CODE_SIGN_FLAGS. This can also be done on the command line by using the following command:

# Re-sign your app

% codesign -s "Signing Identity Name from Keychain" -f --preserve-metadata --generate-entitlement-der MyApp.app
...
MyApp.app: replacing existing signature

# Check your signature again

% codesign -dvvvvv  ActionExtensionHostSSO.app
...
Page size=4096
    -7=4ade7be00e0a7b6db853edc4843e7ece1eea646f6f13d1809f78fc50d8db461f
    -6=0000000000000000000000000000000000000000000000000000000000000000
    -5=1dfa58bd8ac3c4fb42142c1c4d28c436128b3a7460186a44526194fb690112bc
    -4=0000000000000000000000000000000000000000000000000000000000000000
    -3=ef08dbe5a7c355336e1fb571604b683ce1c54536cb59a6155a1d18387fd23f6e
    -2=5b730fa46ffd405fd88da9606d82eda9af7f460f6049047afc176163326f5a7f
...
Signed Time=Jul 9, 2021 at 6:40:59 AM

Try the following steps below and if there are still issues installing or re-signing apps, please let me know.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Building with Xcode 12.5.1 fix it!

@ juliana17

If v=20400, it should still be able to install on device with iOS 15 beta, right? 

You will want to check the Page Size as I mentioned about if you are unable to install on iOS 15 with a CodeDirectory of 20400. Also, another course of action here would be to re-sign your app on macOS Big Sure or macOS Monterey.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

I'm running macOS Catalina and am having this exact issue.

I've tried code signing with --generate-entitlement-der, but the -6 and -7 are still missing from the app's page size.

Thoughts?

@JLJohnson

I'm running macOS Catalina and am having this exact issue. I've tried code signing with --generate-entitlement-der, but the -6 and -7 are still missing from the app's page size. Thoughts?

Try the re-sign on macOS Big Sur or Monterey. If this is still an issue after re-signing on either of those two OS's, please open a bug report and follow up with the Feedback ID.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

It would still be great if this could just be documented publicly (see FB9190730).

I can confirm that this works for me when code signed with macOS Big Sur. What I am hoping is (in order):

(a) Code signing and app distribution isn't required prior to the release of iOS 15. (b) Code signing and app distribution is required, but can be done on macOS Catalina.

Or, if neither of the above are possible:

(c) Official documentation on this requirement, similar to the 'Using the Latest Code Signature Format' article that Quinn linked above.

If (a) or (b) isn't possible, then (c) would at least help support change management, etc.

I have just submitted a bug report regarding this: FB9318576