ITMS-90286: Invalid Code Signing Entitlements but the application-identifier is exactly what it should be

I have an app that I'm building and signing and deploying for the Mac App Store.

I received an email that there were problems with the deployment that make no sense to me.

ITMS-90286: Invalid Code Signing Entitlements - Your application bundle's signature contains code signing entitlements that are not supported on macOS. Specifically, value '367****Y2.com.foo.foo-one.electron' for key 'com.apple.application-identifier' in 'Foo One.app/Contents/MacOS/Foo.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libEGL.dylib' is not supported. This value should be a string starting with your TEAMID, followed by a dot '.', followed by the bundle identifier .

Say what now?

This value should be a string starting with your TEAMID, followed by a dot '.', followed by the bundle identifier .

But that is exactly what it is set to:

367****Y2.com.foo.foo-one.electron (asterisks just here to obscure our actual TeamID)

I have no idea how to proceed. Any advice?

Similar to this question thread 698452

That error message suggests that you have the com.apple.application-identifier entitlement set on your libEGL.dylib library. That doesn’t make sense. Entitlements are only useful when applied to main executables. Signing a library with entitlements is, at best, pointless, and in some cases can cause problems.

Are you using --deep here? If so, don’t. See --deep Considered Harmful.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Yes, I am signing with --deep. Thanks for the link, I'll do some reading.

I'll do some reading.

Cool.

If you want to know more, there are a bunch of links to other docs and posts in the Code Signing Resources post.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

ITMS-90286: Invalid Code Signing Entitlements but the application-identifier is exactly what it should be
 
 
Q