Difficulty debugging a Provisioning problem

I am stuck. I have an iPadOS app that installs and calls a DEXT. I have a provisioning file for the DEXT and another for the app. Xcode shows me that the respective provisioning files match the bundle ids and that the entitlements and provisions match up. I have a developer certificate (two, actually) on the iPad. Xcode shows me, via "Devices" that the provisioning files are installed. When I try to run the app, I get:

0x16d3db000 +[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:]: 78: Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.vyncZ7/extracted/USBApp.app/SystemExtensions/w1ebr.MUUI.ipadOS.driver.dext : 0xe8008015 (A valid provisioning profile for this executable was not found.)

I don't know what to check next.

Replies

In situations like this I recommend that you:

  1. Delete the app from the device.

  2. Build the app in Xcode.

  3. Manually install it using the Finder.

  4. Then see if it still fails.

If it does, you can look at the app on disk to check it’s built state. This is much more reliable than checking the project state in Xcode.

In terms of what checks you can run, I have some general advice in TN3125 Inside Code Signing: Provisioning Profiles and specific advice in Resolving Code Signing Crashes on Launch.

IMPORTANT The latter is focused on macOS, but the basic idea of provisioning profiles works the same on both platforms.

Make sure to check both the app and the sysex nested within the app.

IMPORTANT Ignore the sysex next to the app in the built products directory. The one that matters is the one nested within the app.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • Update 1: I read TN3125. I decoded the DER-encoded version of the embedded.provisionprofile. The SHA-256 hashes of the two Developer Certificates match the SHA-256 fingerprints in the developer certificates installed on my iPad.

    Update 2: The Info.plist files that are embedded for both the App and the DEXT are a mess. After using plutil to clean them up, the are now readable again. The source Info.plist files look fine. When I run plutil on them, they look the same as before I ran it.

  • Update 3: It still won't install, for the same reasons.

  • Update 4: Using Automatic signing and "Apple Developer" vs my personal developer certificate also won't load.

Add a Comment

@eskimo , how do I install Apps on my iPad using Finder on my Mac? Installing using the "Simulators and Devices" menu gives me the same error about not being able to install the app

Error installing  '/Users/gene/Desktop/USBApp.app', ERROR: Error Domain=com.apple.dt.CoreDeviceError Code=3002 "Failed to install the app on the device." UserInfo={NSUnderlyingError=0x60000b2cc510 {Error Domain=IXUserPresentableErrorDomain Code=14 "Unable to Install “USBApp”" UserInfo={NSUnderlyingError=0x60000b2cc480 {Error Domain=MIInstallerErrorDomain Code=13 "Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.769olK/extracted/USBApp.app/SystemExtensions/w1ebr.MUUI.ipadOS.driver.dext : 0xe8008015 (A valid provisioning profile for this executable was not found.)" UserInfo={FunctionName=+[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:], LegacyErrorString=ApplicationVerificationFailed, SourceFileLine=78, LibMISErrorNumber=-402620395, NSLocalizedDescription=Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.769olK/extracted/USBApp.app/SystemExtensions/w1ebr.MUUI.ipadOS.driver.dext : 0xe8008015 (A valid provisioning profile for this executable was not found.)}}, NSLocalizedDescription=Unable to Install “USBApp”, NSLocalizedRecoverySuggestion=Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.769olK/extracted/USBApp.app/SystemExtensions/w1ebr.MUUI.ipadOS.driver.dext : 0xe8008015 (A valid provisioning profile for this executable was not found.), NSLocalizedFailureReason=This app cannot be installed because its integrity could not be verified.}}, NSURL=file:///Users/gene/Desktop/USBApp.app/, NSLocalizedDescription=Failed to install the app on the device.}
Domain: com.apple.dt.DVTCoreDevice
Code: -1
User Info: {
    DVTErrorCreationDateKey = "2024-01-11 21:29:30 +0000";
}
--


System Information

macOS Version 14.3 (Build 23D5051b)
Xcode 15.0.1 (22266) (Build 15A507)
Timestamp: 2024-01-11T16:29:30-05:00

how do I install Apps on my iPad using Finder on my Mac?

I mislead you on that front; sorry.

I use two different mechanisms to install apps outside of Xcode’s standard Product > Run process:

  • Drag a .app to the app list in the Devices and Simulators window.

  • Drag a .ipa to the device in the Finder.

You’re aware of the first one. The problem you’re having with the second is that you need a .ipa. To get that, use the Xcode organiser. Select an archive, click Distribute App, and then choose the Debugging option.

Both of these mechanism exhibit the behaviour I was aiming for in my previous email: You end up with a file on your Mac that is exactly what got installed on the device, so you can examine that file to see how it was built.

In the case of the .ipa, you need to change the extension to .zip and then unpack that.

In this case I think the Finder is an unnecessary complexity, and installing the app via the Xcode organiser is fine (just make sure to delete the previous one beforehand).

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@eskimo , I have tried everything that you suggested. No success so far. I get this log entry (from the iPad)

Received termination request from [osservice<com.apple.mobile.installd>:411] on <RBSProcessPredicate <RBSProcessBundleIdentifierPredicate "w1ebr.MUUIipadOS">> with context <RBSTerminateContext| explanation:installd terminating bundleID:w1ebr.MUUIipadOS reportType:None maxTerminationResistance:Interactive attrs:[ <RBSPreventLaunchLimitation| <RBSProcessPredicate <RBSProcessBundleIdentifierPredicate "w1ebr.MUUIipadOS">> allow:(null)> ]>

Does this tell you anything helpful?

@eskimo , I made progress, but I don't understand what it means :-)

When I remove specific Vendor IDs from the DEXT's entitlement file, the DEXT loads. idVendor="*" also loads the DEXT successfully.

I need your advice.

Device drivers written for my specific receiver (and many others) have been written for Windows, Linux and OSX. The linux and OSX drivers call libUSB. I have compiled a version of libUSB for iPadOS. "Sandbox" in iPadOS denies access to the USB device. I don't know how to temporarily disable Sandbox (I suspect it isn 't possible for me) When I requested entitlements from Apple so that I could try to create a driver, Apple denied my request.

Does this imply that iPadOS, even with DriverKit really isn't a viable platform for software which can communicate with many different USB devices?

Device drivers written for my specific receiver

What does “receiver” mean in this context? And if it’s an accessory, is that something you created? Or something from a different third party?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

My wild guess is that there are probably about 100 different radio receivers with USB interfaces and unique hardware ids that are available for purchase. The one that I bought has a Realtek USB tuner chip inside of it (idVendor=0x0bda, idProduct=0x2838). Folks that develop software defined receiver apps (SDRs) typically write the software that does the radio receiver math and the presentation and user interface graphics and rely on other teams to create device drivers that interface to specific hardware. (There is even a GNU Radio project that allows users to create software defined radios using pre-defined building blocks connected by a graph.)

The M1 and M2 iPads have more than the necessary CPU and graphics performance that a portable SDR solution requires. I also am curious about the neural processor and it's potential use for signal processing.

Currently, the USB support in DriverKit on iPadOS requires you to apply for, and be granted access to, the entitlements necessary to communicate with your accessory. See Requesting Entitlements for DriverKit Development. While I’m not involved in that process, and thus I can’t make definitive statements about it, it seems to assume that you’re talking to an accessory that you develop. For example, when you get to the request form it asks for a specific Vendor ID.

My wild guess is that there are probably about 100 different radio receivers with USB interfaces and unique hardware ids that are available for purchase.

Do these present some standard USB class interface? Like audio? Or are you required to send custom commands?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

The DeviceClass=0x00 and the InterfaceClass, Interface SubClass and Interface Protocol all = 0xFF which means the device does not specify how to interface to it. The code is complex and the dependencies are difficult to figure out (for me), so I think the next step is to try to trace the device driver running on my MBP. (I wish I could turn Sandbox off!)

@eskimo , I am becoming convinced that Apple does not want user developed software to interface with the USB-C bus unless it is for a specific device.

I also saw that there is a libUSBCfwflash library which seems, on the surface, to be a bit hypocritical of Apple.

I am impressed by Apple’s hardware and many of the apps but truly discouraged when it comes to using it with the USB interface. I don’t understand why reading and writing to a USB device from user space should be limited or why Apple doesn’t give an option to disable that part of the Sandbox, like they do in OSX. The IOKit calls used in libUSB that I looked into exist in iPadOS but they are blocked from user access.

The current RTL-SDR driver software supports about 30 different combinations of Device ID and Product ID. DriverKit isn’t broken but the entitlement process seems to be.

Thanks for all of your help, @eskimo. I appreciate your support!

Gene