ITMS-91109: Invalid package contents

Hi fellow developers,

I built Video Restore AI which uses a number of models with CoreML on macOS to provide simple one-blick video upscaling and colorization. After uploading my archive, I received the following notification through email.

ITMS-91109: Invalid package contents - The package contains one or more files with the com.apple.quarantine extended file attribute, such as “{com.kammerath.VideoRestore.pkg/Payload/Video Restore AI.app/Contents/Resources/ECCV16Colorize.mlmodelc/weights/weight.bin}”. This attribute shouldn’t be included in any macOS apps distributed on TestFlight or the App Store. Starting February 18, 2025, you must remove this attribute from all files within your macOS app before you can upload to App Store Connect.

How do I deal with this? Is there a way to get Apple to just accept the model contents or do I need to convert it again with coremltools?

Many thanks in advance!

Jan

Answered by DTS Engineer in 821074022

Oh hey, we’ve started warning about that. That’s excellent news, because submitting an app where bits of it were quarantined was an ongoing source of confusing problems.

This error is saying that one of the files in your upload, Video Restore AI.app/Contents/Resources/ECCV16Colorize.mlmodelc/weights/weight.bin, has the quarantine attribute (com.apple.quarantine) set. That attribute is set by user-level tools, like Safari, when they download a file. When the user then goes to open the file, the presence of this attribute triggers a thorough check of the file by Gatekeeper.

It doesn’t make sense to set this attribute on a file that you submit to the App Store because the App Store is going to check the content of your app in any case. And the presence of this attribute can cause problems when the file eventually lands on your customer’s Mac.

You need to work out how this attribute got set on the file. As a first step, check in your source code repository. If the attribute is set there, remove it (using xattr) and then commit that change to the repo.

If the attribute isn’t set in the repo, it’s must be set as part of your build process. In that case, you’ll need to work through the build process to see which step is setting the attribute.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Oh hey, we’ve started warning about that. That’s excellent news, because submitting an app where bits of it were quarantined was an ongoing source of confusing problems.

This error is saying that one of the files in your upload, Video Restore AI.app/Contents/Resources/ECCV16Colorize.mlmodelc/weights/weight.bin, has the quarantine attribute (com.apple.quarantine) set. That attribute is set by user-level tools, like Safari, when they download a file. When the user then goes to open the file, the presence of this attribute triggers a thorough check of the file by Gatekeeper.

It doesn’t make sense to set this attribute on a file that you submit to the App Store because the App Store is going to check the content of your app in any case. And the presence of this attribute can cause problems when the file eventually lands on your customer’s Mac.

You need to work out how this attribute got set on the file. As a first step, check in your source code repository. If the attribute is set there, remove it (using xattr) and then commit that change to the repo.

If the attribute isn’t set in the repo, it’s must be set as part of your build process. In that case, you’ll need to work through the build process to see which step is setting the attribute.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Mind that attr -c does not change the timestamp of a file, so git commit will not notice it’s changed. You also need to “touch” the file.

I find the complaint about the attributes a bit lame, photoshop, safari all seem to set these attributes. Have xcode check, warn, remove such attributes in the distribution process. If it’s important enough to notify developers after upload, then please build it into xcode.

Written by rickj in 821743022
Have xcode check, warn, remove such attributes in the distribution process.

I think that’d make a fine enhancement request for Xcode. Please post your bug number, just for the record.

However, that doesn’t obviate the need for an App Store Connect check. There are lots of App Store developers who don’t use Xcode, especially on the Mac.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

ITMS-91109: Invalid package contents
 
 
Q