We have an application that sets a code signing requirement on a XPC connection between a File Provider extension and the main application. Only with a specific Developer ID certificate <DEVELOPER_ID_TEAM_IDENTIFIER> that designated requirement is not accepted and the application crashes with EXC_CRASH (SIGABRT) and the stacktrace
Thread 1 Crashed:: Dispatch queue: com.apple.root.default-qos
0 libsystem_kernel.dylib 0x19b556388 __pthread_kill + 8
1 libsystem_pthread.dylib 0x19b58f88c pthread_kill + 296
2 libsystem_c.dylib 0x19b498a3c abort + 124
3 libc++abi.dylib 0x19b545384 abort_message + 132
4 libc++abi.dylib 0x19b533cf4 demangling_terminate_handler() + 344
5 libobjc.A.dylib 0x19b1b8dd4 _objc_terminate() + 156
6 libc++abi.dylib 0x19b544698 std::__terminate(void (*)()) + 16
7 libc++abi.dylib 0x19b547c30 __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) + 88
8 libc++abi.dylib 0x19b547bd8 __cxa_throw + 92
9 libobjc.A.dylib 0x19b1aecf8 objc_exception_throw + 448
10 Foundation 0x19d5c3840 -[NSXPCConnection setCodeSigningRequirement:] + 140
11 libxpcfileprovider.dylib 0x301023048 NSXPCConnection.setCodeSigningRequirementFromTeamIdentifier(_:) + 1796
12 libxpcfileprovider.dylib 0x30101dc94 closure #1 in CallbackFileProviderManager.getFileProviderConnection(_:service:completionHandler:interruptionHandler:exportedObject:) + 1936
13 libxpcfileprovider.dylib 0x30101e110 thunk for @escaping @callee_guaranteed @Sendable (@guaranteed NSXPCConnection?, @guaranteed Error?) -> () + 80
14 Foundation 0x19d46c3a4 __72-[NSFileProviderService getFileProviderConnectionWithCompletionHandler:]_block_invoke_2.687 + 284
15 libdispatch.dylib 0x19b3d7b2c _dispatch_call_block_and_release + 32
16 libdispatch.dylib 0x19b3f185c _dispatch_client_callout + 16
17 libdispatch.dylib 0x19b40e490 + 32
18 libdispatch.dylib 0x19b3e9fa4 _dispatch_root_queue_drain + 736
19 libdispatch.dylib 0x19b3ea5d4 _dispatch_worker_thread2 + 156
20 libsystem_pthread.dylib 0x19b58be28 _pthread_wqthread + 232
21 libsystem_pthread.dylib 0x19b58ab74 start_wqthread + 8
The designated codesign requirement on the XPC connection is set to
anchor apple generic and certificate leaf[subject.OU] = <DEVELOPER_ID_TEAM_IDENTIFIER>"
We have verified the designated code sign requirement to be valid on both the main bundle and the embedded extension using:
codesign --verify -v -R '=anchor apple generic and certificate leaf[subject.OU] = "<DEVELOPER_ID_TEAM_IDENTIFIER>"' *.app
codesign --verify -v -R '=anchor apple generic and certificate leaf[subject.OU] = "<DEVELOPER_ID_TEAM_IDENTIFIER>"' *.app/Contents/PlugIns/*
Thanks for bringing this to the forums. This is a weird one, and I’m glad to be able to answer it in public.
The designated codesign requirement on the XPC connection is set to …
The most likely cause of this issue is a quoting problem. Consider this:
% cat ok.txt
anchor apple generic and certificate leaf[subject.OU] = SKMME9E2Y8
% csreq -r ok.txt -t
anchor apple generic and certificate leaf[subject.OU] = SKMME9E2Y8
% cat ng.txt
anchor apple generic and certificate leaf[subject.OU] = 1KMME9E2Y8
% csreq -r ng.txt -t
error: invalid or corrupted code requirement(s)
Requirement syntax error(s):
line 1:55: unexpected token: =
line 1:57: expecting EOF, found '1'
The only difference between ok.txt and ng.txt is that the Team ID starts with a digit. That throws off the requirements parser, resulting in wacky errors. When you use it with NSXPCConnection the error occurs at a point where it’s very hard to propagate, and thus you trap.
The fix is to apply always quote your Team ID:
% cat fixed.txt
anchor apple generic and certificate leaf[subject.OU] = "1KMME9E2Y8"
% csreq -r fixed.txt -t
anchor apple generic and certificate leaf[subject.OU] = "1KMME9E2Y8"
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
