Hello everyone,
I’m running into a code signing validation failure when delivering a .NET MAUI Mac Catalyst app to App Store Connect via Transporter. I’d appreciate any help in figuring out what is misconfigured.
Environment:
.NET 9 MAUI (net9.0-maccatalyst)
Build host: Mac
Delivery tool: Transporter (App Store Connect)
Issue:
The packaging process itself appears to succeed and produces a .pkg file, but Transporter fails during validation with the following error:
text The product archive package's signature is invalid. Ensure that it is signed with your "3rd Party Mac Developer Installer" certificate. (90237) Publish command:
I’m publishing and signing from the command line, following Microsoft’s documentation for publishing .NET MAUI Mac Catalyst apps to the Mac App Store.
bash
dotnet publish -f net9.0-maccatalyst -c Release
-p:EnableCodeSigning=true
-p:EnablePackageSigning=true
-p:CodesignKey="Apple Distribution: Ping Zhang (*********D)"
-p:CodesignProvision="AideApp_MacCatalyst"
-p:CodesignEntitlements="Platforms/MacCatalyst/Entitlements.plist"
-p:PackageSigningKey="3rd Party Mac Developer Installer: Ping Zhang (Y2K7Q6HU4D)"
-p:CreatePackage=true
What I’ve checked so far:
The 3rd Party Mac Developer Installer certificate is present in my keychain.
The certificate has not expired.
The certificate matches the correct team and App ID.
The generated .pkg is what I’m uploading through Transporter.
Questions:
Is there anything wrong with the PackageSigningKey or CodesignKey parameters in the command above?
Does .NET MAUI actually apply the 3rd Party Mac Developer Installer signature to the .pkg when EnablePackageSigning=true and CreatePackage=true are used?
Should the CodesignKey be an Apple Distribution certificate, or should it also be a 3rd Party Mac Developer Application certificate for Mac App Store distribution?
Are there any additional steps required to ensure the .pkg is signed correctly before uploading with Transporter?
How can I verify whether the .pkg was signed with the correct installer certificate? For example, would pkgutil --check-signature be sufficient?
Any guidance would be greatly appreciated. Thank you!
I can’t help you with third-party tools. If you need help with that, I recommend that you request that help via the support channel for those tools.
Before you do that, however, it’d be a good idea to rule out the Apple side of the equation. If you use Apple tools to create a Mac App Store installer package, will Transporter accept that?
Any easy way to do this is:
- Using Xcode, create a new macOS > App project with the same bundle ID as your main app.
- Choose Product > Archive.
- In the Xcode organiser, use Validate App to ensure that it’s set up correctly. It’s likely you’ll require a few tweaks, for example, setting up the icon.
- Once it passes validation, click Distribute App and follow the Custom > App Store Connect > Export workflow. The final result will be a Transporter-ready installer package (
.pkg). - Try to upload that with Transporter.
If it works, you know that the Apple side of this is all good and you can talk with your third-party tooling vendor. If it doesn’t work, there’s something wrong on the Apple side and we can talk more about it here.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
