Demystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.

Post

Replies

Boosts

Views

Activity

Subject: Assistance Needed: Xcode Suggesting Unnecessary @Transient Backing Data Code for SwiftData Model
Question: Hello, I'm encountering an issue with SwiftData in Xcode. Despite setting up my model classes correctly, Xcode is suggesting additional boilerplate code for handling backing data which I believe should not be necessary. Here are the details: Context: I'm working with SwiftData to persist my data models. I've set up my model container and schema correctly, and I'm only persisting final classes. However, Xcode is suggesting the following code for one of my model classes (LoanAccount): swift Copy code @Transient private var _$backingData: any SwiftData.BackingData = LoanAccount.createBackingData() public var persistentBackingData: any SwiftData.BackingData { get { _$backingData } set { _$backingData = newValue } } static var schemaMetadata: [SwiftData.Schema.PropertyMetadata] { return [ SwiftData.Schema.PropertyMetadata(name: "loanName", keypath: \LoanAccount.loanName, defaultValue: nil, metadata: nil), SwiftData.Schema.PropertyMetadata(name: "outstandingBalance", keypath: \LoanAccount.outstandingBalance, defaultValue: nil, metadata: nil), SwiftData.Schema.PropertyMetadata(name: "currentAssetValue", keypath: \LoanAccount.currentAssetValue, defaultValue: nil, metadata: nil), SwiftData.Schema.PropertyMetadata(name: "securedAssets", keypath: \LoanAccount.securedAssets, defaultValue: [], metadata: nil) ] } required init(backingData: any SwiftData.BackingData) { _loanName = _SwiftDataNoType() _outstandingBalance = _SwiftDataNoType() _currentAssetValue = _SwiftDataNoType() _securedAssets = _SwiftDataNoType() self.persistentBackingData = backingData } @Transient private let _$observationRegistrar = Observation.ObservationRegistrar() struct _SwiftDataNoType { } My Model Setup: Here's a brief overview of my model setup: swift Copy code import Foundation import SwiftData @Model class LoanAccount: LiabilityAccount { var loanName: String var outstandingBalance: Double? var currentAssetValue: Double? var securedAssets: [SecuredAsset] = [] required init( id: UUID = UUID(), institutionName: String, accountName: String, accountBalance: Double = 0, accountOwner: String, country: String = "UK", accountCurrency: String, risk: Int = 1, accountStatus: String = "Active", startDate: Date = Date(), maturityDate: Date = Date(), dateCreated: Date = Date(), dateUpdated: Date = Date(), addressline1: String? = nil, addressline2: String? = nil, county: String? = nil, zipcode: String? = nil, phoneNumber: String? = nil, email: String? = nil, contact1: String? = nil, contact2: String? = nil, link: String? = nil, notes: String? = nil, accountNumber: String? = nil, sortCode: String? = nil, accountFee: Double? = nil, interestRate: Double? = nil, loanName: String, outstandingBalance: Double? = nil, currentAssetValue: Double? = nil, securedAssets: [SecuredAsset] = [], activities: [AccountActivity] = [] ) { self.loanName = loanName self.outstandingBalance = outstandingBalance self.currentAssetValue = currentAssetValue self.securedAssets = securedAssets super.init( id: id, institutionName: institutionName, accountName: accountName, accountType: "Loan", icon: "default_icon", accountOwner: accountOwner, country: country, accountCurrency: accountCurrency, risk: risk, accountStatus: accountStatus, startDate: startDate, maturityDate: maturityDate, dateCreated: dateCreated, dateUpdated: dateUpdated, addressline1: addressline1, addressline2: addressline2, county: county, zipcode: zipcode, phoneNumber: phoneNumber, email: email, contact1: contact1, contact2: contact2, link: link, notes: notes, accountNumber: accountNumber, sortCode: sortCode, accountFee: accountFee, interestRate: interestRate, accountBalance: accountBalance, activities: activities ) } } Issue: Xcode is suggesting that I need to add the @Transient backing data code, even though my understanding is that this should be handled automatically by SwiftData when using the @Model attribute. Request: Can anyone provide insight into why Xcode is suggesting this code and if there's a configuration or setup step I might be missing? I want to ensure my data models are set up correctly without needing unnecessary boilerplate code. Thank you!
0
0
56
1d
codesign errSecInternalComponent
I encountered a signature issue, codesign -f -s "Developer ID Application: ***" /Users/leagsoft/Desktop/uninstall /Users/leagsoft/Desktop/uninstall: replacing existing signature Warning: unable to build chain to self-signed root for signer "Developer ID Application:***" /Users/uninstall: errSecInternalComponent but using Sodu can sign normally
0
0
56
2d
possibility of unified code-signing "build settings" for Sonoma14 and iPAD OS>=17 OS & iPAD
1) The situation in general: 1A) I begun USB-DExt project for Mac & iPADsOS>=17. 1B) I started-from scratch with DriverKitSampleApp 1C) For these two different targets (Mac,iPAD; using IDE XCode15.0), I couldn't find another way to build the sample project from Apple, beside this: now I have two handmade sets of ini-profiles and two respective "command-files". 2) My current palliative solution comprises of two specific ~"command-files" (each one runs in a directory with specific DriverKitSampleApp.entitlements,project.pbxproj)_ : 2A) my current file "cpy.command" for target "MAC" ## Destination "Mac" ## DriverKitSampleApp.entitlements: "com.apple.developer.driverkit.userclient-access" ## item0: "com.ry.dexsample1.driver" ## Build Settings "DriverKitSampleApp":Signing:Code Signing Identity:"Sign to Run Locally" ## "NullDriver":Signing:Code Signing Identity:"Sign to Run Locally" ## "NullDriver":"AD_HOC_CODE_SIGNING_ALLOWED=YES" cp DriverKitSampleApp.entitlements ../DriverKitSampleApp cp project.pbxproj ../RyDExtSmpl1.xcodeproj 2B) my current file ~"cpy.command" for target "iPAD" ## Destination "iPAD" ## Build Settings "DriverKitSampleApp":Signing:Code Signing Identity:"Apple Development" ## "NullDriver":Signing:Code Signing Identity:"Apple Development" ## "NullDriver":"AD_HOC_CODE_SIGNING_ALLOWED=NO" cp DriverKitSampleApp.entitlements ../DriverKitSampleApp cp project.pbxproj ../RyDExtSmpl1.xcodeproj 2C) This state is inconvenient (predicting that I will switch between MAC and iPAD dozens thousands of times when debugging this project) 3) The question 3A) I need to build the Apple's sample project "DriverKitSampleApp" just selecting one of two possible targets (Mac,iPad) in XCode-IDE. 3B) Option1: what developer(or team's entitlements) do I need for "3A"? 3C) Option2: what adjustments of project's configuration files do I need for "3A"? .
1
0
111
6d
Code signing breaks conda environment
Hi, I am trying to release a small application which bundles a conda environment and a python script. I am using Platypus to turn it into a .app, and I include all necessary resources (libraries, binaries etc) inside the Resources directory. My application works correctly before code signing, and is portable between machines (so I don't think it is the case that the conda environment is missing something). However, after signing, it crashes when it runs one of the programs within the conda environment. I am first signing all .so, .dylib and all files in conda_env/bin as follows: # Within the conda environment directory in Resources find bin -type f | xargs -n1 codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)" find . -name "*.dylib" -o -name "*.so" -type f | xargs -n1 codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)" I am then signing the .app itself codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)" my_app.app Finally, I convert it into a .dmg (with appdmg) and sign that. codesign -f --sign "Developer ID Application: Whatever (123456789)" --timestamp my_app.dmg I submit to the notary service, which succeeds, and then I staple the ticket to the .dmg: xcrun notarytool submit my_app.dmg --keychain-profile my_notarytool_keychain_id --wait xcrun stapler staple my_app.dmg spcl is happy with the signed .app and .dmg and accepts them both. spctl -a -vv my_app.app # my_app.app: accepted # source=Notarized Developer ID # origin=Whatever (123456789) spctl -a -vv -t install my_app.dmg # my_app.dmg: accepted # source=Notarized Developer ID # origin=Whatever (123456789) I have a valid Developer Application ID. All good, right? Except, during execution, the signed .app crashes. When I look in the Console, the error log always looks similar - something like: Exception Type: EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid)) Termination Reason: Namespace CODESIGNING, Code 2 Invalid Page Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsystem_platform.dylib 0x186e15848 sys_icache_invalidate + 40 1 libllvmlite.dylib 0x2a022f8e8 llvm::sys::Memory::protectMappedMemory(llvm::sys::MemoryBlock const&, unsigned int) + 384 2 libllvmlite.dylib 0x29d765528 LLVMPY_TryAllocateExecutableMemory + 92 3 libffi.8.dylib 0x103abc04c ffi_call_SYSV + 76 etc I think all the .dylib, .so, and binaries are signed in my codesign scripts, except for the libsystem_platform.dylib mentioned in the first line of the log. Could this be the problem? How can I find if I am not signing something that is being used? Are there other types of files that I should be signing that I am missing? I've been trying to fix this for several days and I feel I have tried everything (constructing the conda env in different ways, signing in different ways, e.g. with/without --deep, with/without signing each type of library/binary) to no avail... Any help would be greatly appreciated! All the best, George
1
0
216
1w
Command CodeSign failed with a nonzero exit code
I am having a peculiar issue with an app I am developing. I am trying to upload it onto App Store Connect but I am getting one error, and a very odd behavior. The error message I am getting is: /Users/user/Documents/GitHub/MyApp/MyApp/DerivedData/MyApp.pub/Build/Intermediates.noindex/ArchiveIntermediates/MyApp.pub/InstallationBuildProductsLocation/Applications/MyApp.pub.app: resource fork, Finder information, or similar detritus not allowed Command CodeSign failed with a nonzero exit code I have cleaned built the directory, I have removed the Derived Data, but this always gets thrown. It was working fine a few months ago, I have only just got back to working on it. The other issue I am havving, when I set to archive the app, I set the target as Any iOS Arm Device (arm64), but when it is archiving it switches to my iPhone as the target. I don't prompt it to do this, it just does it. This is very frustrating. I'm using a MacBook Air M1, with a macOS Sonoma. I updated my Xcode the other day, that's Version 15.4 (15F31d). My App has a minimum target of iOS 15 and a project target of Xcode 13. Any help is appreciated.
3
0
224
1w
run command line tool with associated dylib
I've been given an Xcode project which produces a command line tool which links to a dylib. I have the dylib, but not its source code. I change the signing option for the command line tool target so it is signed automatically by my personal team. On an attempt to run the tool, it fails to load the dylib, because the dylib is signed with a different certificate. I manually codesign the dylib with the same certificate I am using for the command line app. Now, I can build the app, but not run it. If I try to do so, I see four dialogs telling me “libXXX.dylib” can’t be opened because Apple cannot check it for malicious software, then the console tells me "'/path/to/libXXX.dylib' not valid for use in process: library load disallowed by system policy)" I found an old document about Gatekeeper (https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html) which suggests that Gatekeeper just won't let me do this - I can't just put the dylib next to the executable, although the dynamic linker finds the dylib, Gatekeeper doesn't like it because the dylib isn't inside the app bundle (there is none), and isn't in one of the well-known places. I dealt with this by making a do-nothing app which I can sign with my personal certificate. Then I replace the signature on the dylib (and its dependent dylibs) with my own. I add the command line tool and all its dylib dependencies to the do-nothing app, then add those files into the Copy Bundle Resources phase of the do-nothing app. Now, the command line tool and its dylibs all live in do-nothing.app/Contents/Resources, and I can run the tool from there without Gatekeeper complaining. Is there an easier way (aside from asking my supplier for static libraries)? And if this is the only way, is Contents/Resources the right place to put command line tools and the dylibs they link to?
5
0
473
3w
App Sandbox blocked my launchPath
I need help, when I run code without a sandbox it works well. however, when I enabled it, it gave me (Thread 3: "launch path not accessible")! How can I fix that? let task = Process() task.launchPath = "/Users/alielzieny/Documents/TerrierSectraFix/TerrierSectraFix/Frameworks/python3" task.arguments = ["/Users/alielzieny/Documents/TerrierSectraFix/TerrierSectraFix/SectraFix.py", selectedDirectoryURL.path, destinationDirectoryURL.path] let pipe = Pipe() task.standardOutput = pipe task.launch() task.waitUntilExit() let data = pipe.fileHandleForReading.readDataToEndOfFile() if let output = String(data: data, encoding: .utf8) { print(output) }
1
1
353
3w
An App ID with Identifier 'de.{domain}.app' is not available. Please enter a different string
Hi, I am trying to create a new Identifier for my app. When I write down the Bundle ID I am getting this popup: An attribute in the provided entity has invalid value An App ID with Identifier 'de.{domain}.app is not available. Please enter a different string. Can anyone please help? The domain is mine and no apps have been released yet. I can't find a solution for this
1
0
231
May ’24
The python app is caught by gatekeeper.
I got the python app notarized and downloaded it fine. However, if you are caught by Gatekeeper and open the information window, you will see a lock and even if you enter the password to open the lock, it will not work. xattr -d com.apple.quarantine ./test.app You have to exclude it from the gatekeeper directly. I wonder if the downloaded app is unavoidable... or if there is another way.
1
0
205
May ’24
need help updating an app to work on ios 17+
I have an app that needs re-signing/updating to work on ios 17 (ios 17.4.1). I have renamed the IPA file to zip and extracted it to the desktop. The files in the extracted folder are: ItunesArtwork ItunesMetadata.plist Payload folder Payload folder contains the app App package contents contains all the app files, including the _CodeSignature folder. I extracted the package contents to a folder on the desktop. Xcode 15.3 (15E204a) is installed. Need the steps necessary to complete it and generate the new IPA file to test. Thanks all, Ed
1
0
247
May ’24
Crash using OpenMP library in a sandboxed app
I'm trying to add a feature to my app which requires OpenMP as third party library. The first time an openMP API gets called makes the app crash. The Xcode terminal reports this: OMP: Error #179: Function Can't open TEMP failed: OMP: System error #1: Operation not permitted Assertion failure at kmp_runtime.cpp(6918): temp_reg_status_file_name. OMP: Error #13: Assertion failure at kmp_runtime.cpp(6918). Console app reports this: Sandbox: deny(1) ipc-posix-shm-write-create /__KMP_REGISTERED_LIB_31975 I cannot substitute or get rid of the OpenMP library as it is used by other third party libs needed by the feature I’m developeng. Hope there is a workaround to the sandbox security restrictions that allows to use the lib. Thanks, Andrea
1
0
267
May ’24
Deploying a personal app
I have a personal app I use only for myself on my iPhone. I do not distribute this. Its stops working every year when my renewal comes up. Once I renew my subscription I reload the app onto my phone and it works again. Is there a way that I can have it work forever without having to reload it every year? Sometimes I forget to reload after my renewal and it does not work until I do so.
1
0
219
Apr ’24
PKG Installer postinstall script not executing in Sonoma
Hi, we have an app that has been in development since Catalina and ever since Sonoma came out we noticed that when executing our pkg installer the application is installed correctly but the postinstall script is not executed. The weird thing is that if I run the pkg for the first time the postinstall does not execute BUT if I run it again then it DOES!! Looking through the logs I found these ones that confirm the execution of the script is being blocked. We haven't changed anything in the way we build the installer so I'm not quite sure how to fix this. 2024-04-25 16:29:51.570662-0300 0x1c62 Error 0x0 308 0 syspolicyd: [com.apple.syspolicy.exec:default] Unable (errno: 2) to read file at <private> for pid: 784 process path: <private> library path: (null) 2024-04-25 16:29:51.570662-0300 0x1c62 Error 0x0 308 0 syspolicyd: [com.apple.syspolicy.exec:default] Terminating process due to Malware rejection: 784, <private> 2024-04-25 16:29:51.570679-0300 0x1d13 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Sleep interrupted, signal 0x100 2024-04-25 16:29:51.570682-0300 0x1d13 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 784, /private/tmp/PKInstallSandbox.m5Av3O/Scripts/com.mycompany.myapp.pkg.BSOjtt/postinstall The app as well as the installer are both signed, notarized and stapled. Here you can see the script which just simply executes the app. #!/bin/bash echo "Running postinstall" /Applications/myapp.app/Contents/MacOS/myapp --load-system-extension & exit 0 Any help would be much appreciated. Thanks!
4
0
362
Apr ’24
Unable to verify certificate on iOS caused by invalid HTTPS certificate on ppq.apple.com
I am able to successfully install the app on my device, but I am unable to verify the app. Steps to reproduce: Navigate to Settings -> VPN & Device Management on iPhone 14 Select developer under Developer App Select trust this computer Attempt to Verify App The "Verify App" button has no effect. The app can still be installed when built, but is not able to be opened. Navigating to ppq.apple.com in a browser results in a "cannot be trusted":
2
0
264
Apr ’24