Hi,
the documentation says that an application bundle for Mac OS X can have a Frameworks folder within Contents. Using a framework for console applications (no bundle) and GUI applications (bundle), I cannot load the console applications anymore on Ventura.
Prior to Ventora I have tested and ran both on Mojave or earlier - I am not sure.
To fix the issue, I have moved the frameworks within the application bundle to match the rpath for /Users/lothar/Library/Frameworks when I place the console into /Users/lothar/bin, the same rpath for application bundles works for those within the bin folder.
Can I publish an application bundle with that modified layout or do I have to expect getting problems and do rather a Symlink pointing from /Users/lothar/Frameworks to /Users/lothar/Library/Frameworks?
Thanks, Lothar
General
RSS for tagDemystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
There does not seem to be a way to code sign a PAM module so that an XPC service can verify the signature with setCodeSigningRequirement.
There should be a way to build a PAM module (dynamic Library ) so it can be code signed. Put in a bundle and code signing the bundle does not work .
Incremental builds using xcodebuild are very slow, around 3x slower when compared to the same build using Xcode.
Recently, I discovered that CODE_SIGNING_ALLOWED=NO" fixed the issue, but of course, I can't then run iOS app.
It seems like automatic signing using xcodebuild is somehow broken. Therefore, I think I could set CODE_SIGNING_ALLOWED=NO" and sign it manually later. However, I'm not sure how to do that.
I checked what Xcode does and it's:
/usr/bin/codesign --force --sign - --entitlements /Users/wkulik/Library/Developer/Xcode/DerivedData/XYZ-hblnhsksxjrctzekqmlevcflnsji/Build/Intermediates.noindex/XYZ.build/Debug-iphonesimulator/XYZ.build/XYZ.app.xcent --timestamp\=none --generate-entitlement-der /Users/wkulik/Library/Developer/Xcode/DerivedData/XYZ-hblnhsksxjrctzekqmlevcflnsji/Build/Products/Debug-iphonesimulator/XYZ.app
However, if I run xcodebuild with disabled signing I don't have XYZ.app.xcent required by this command.
I also tried:
codesign --force --deep --sign "Apple Development: John Snow (XYZ)" /Users/wkulik/Library/Developer/Xcode/DerivedData/XYZ-hblnhsksxjrctzekqmlevcflnsji/Build/Products/Debug-iphonesimulator/XYZ.app
but the app immediately terminates (the same way like when unsigned).
Could anyone help with that?
Hi all,
I have two apple accounts. Stupidly my project is written in Account A and my paid developer account is Account B. When I tried to archive and publish under Account A, it says "Team "*** (Personal Team)" is not enrolled in the Apple Developer Program". But when I add a team to Account B, "Command CodeSign failed with a nonzero exit code". I know it is not the code itself because it runs fine when I use Account A. Just couldn't publish.
Any advice? Many many thanks
Topic:
Code Signing
SubTopic:
General
I am a developer, please send me the authentication code !
I have an app Arpeggio.app which I build and then sign without errors: "electron-osx-sign dist/mac-arm64/Arpeggio.app --identity="Developer ID Application: XXXX (XXXXXX)" --hardened-runtime --no-gatekeeper-assess --entitlements=entitlements.plist".
It returns "Application signed: dist/mac-arm64/Arpeggio.app".
I then use "/usr/bin/ditto -c -k --sequesterRsrc --keepParent src dst" to make a zip with the same signatures.
I then submit the zip for notarization: "xcrun notarytool submit dist/mac-arm64/Arpeggio.zip --apple-id XXXX etc"
which returns "Waiting for processing to complete.
Current status: Accepted..............
Processing complete
id: ***-***-xx-xx
status: Accepted".
Then I staple the notarization to the app and get "The staple and validate action worked!". Now it shows all validated and that the notarization is stapled. I then run "spctl --assess --type execute -vv 'dist/mac-arm64/Arpeggio.app'" as a last check and always get this:
dist/mac-arm64/Arpeggio.app: unknown error 99999=1869f
Why is this happening? I can't seem to debug the issue but out notarization and signing is always successful and the app works as expected. Pleas ehelp me get to the bottom of this.
I tried building the React App for Any iOS device (Arm64) but I get error.
Although I can build successfully for any iOS Simulators
In the codesigning step I get the following error,
"Warning: unable to build chain to self-signed root for signer "Apple Development: my email address ( ... ) "
I don't have paid membership of Apple Developer Program, does that cause this failure?
Also, to archive also do I need Apple Developer Program paid membership?
Topic:
Code Signing
SubTopic:
General
I'm unable to run a widget containing a live activity with the error message at the bottom of this post. I've verified I have NSSupportsLiveActivities set to yes in the correct Info.plist, and have downloaded sample projects from github containing the same values. This error occurs while running on a device or simulator, on Xcode 15 and 16, iOS simulator 17 and 18.
Create sample project
Create new widget extension target
Set NSSupportsLiveActivities to true in the appropriateinfo.plist
Run the widget
This seems to be a longstanding issue https://forums.developer.apple.com/forums/thread/651611
Any ideas for debugigng? I'm completely blocked from running live activities.
SendProcessControlEvent:toPid: encountered an error: Error Domain=com.apple.dt.deviceprocesscontrolservice Code=8 "Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}." UserInfo={NSLocalizedDescription=Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}., NSUnderlyingError=0x600000c6a940 {Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}}}
Domain: DTXMessage
Code: 1
User Info: {
DVTErrorCreationDateKey = "2024-11-15 17:06:33 +0000";
}
SendProcessControlEvent:toPid: encountered an error: Error Domain=com.apple.dt.deviceprocesscontrolservice Code=8 "Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}." UserInfo={NSLocalizedDescription=Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}., NSUnderlyingError=0x600000c6a940 {Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}}}
Domain: DTXMessage
Code: 1
System Information
macOS Version 14.5 (Build 23F79)
Xcode 16.1 (23503) (Build 16B40)
Timestamp: 2024-11-15T12:06:33-05:00
Topic:
Code Signing
SubTopic:
General
Adobe says that Animate works with the latest Mac OS.
When I publish apps with Animate, they work on my computer.
With a self-signed certificate, they work on some older Mac OS versions, but not on the 2 most recent.
How can I test my apps on others' Mac computers?
Robert
Hi
After I added iCloud container and iCloud documents my UITests can't run anymore what is this problem and how can I solve it?
Thanks!
Hi,
If an Apple developer subscription account is stopped, how does it affect already signed and and notarized apps?
Will all apps and dmg's already signed and notarized in the past still be valid in the future?
Platforms: Ventura and Big Sur
Steps to Reproduce:
Create new application and installer CSRs with keypairs
Generate new certificates in Apple web portal
Repackage certificates as .p12 using exported private keys since they are not referenced in keychain app by default.
Import certificates into MacOS Keychain
Set certificate access to "Always Trust" for all certificate uses
Sign binary fails using "codesign --force --sign "
Sign installer package succeeds using "productsign --sign
Additional Info:
The private keys ware initially not recognized by the Keychain application resulting a certificate without a private key "leaf" beneath them. To resolve it I exported the private key and repackaged certificate as a .p12 file.
Both certificates appear "good" when evaluated for code signing
The installer certificate shows an intermediate and root while the application certificate does not
Repackaging as .p12 with expected intermediate and root did not resolve the issue
Installing all available intermediates and roots from Apple did not resolve the issue
Signing a test app with XCode succeeds
In production, we sign using CMake so we need to be able to sign code from the command line with codesign.
Hello,
I'm new at developing an ios app, but I have created a basic app, I plan to use just for me using xcode and the language swift.
I intend to use this app, to display a video and images on ipads that will be used as KIOS on a trade show. I don't need this app to be published on the app store as I intend to use it solely for my use.
Is there a way I can do something like this that won't be restricted with the 10 days restriction?
I learned xcode/swift as little as I could to create the app, but now I'm limited to the 10 days, and only 3 devices. Is there a way I can create an offline app, that doesn't have the all the restrictions? I plan to use these ipads over and over again on tradeshows to display my work.
Topic:
Code Signing
SubTopic:
General
Hello,
I am on maxOS 14.6 and I developed a C++ application for macOS with graphical-user interface by using wxWidgets. The .app application bundle is built correctly and the application runs. Now I would like to sign it to get it notarized.
I get the following error
sudo codesign -vvv --deep --strict MyApp.app/Contents/MacOS/MyApp MyApps.app/Contents/MacOS/MyApp: code has no resources but signature indicates they must be present
If I check the signature I get
% pkgutil --check-signature MyApp.app Package "MyApp": Status: package is invalid (checksum did not verify)
How may I fix this?
Thank you!
Topic:
Code Signing
SubTopic:
General
For some reason Xcode said my certificate was revoked. Developer support says it’s active. Could someone point me towards the steps to reactivate it?
Chrome has started crashing almost immediately after startup. I've reported the issue to the Chrome team here: https://issues.chromium.org/issues/385433270
I'm hoping to debug the issue a bit more myself. This page from the Chrome team https://chromium.googlesource.com/chromium/src/+/master/docs/mac/debugging.md#chrome-builds suggests using the follow to strip off the protections:
codesign --force --sign - path/to/Google\ Chrome.app
However, applying that seems to have no effect:
% codesign --force --sign - /Applications/Google\ Chrome\ copy.app
/Applications/Google Chrome copy.app: replacing existing signature
/Applications/Google Chrome copy.app: resource fork, Finder information, or similar detritus not allowed
% lldb /Applications/Google\ Chrome\ copy.app
(lldb) target create "/Applications/Google Chrome copy.app"
Current executable set to '/Applications/Google Chrome copy.app' (arm64).
(lldb) run
error: process exited with status -1 (attach failed (Not allowed to attach to process. Look in the console messages (Console.app), near the debugserver entries, when the attach failed. The subsystem that denied the attach permission will likely have logged an informative message about why it was denied.))
I have tried other variations like the following based on Stack Overflow, this forum, etc., but with the same result. (I'm still a little vague on the meaning for some flags, sorry.) Though codesign says that it's "replacing existing signature", as far as I can tell, nothing is changing:
% cat <<EOF > debuggee-entitlement.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.get-task-allow</key>
<true/>
</dict>
</plist>
EOF
% codesign --verbose=4 -fs - --options library-validation --entitlements debuggee-entitlement.xml /Applications/Google\ Chrome\ copy.app
/Applications/Google Chrome copy.app: replacing existing signature
/Applications/Google Chrome copy.app: resource fork, Finder information, or similar detritus not allowed
file with invalid attached data: Disallowed xattr com.apple.FinderInfo found on /Applications/Google Chrome copy.app
lldb still fails the same way.
Here's what I see after the above:
% codesign -d -vvv /Applications/Google\ Chrome\ copy.app
Executable=/Applications/Google Chrome copy.app/Contents/MacOS/Google Chrome
Identifier=com.google.Chrome
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=1821 flags=0x12a00(kill,restrict,library-validation,runtime) hashes=46+7 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=5d7beab2b03d9892426076b24acc19815d7a3ff8
CandidateCDHashFull sha256=5d7beab2b03d9892426076b24acc19815d7a3ff8c1446966e422c3c10672626b
Hash choices=sha256
CMSDigest=5d7beab2b03d9892426076b24acc19815d7a3ff8c1446966e422c3c10672626b
CMSDigestType=2
CDHash=5d7beab2b03d9892426076b24acc19815d7a3ff8
Signature size=8989
Authority=Developer ID Application: Google LLC (EQHXZ8M8AV)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Dec 17, 2024 at 2:47:58 PM
Notarization Ticket=stapled
Info.plist entries=44
TeamIdentifier=EQHXZ8M8AV
Runtime Version=15.0.0
Sealed Resources version=2 rules=13 files=63
Internal requirements count=1 size=288
From what I can tell, my codesign runs have changed nothing... I see no diff as compared with what I see running codesign -d on a fresh copy.
Is it possible to strip off the protections on my local instance to allow debugging with lldb? If so, could someone share a command for accomplishing that?
Although I'm asking about this because of Chrome specifically, I'm hoping to learn more about codesigning in general and to be more empowered as a user to be able to debug when an app I depend on is crashing.
Thanks much! Happy Holidays!
I want to code radeem for testflight
Topic:
Code Signing
SubTopic:
General
I have an executable file named infogodesk, located in the directory /usr/local/SmpAgent/rustdesk/infogodesk. When I execute it using the terminal with ./infogodesk, the process gets terminated by the kernel. However, if I move the executable to another directory, it works fine.
This issue is very frustrating, and I hope to get some help. Below is the console log output:
默认 11:26:28.162205+0800 kernel ASP: Validation category (6) does not match top-level policy match (3) for process: /usr/local/SmpAgent/rustdesk/infogodesk
默认 11:26:28.162211+0800 kernel Validation category policy: Notifying syspolicyd about /usr/local/SmpAgent/rustdesk/infogodesk with PID 88264
默认 11:26:28.166695+0800 kernel CODE SIGNING: cs_invalid_page(0x104e04000): p=88264[infogodesk] final status 0x23000200, denying page sending SIGKILL
默认 11:26:28.166698+0800 kernel CODE SIGNING: process 88264[infogodesk]: rejecting invalid page at address 0x104e04000 from offset 0x0 in file "/usr/local/SmpAgent/rustdesk/infogodesk" (cs_mtime:1734509326.0 == mtime:1734509326.0) (depth:0)
默认 11:26:28.166738+0800 kernel infogodesk[88264] Corpse allowed 1 of 5
默认 11:26:28.255182+0800 ReportCrash ASI found [ReportCrash] (sensitive) 'Pid 88264 'infogodesk' CORPSE: Extracting
Completed 1, Recent: Pid 86766 'ReportCrash' CORPSE'
默认 11:26:28.261619+0800 ReportCrash ASI found [ReportCrash] (sensitive) 'Pid 88264 'infogodesk' CORPSE: Extracting
Completed 1, Recent: Pid 86767 'ReportCrash' CORPSE'
Topic:
Code Signing
SubTopic:
General
I exported an app from an Xcode project using the "Archive" feature. After signing and notarizing it, the app runs normally on my local machine. However, after packaging it with create-dmg or ditto and distributing it to another Mac, I get an error saying the application cannot run. When I execute the command open ***.app in Terminal, it shows _LSOpenURLsWithCompletionHandler() failed for the application /Applications/Maxi PC Suite.app with error -10810. Does anyone know why this is happening?
codesign and notarization info:
codesign -vvv Maxi\ PC\ Suite.app
......
Maxi PC Suite.app: valid on disk
Maxi PC Suite.app: satisfies its Designated Requirement
syspolicy_check distribution Maxi\ PC\ Suite.app
App passed all pre-distribution checks and is ready for distribution.
Topic:
Code Signing
SubTopic:
General
from; tkinter; import *
from; tkinter; import ttk
import random
import time
import sqlite3
#Connect; to; the; database (create, if it doesnot exist)
conn = sqlite3.connect("quiz_database.db")
c = conn.cursor()
Create the table if it doesnot exist
c.execute(""'CREATE TABLE IF NOT EXISTS questions
(id INTEGER PRIMARY KEY AUTOINCREMENT,
question TEXT,
answer1 TEXT,
answer2 TEXT,
correct_answer INTEGER)""')
conn.commit()
Sample data (replace with your own questions)
sample_questions = [
("Is the Earth flat?", "True", "False", 2),
("Do birds fly?", "True", "False", 1),
("Is water wet?", "True", "False", 1),
("Can humans breathe underwater?", "True", "False", 2),
]
c.executemany("INSERT OR IGNORE INTO questions (question, answer1, answer2, correct_answer) VALUES (?, ?, ?, ?)", sample_questions)
conn.commit()
class QuizApp:
def init(self, master):
self.master = master
master.title("True/False Quiz")
# Initialize variables
self.questions = []
self.current_question = 0
self.score = 0
self.start_time = 0
self.time_limit = 60 # Time limit in seconds
# Get questions from the database
self.load_questions()
# Create GUI elements
self.question_label = Label(master, text="", font=("Arial", 16))
self.question_label.pack(pady=20)
self.true_button = Button(master, text="True", command=lambda: self.check_answer(1), width=15)
self.true_button.pack(side=LEFT, padx=10)
self.false_button = Button(master, text="False", command=lambda: self.check_answer(2), width=15)
self.false_button.pack(side=RIGHT, padx=10)
self.feedback_label = Label(master, text="", font=("Arial", 12))
self.feedback_label.pack(pady=10)
self.timer_label = Label(master, text="Time Left: 60s", font=("Arial", 12))
self.timer_label.pack()
self.progress_bar = ttk.Progressbar(master, orient=HORIZONTAL, length=200, mode="determinate")
self.progress_bar.pack(pady=10)
self.start_quiz()
def load_questions(self):
c.execute("SELECT * FROM questions")
self.questions = c.fetchall()
random.shuffle(self.questions)
def start_quiz(self):
self.start_time = time.time()
self.display_question()
self.update_timer()
def display_question(self):
if self.current_question < len(self.questions):
question = self.questions[self.current_question]
self.question_label.config(text=question[1]) # Display the question
self.progress_bar["maximum"] = len(self.questions)
self.progress_bar["value"] = self.current_question + 1 # Update progress bar
def check_answer(self, selected_answer):
correct_answer = self.questions[self.current_question][4]
if selected_answer == correct_answer:
self.feedback_label.config(text="Correct!", fg="green")
self.score += 1
else:
self.feedback_label.config(text="Incorrect!", fg="red")
self.current_question += 1
if self.current_question < len(self.questions):
self.display_question()
else:
self.end_quiz()
def update_timer(self):
elapsed_time = time.time() - self.start_time
remaining_time = self.time_limit - elapsed_time
if remaining_time > 0:
self.timer_label.config(text=f"Time Left: {int(remaining_time)}s")
self.master.after(1000, self.update_timer)
else:
self.end_quiz()
def end_quiz(self):
self.true_button.config(state=DISABLED)
self.false_button.config(state=DISABLED)
self.feedback_label.config(text=f"Quiz Over! Your score: {self.score}/{len(self.questions)}")
Run the application
root = Tk()
app = QuizApp(root)
root.mainloop()
Close the database connection
conn.close()
Topic:
Code Signing
SubTopic:
General