Project Background:
I developed a Mac project using Electron and VSCode
Successfully uploaded the packaged pkg using Transporter,
However, I will receive an email informing me that there are some issues with the project:
ITMS-90296: App sandbox not enabled - The following executors must include the 'com. apple. security. app sandbox' entitlement with a Boolean value of true in the entitlement property list: [[com. electron. iflyrecclient. pkg/Payload/iFlytek Listen. app/Contents/MacOS/iFlytek Listen]]
ITMS-90886: 'Cannot be used with TestFlight because the signature for the bundle at' iFlytek hears. app 'is missing an application identifier but has an application identifier in the provisioning profile for the bundle.' Bundles with application identifiers in the provisioning profile are expected to have the same identifier signed into the bundle in order to be eligible for TestFlight.'
Here is my packaging process:
Generate an app using the electron packager tool
Sign the app using @ electron osx sign (version 1.3.1)
After signing, use
productbuild - component Yourappname App/Applications - sign "3rd Party Mac Developer Installer: * * * * * (XXXXXXXXXX)" Yourappname. pkg
command generates pkg
PS:
For the second step, I have set sand box=true in both entitlents.plist and entitlents.macinheriting. plist. And after signing, using
codesign -dvvv -- entitiements - /path
to view the app file shows' checkbox=true ', and the [iFlytek Listen. app/Contents/MacOS/iFlytek Listen] file in the issue also exists.
Using the Suspicious Package software to view pkg also has sandbox=true.
A few months ago, I uploaded it once and the issues mentioned in the email did not appear. The only changes were the macOS system version number and the replacement of the signature with provisionprofileprovisionprofile.
I have reviewed similar issues on the Apple Developer Forums, but have not been resolved
General
RSS for tagDemystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
I tried building the React App for Any iOS device (Arm64) but I get error.
Although I can build successfully for any iOS Simulators
In the codesigning step I get the following error,
"Warning: unable to build chain to self-signed root for signer "Apple Development: my email address ( ... ) "
I don't have paid membership of Apple Developer Program, does that cause this failure?
Also, to archive also do I need Apple Developer Program paid membership?
Topic:
Code Signing
SubTopic:
General
I'm unable to run a widget containing a live activity with the error message at the bottom of this post. I've verified I have NSSupportsLiveActivities set to yes in the correct Info.plist, and have downloaded sample projects from github containing the same values. This error occurs while running on a device or simulator, on Xcode 15 and 16, iOS simulator 17 and 18.
Create sample project
Create new widget extension target
Set NSSupportsLiveActivities to true in the appropriateinfo.plist
Run the widget
This seems to be a longstanding issue https://forums.developer.apple.com/forums/thread/651611
Any ideas for debugigng? I'm completely blocked from running live activities.
SendProcessControlEvent:toPid: encountered an error: Error Domain=com.apple.dt.deviceprocesscontrolservice Code=8 "Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}." UserInfo={NSLocalizedDescription=Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}., NSUnderlyingError=0x600000c6a940 {Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}}}
Domain: DTXMessage
Code: 1
User Info: {
DVTErrorCreationDateKey = "2024-11-15 17:06:33 +0000";
}
SendProcessControlEvent:toPid: encountered an error: Error Domain=com.apple.dt.deviceprocesscontrolservice Code=8 "Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}." UserInfo={NSLocalizedDescription=Failed to show Widget 'ca.holligan.live-activity-example.widget' error: Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}., NSUnderlyingError=0x600000c6a940 {Error Domain=FBSOpenApplicationServiceErrorDomain Code=1 "The request to open "com.apple.springboard" failed." UserInfo={NSLocalizedFailureReason=The request was denied by service delegate (SBMainWorkspace)., BSErrorCodeDescription=RequestDenied, NSUnderlyingError=0x600000c6a8b0 {Error Domain=SBAvocadoDebuggingControllerErrorDomain Code=1 "Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)" UserInfo={NSLocalizedDescription=Failed to get descriptors for extensionBundleID (ca.holligan.live-activity-example.widget)}}, FBSOpenApplicationRequestID=0x2ca0, NSLocalizedDescription=The request to open "com.apple.springboard" failed.}}}
Domain: DTXMessage
Code: 1
System Information
macOS Version 14.5 (Build 23F79)
Xcode 16.1 (23503) (Build 16B40)
Timestamp: 2024-11-15T12:06:33-05:00
Topic:
Code Signing
SubTopic:
General
I work with a team that is responsible for our company's centralized infrastructure for code signing various products within our portfolio, including iOS apps. For security purposes, we want to sign apps before their posting on the App Store, and also to log this activity for eventual security audits. Not surprisingly, we need automated processes; we can't use an IDE like Xcode to do the work. We must queue, process, and log all signing jobs, and have Macs dedicated to this purpose.
I can't go into many details about our infrastructure due to confidentiality concerns, so I'll apologize now if my questions seem a little vague.
We currently require our iOS developers to submit one or more new provisioning profiles as well as their IPA archive for signing. We support supplying multiple provisioning profiles because some of our developers include embedded third-party extensions within their IPAs, and these extensions can also have their own provisioning profiles. Within our back end, we open the archive, sign the relevant portions using the entitlements in one of the profiles (that we believe to be the appropriate one for the particular archive element), overwrite each supplied provisioning profile with (what we believe to be) the appropriate one from user input, and re-compress the archive.
Here come the questions:
When we receive multiple provisioning profiles, how do we know which profile should be used to help with signing which archive elements? What data (e.g. entitlements application-identifier, team-identifier) can we use?
We also need to know which provisioning profiles from their input correspond to those that already exist within the archive. What data can we use to map profiles from one set to the other?
Should we be requiring our users to submit new provisioning profiles in the first place? Or should we edit/recycle the existing ones in some way? We'd like to remove any unnecessary burdens for our users, if possible.
Topic:
Code Signing
SubTopic:
General
Adobe says that Animate works with the latest Mac OS.
When I publish apps with Animate, they work on my computer.
With a self-signed certificate, they work on some older Mac OS versions, but not on the 2 most recent.
How can I test my apps on others' Mac computers?
Robert
I have already posted asking about this:
[quote='768005021, CynthiaSun, /thread/768005, /profile/CynthiaSun']
Codesigned and notarized app cannot directly write files inside the app bundle...
[/quote]
But there are still some doubts that have not been answered.
We use Qt to develop an application on the macOS platform, and we are attempting to perform code signing and notarization to ensure our the application is trusted by Apple.
However, there are a few things that seem weird regarding this statement:
"App bundles are read-only by design."
Let me provide more details.
Currently, when our application starts, it needs to create folder (e.g. Temp) in the root directory of the executable
For example: Myapp.app/Contents/MacOS/Myapp ---> Myapp.app/Contents/MacOS/Temp
The folder is designed for storing runtime logs or config files for our application. In the past, users may also modify the settings inside target folder if needed.
However, the strange thing is that after the application is codesigned and notarized.
When we double-click the application Myapp (a.k.a Myapp.app) in Finder, it could successfully launch and create the Temp folder inside the Myapp.app/Contents/MacOS folder.
However, when we navigate and attempt to run the main application executable in command line mode (as our application supports this command line execution)
$ cd Myapp.app/Contents/MacOS
$ ./Myapp -h
As our application will check if the root folder has write permission before starting (i.e., check if Myapp.app/Contents/MacOS is writable because we require to create Temp folder in the following steps)
It pop up the error that folder does not have write permission.
The aforementioned scenarios seems to conflict with this statement: "App bundles are read-only by design" (because when the application is launched directly by clicking in Finder, the Temp folder can be created successfully, but via the console command line, it cannot).
I would like to confirm again if writing files in the notarized application MacOS directory is not allowed?
If not, have any recommended approaches? (e.g., changing the folder to another directory). What causes the different results in these running scenarios?
We are not concerned about breaking the signature after application launched, as it seems that macOS will add it to system trust list after first time successfully launch. (Download the app from internet --> System: it is an app downloaded from the internet. Are you sure want to open it...? OK --> Although our application creates the Temp folder after first launch, when we click the application second time, it could directly open the app)
Platforms: Ventura and Big Sur
Steps to Reproduce:
Create new application and installer CSRs with keypairs
Generate new certificates in Apple web portal
Repackage certificates as .p12 using exported private keys since they are not referenced in keychain app by default.
Import certificates into MacOS Keychain
Set certificate access to "Always Trust" for all certificate uses
Sign binary fails using "codesign --force --sign "
Sign installer package succeeds using "productsign --sign
Additional Info:
The private keys ware initially not recognized by the Keychain application resulting a certificate without a private key "leaf" beneath them. To resolve it I exported the private key and repackaged certificate as a .p12 file.
Both certificates appear "good" when evaluated for code signing
The installer certificate shows an intermediate and root while the application certificate does not
Repackaging as .p12 with expected intermediate and root did not resolve the issue
Installing all available intermediates and roots from Apple did not resolve the issue
Signing a test app with XCode succeeds
In production, we sign using CMake so we need to be able to sign code from the command line with codesign.
I am working on releasing my macOS arm64 app. My problem is that after the user downloads the dmg, double-clicking my.app in the dmg, a Gatekeeper pop-up box will appear with a warning that the developer cannot be verified.
Question: Can an application signed with "com.apple.security.cs.disable-library-validation" be published as trusted?
If yes, what steps have I missed?
If not, can I get an official response from Apple?
(Because I referred to this post, it seems to mention that it is possible to publish trusted software.I have looked up similar questions on the forum and tried many things, but nothing works. )
Here are my steps:
Use the codesign to sign my.app. Because my app needs to access third-party dynamic libraries, entitlements.plist contains a "com.apple.security.cs.disable-library-validation". After the "codesign -dvvv" check, the signature was successful.✅
Use the "xcrun notarytool" command to notarize my app, and the status is displayed as accepted.✅
Use "xcrun stapler staple" to attach the notarization to my app, and it returns success.✅
Use the "spctl -a -v " command to verify whether my app has passed Gatekeeper, and it returns that it has passed.✅
Then I packaged my.app into a dmg, and then attached the notarization mark to the dmg, which was successful.✅
I completed the above steps and distributed the dmg. When I downloaded the dmg as a user test and double-clicked my.app in it, the Gatekeeper pop-up box still appeared, and the developer cannot be verified.❌
Hello,
I'm new at developing an ios app, but I have created a basic app, I plan to use just for me using xcode and the language swift.
I intend to use this app, to display a video and images on ipads that will be used as KIOS on a trade show. I don't need this app to be published on the app store as I intend to use it solely for my use.
Is there a way I can do something like this that won't be restricted with the 10 days restriction?
I learned xcode/swift as little as I could to create the app, but now I'm limited to the 10 days, and only 3 devices. Is there a way I can create an offline app, that doesn't have the all the restrictions? I plan to use these ipads over and over again on tradeshows to display my work.
Topic:
Code Signing
SubTopic:
General
Hi, I am a long time programmer in C#, and newer to Rust, and a rookie to MacOS 15.1.
Over the past few days I have made numerous attempts to run a Rust GUI binary that I compiled on Mac.
Here are some examples of things I have tried using.
Executable compiled in M1 mac not running on Apple Silicon Mac - help - The Rust Programming Language Forum
And here....
How to run unsigned apps in macOS 15.1
Also here... "sudo spctl --master-disable"
There are many more that I have tried.
I also tried moving the binary from my developer folder to the Application folder and running....
xattr -r -d com.apple.quarantine /Applications/csv
Note that "csv" is the name of my binary.
You have probably seen this 100 times, so can you point me to me to something that allows my Rust binaries to run under MacOS?
PS The Rust program code works just fine under Linux. I can either type Cargo Run and run the binary from the Terminal or go directly to the executable and double click on it to open the GUI application. The only thing that MacOS lets me do it open the GUI from the Terminal. Commander One says that I do not have the proper credentials to open the file directly. Finder also does not allow me to open the binary directly.
Thanks, Jim
from; tkinter; import *
from; tkinter; import ttk
import random
import time
import sqlite3
#Connect; to; the; database (create, if it doesnot exist)
conn = sqlite3.connect("quiz_database.db")
c = conn.cursor()
Create the table if it doesnot exist
c.execute(""'CREATE TABLE IF NOT EXISTS questions
(id INTEGER PRIMARY KEY AUTOINCREMENT,
question TEXT,
answer1 TEXT,
answer2 TEXT,
correct_answer INTEGER)""')
conn.commit()
Sample data (replace with your own questions)
sample_questions = [
("Is the Earth flat?", "True", "False", 2),
("Do birds fly?", "True", "False", 1),
("Is water wet?", "True", "False", 1),
("Can humans breathe underwater?", "True", "False", 2),
]
c.executemany("INSERT OR IGNORE INTO questions (question, answer1, answer2, correct_answer) VALUES (?, ?, ?, ?)", sample_questions)
conn.commit()
class QuizApp:
def init(self, master):
self.master = master
master.title("True/False Quiz")
# Initialize variables
self.questions = []
self.current_question = 0
self.score = 0
self.start_time = 0
self.time_limit = 60 # Time limit in seconds
# Get questions from the database
self.load_questions()
# Create GUI elements
self.question_label = Label(master, text="", font=("Arial", 16))
self.question_label.pack(pady=20)
self.true_button = Button(master, text="True", command=lambda: self.check_answer(1), width=15)
self.true_button.pack(side=LEFT, padx=10)
self.false_button = Button(master, text="False", command=lambda: self.check_answer(2), width=15)
self.false_button.pack(side=RIGHT, padx=10)
self.feedback_label = Label(master, text="", font=("Arial", 12))
self.feedback_label.pack(pady=10)
self.timer_label = Label(master, text="Time Left: 60s", font=("Arial", 12))
self.timer_label.pack()
self.progress_bar = ttk.Progressbar(master, orient=HORIZONTAL, length=200, mode="determinate")
self.progress_bar.pack(pady=10)
self.start_quiz()
def load_questions(self):
c.execute("SELECT * FROM questions")
self.questions = c.fetchall()
random.shuffle(self.questions)
def start_quiz(self):
self.start_time = time.time()
self.display_question()
self.update_timer()
def display_question(self):
if self.current_question < len(self.questions):
question = self.questions[self.current_question]
self.question_label.config(text=question[1]) # Display the question
self.progress_bar["maximum"] = len(self.questions)
self.progress_bar["value"] = self.current_question + 1 # Update progress bar
def check_answer(self, selected_answer):
correct_answer = self.questions[self.current_question][4]
if selected_answer == correct_answer:
self.feedback_label.config(text="Correct!", fg="green")
self.score += 1
else:
self.feedback_label.config(text="Incorrect!", fg="red")
self.current_question += 1
if self.current_question < len(self.questions):
self.display_question()
else:
self.end_quiz()
def update_timer(self):
elapsed_time = time.time() - self.start_time
remaining_time = self.time_limit - elapsed_time
if remaining_time > 0:
self.timer_label.config(text=f"Time Left: {int(remaining_time)}s")
self.master.after(1000, self.update_timer)
else:
self.end_quiz()
def end_quiz(self):
self.true_button.config(state=DISABLED)
self.false_button.config(state=DISABLED)
self.feedback_label.config(text=f"Quiz Over! Your score: {self.score}/{len(self.questions)}")
Run the application
root = Tk()
app = QuizApp(root)
root.mainloop()
Close the database connection
conn.close()
Topic:
Code Signing
SubTopic:
General
Hi,
I know my swiftui, but I'm completely new to macOS development. Using Xcode 16.2 I wrote a backup app that fits my needs. I got it to use iCloud Documents in its own container. It runs beautifully on my developing Mac.
When I copy it over to my other Mac and try to open it, I just get a message that macOS can't open the app ("Das Programm kann nicht geöffnet werden")
In terminal I get this message: "embedded provisioning profile not valid: file:///Users/niko/FlexBackup.app/Contents/embedded.provisionprofile error: Error Domain=CPProfileManager Code=-212 "Provisioning profile does not allow this device."
I have "automatically manage signing" turned on and a Xcode Managed Profile.
How can I run my app on all of y Macs?
Hi at all, is there a way to count how many files have been marked with the codesign? Thanks in advance
Topic:
Code Signing
SubTopic:
General
I'm having a problem with codesign for output from Pyinstaller
The files are in ~/PycharmProjects/ALP_Document_Factory_II
That folder contains the icon file, the entitlement file, and also contains a "dist" folder where Pyinstaller places the app file (ALP_Document_Factory_II.app)
The generated app works and runs when I double click it.
When I run codesign:
codesign -s xxxxxxxx -f --entitlements entitlements.plist -o runtime dist/ALP_Document_Factory_II.app
("xxxxxxx" is where I place the hash of my credential)
I get the following error message: No such file or directory
Here is the Terminal copy... minus my Hash
dickl45@Dicks-iMac3 ALP_Document_Factory_II % codesign -s xxxxxxxxxx -f --entitlements entitlements.plist -o runtime dist/ALP_Document_Factory_II.app
dist/ALP_Document_Factory_II.app: No such file or directory
Earlier I was able to use codesign and notarytool, but I must be doing something wrong that I can't see.
Yours baffled
MacOs 15.2
Hi,
For the purposes of iteration speed in development builds, on an iPhone in development mode, I am attempting to use hot reloaded dylibs. The goal is that the app is rarely fully restarted and small code changes can be applied quickly, drastically reducing iteration speed.
For this purpose I have a socket server on my Mac that sends changed dylibs to my app on my iPhone. This works great on Mac, however on iOS i am running into codesigning problems.
I am using the following to codesign the dylib:
codesign -f -s *** --timestamp=none testlibrary-ios.dylib
I am placing the downloaded dylib in this folder:
const char* cachedirectoryPath = [NSSearchPathForDirectoriesInDomains(NSCachesDirectory, NSUserDomainMask, YES)[0] UTF8String];
dlopen gives me the following error:
dlopen(/var/mobile/Containers/Data/Application/67A3D31B-6F72-4939-9E7F-665FC78CDC61/Library/Caches/testlibrary-ios.dylib, 0x000A): tried: '/usr/lib/system/introspection/testlibrary-ios.dylib' (no such file, not in dyld cache), '/var/mobile/Containers/Data/Application/67A3D31B-6F72-4939-9E7F-665FC78CDC61/Library/Caches/testlibrary-ios.dylib' (code signature invalid in <78A101AD-D756-3526-8754-8B7F4925DE90> '/private/var/mobile/Containers/Data/Application/67A3D31B-6F72-4939-9E7F-665FC78CDC61/Library/Caches/testlibrary-ios.dylib' (errno=1) sliceOffset=0x00000000, codeBlobOffset=0x0000C2E0, codeBlobSize=0x00004990),
....
Is loading a dylib like this on iPhones in development mode possible?
Any idea what is going wrong with codesigning or installing the dylib?
(Obviously this code is never deployed in an app that goes on the AppStore)
I am trying to code sign an application which relies on many python libraries to run. For background knowledge, the .app was created with a —onefile command on Visual Studio.
I code signed my application itself using
codesign --deep --force --verify --timestamp --sign "Developer ID Application: Issey Yohannes (GL5BCCW69X)" /Users/isseyyohannes/Desktop/Automated\ ALGORA.app
However, when I try to run the application the error shows in terminal as follows
[PYI-16345:ERROR] Failed to load Python shared library '/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python': dlopen: dlopen(/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python, 10): no suitable image found. Did find:
/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python: code signature in (/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python) not valid for use in process using Library Validation: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python: stat() failed with errno=1
Through some external tools, I was able to narrow the issue as follows
Hardened Runtime Restriction: Your application is attempting to load a shared library (Python) at runtime, but the library is either: Not properly signed with the same Team ID as your app. Not marked as a valid platform binary. macOS requires all loaded libraries to comply with its code-signing and runtime security policies.
Any insight is much appreciated.
Topic:
Code Signing
SubTopic:
General
I've noticed that NSTaks has this property as of macOS 14.4
@property (nullable, copy) NSData *launchRequirementData API_AVAILABLE(macos(14.4)) API_UNAVAILABLE(ios, watchos, tvos, visionos);
It has no documentation whatsoever. Even google search has no clue. Does this have anything to do with code signature requirements validation? Any explanations and examples would be appreciated!
I am using matlab to create an application (.app) using matlab application compiler.
Along with that, I use matlab to create an installer for that.
Unfortunately, the installer is in (.app) format. So do some custom things to install the dependencies and copying my application to Applications folder.
I am able to sign the original application with Developer ID application certificate.
But I am not able to sign the installer in .app format with Developer ID installer certificate.
Is there any flag in any signing executable that allows me to use Developer ID installer certificate to sign .app file instead of typical (.pkg/.dmg)?
Any help would be much appreciated.
Hi,
I have a project that integrates the Firebase SDK via SPM as a dependency of an internal Swift Package:
My app ⟶ My Library ⟶ Firebase SDK
The project builds successfully and can be archived locally ✅. The uploaded .ipa is valid and gets published 🚀.
However, we are now trying to automate the release process using Xcode Cloud, but the iOS Archive action is failing ❌ on Xcode Cloud.
The logs show the following error ⬇️:
error: exportArchive codesign command failed (/Volumes/workspace/tmp/XcodeDistPipeline/XcodeDistPipeline.~~~oomCvM/Root/Payload/base-ios.app/Frameworks/FirebaseAnalytics.framework: replacing existing signature
/Volumes/workspace/tmp/XcodeDistPipeline/XcodeDistPipeline.~~~oomCvM/Root/Payload/base-ios.app/Frameworks/FirebaseAnalytics.framework: invalid or corrupted code requirement(s)
Requirement syntax error(s):
line 1:178: unexpected token: <COMPANY_NAME>
)
** EXPORT FAILED **
I have been researching this issue for a while and have tried several solutions to fix it, but with no luck. Even though the error points to a specific library—the Firebase SDK—I don’t believe Firebase is the root cause. There were related issues in the past, but those were already fixed by the Firebase team, and as I mentioned, the project archives correctly when built locally.
On the other hand, the error states:
line 1:178: unexpected token: <COMPANY_ACRONYM>
This makes me wonder if there’s an issue parsing our Team Name during the re-signing process, as it contains special characters ":
"name": "Apple Distribution: Company Full Name "COMPANY_ACRONYM""
I have a .NET 6 application that runs in the background. The installer is a .pkg file built using a third-party tool called "Packages".
All .dylib and executable files are codesigned before packaging. The resulting .pkg file is notarized.
The app uses these entitlements:
com.apple.security.cs.allow-jit
com.apple.security.cs.allow-unsigned-executable-memory
com.apple.security.cs.allow-dyld-environment-variables
com.apple.security.cs.disable-library-validation
The app is built on a macbook Air 2015 running macOS 12.6 and it works without issues on that machine.
On a macbook Pro M3 running macOS 14.6.1 the app fails to run even though the installation itself is successful.
The only logs that I was able to find are related to syspolicyd (4 warnings):
Unable to apply protection to app: 45, PST: (vuid: A78FF6C2-08D5-4DCC-B946-8836251AA0E7), (objid: 1873967), (team: (null)), (id: (null)), (bundle_id: (null))
Failed to register app bundle for protection: 45, PST: (vuid: A78FF6C2-08D5-4DCC-B946-8836251AA0E7), (objid: 1873967), (team: (null)), (id: (null)), (bundle_id: (null))
scan failed, finishing evaluation : PST: (vuid: A78FF6C2-08D5-4DCC-B946-8836251AA0E7), (objid: 1873967), (team: (null)), (id: (null)), (bundle_id: (null))
Terminating process due to Gatekeeper rejection: 95158,
Unfortunately, verification commands such as
sudo codesign --verify --deep --strict -vvv MyApplication.App
spctl -a -vvv -t install MyApplicationInstaller.pkg
do not indicate any issues.
Are there any additional steps that need to be performed in order for my app to work properly on newer machines?