Demystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.

All subtopics
Posts under Code Signing topic

Post

Replies

Boosts

Views

Activity

When starting a process on macOS Sequoia, it gets terminated by the kernel.
I have an executable file named infogodesk, located in the directory /usr/local/SmpAgent/rustdesk/infogodesk. When I execute it using the terminal with ./infogodesk, the process gets terminated by the kernel. However, if I move the executable to another directory, it works fine. This issue is very frustrating, and I hope to get some help. Below is the console log output: 默认 11:26:28.162205+0800 kernel ASP: Validation category (6) does not match top-level policy match (3) for process: /usr/local/SmpAgent/rustdesk/infogodesk 默认 11:26:28.162211+0800 kernel Validation category policy: Notifying syspolicyd about /usr/local/SmpAgent/rustdesk/infogodesk with PID 88264 默认 11:26:28.166695+0800 kernel CODE SIGNING: cs_invalid_page(0x104e04000): p=88264[infogodesk] final status 0x23000200, denying page sending SIGKILL 默认 11:26:28.166698+0800 kernel CODE SIGNING: process 88264[infogodesk]: rejecting invalid page at address 0x104e04000 from offset 0x0 in file "/usr/local/SmpAgent/rustdesk/infogodesk" (cs_mtime:1734509326.0 == mtime:1734509326.0) (depth:0) 默认 11:26:28.166738+0800 kernel infogodesk[88264] Corpse allowed 1 of 5 默认 11:26:28.255182+0800 ReportCrash ASI found [ReportCrash] (sensitive) 'Pid 88264 'infogodesk' CORPSE: Extracting Completed 1, Recent: Pid 86766 'ReportCrash' CORPSE' 默认 11:26:28.261619+0800 ReportCrash ASI found [ReportCrash] (sensitive) 'Pid 88264 'infogodesk' CORPSE: Extracting Completed 1, Recent: Pid 86767 'ReportCrash' CORPSE'
Topic: Code Signing SubTopic: General
1
0
466
Dec ’24
missing entitlements with fastlane
hi I am using fastlane and match to upload an app to test flight. The app requires com.apple.developer.storekit.external-link.account to be activated. My identifier has activated the capabilities and when I look at provisional profile, it also has it, but when the app has been uploaded, it's missing (although all other entitlements are there). Now it gets weird: Every time I run my flow I delete derived data, deletes all downloaded provisional profiles and use match to redownload them with read only (force is not an option). It does not work. I go to Apple dev and Toggles the capability off and on and saves. This invalidates the profile. I press edit and save. So no real changes. Run my flow and the app is uploaded correctly WITH the correct capabilities. Runs the flow again without the manual steps and the entitlements will be missing once again. Repeats the toggle stuff and the subsequent behavior repeats itself. Same flow and same code and same settings, app and profile.... I am building automated flows so this does not really work for me.... Heeeelp...
1
0
687
Dec ’24
Please help
I just made a TikTok account accidentally using my Apple ID I’m trying to delete the account and the only way to delete it is to put this code in I don’t know where to look for the code and apparently it was sent to my private relay.appleid.com.
1
0
395
Dec ’24
App Fails to Launch on Another Mac with Error -10810 After Codesign and Notarization
I exported an app from an Xcode project using the "Archive" feature. After signing and notarizing it, the app runs normally on my local machine. However, after packaging it with create-dmg or ditto and distributing it to another Mac, I get an error saying the application cannot run. When I execute the command open ***.app in Terminal, it shows _LSOpenURLsWithCompletionHandler() failed for the application /Applications/Maxi PC Suite.app with error -10810. Does anyone know why this is happening? codesign and notarization info: codesign -vvv Maxi\ PC\ Suite.app ...... Maxi PC Suite.app: valid on disk Maxi PC Suite.app: satisfies its Designated Requirement syspolicy_check distribution Maxi\ PC\ Suite.app App passed all pre-distribution checks and is ready for distribution.
Topic: Code Signing SubTopic: General
1
1
462
Dec ’24
Importing .developerprofile from xcode 15 -> 16?
I am trying out the new xcode 16, and am trying to sign some existing apps. I have a .developerprofile from xcode 15. But I cannot find a way to import it (I think I need the private certs, in order to sign an app). There is no "import" button at the bottom of the Accounts tab, within the xcode Accounts Settings.... Is there any other way (e.g: Terminal) to import an existing .developerprofile into xcode? Or am I missing something?
8
2
2.5k
Dec ’24
Notarization still in progress after almost 3 hours
My app has been attempting to notarize for almost 3 hours now. The status page shows everything is ok: https://developer.apple.com/system-status/ Anyone else experiencing this? Anything I can do to expedite the process? xcrun notarytool history Successfully received submission history. history -------------------------------------------------- createdDate: 2024-12-29T01:20:45.358Z id: 449ebcdd-60eb-41e3-87a7-8107fe6276c3 name: Scourhead.zip status: In Progress -------------------------------------------------- createdDate: 2024-12-29T00:51:10.641Z id: 0054eebd-ddcc-4eb3-928f-86ce2182dbfe name: Scourhead.zip status: In Progress
6
2
671
Dec ’24
Notarization issue with keys
Keys can vary; an account is not necessary, as only Team Keys are suitable for notarization. It seems that Developer role is sufficient for notarization. We have tried both keys and roles of Developer and Account Manager - the behavior is the same. Multiline There are two types of API keys: Team Access to all apps, with varying levels of access based on selected roles. Individual Access and roles of the associated user. Individual kevs aren't able to use Provisioning endpoints, access Sales and Finance, or notaryTool. BlockQuote Here are the parameters used for notarization via API key: `-k, --key key-path    App Store Connect API key. File system path to the private key. -d, --key-id key-id    App Store Connect API Key ID. For most teams this will be a 10 character alphanumeric string. -i, --issuer issuer    App Store Connect API Issuer ID. The issuer ID is a UUID format string.` The notarization result shows as successful, and on the same machine, the package appears as notarized. However, when the package is transferred to another system, it is displayed as not notarized.
11
0
683
Dec ’24
Electron Builder Notarization Issue
I'm having issues with notarizing my Electron app using electron-builder. The build process works, but notarization gets hung up on submitting to Apple. Versions electron: 33.2.1 electron-builder: 24.9.1 @electron/notarize: 2.3.2 macOS runner: macos-latest Current Setup Using GitHub Actions for CI/CD Developer ID Application certificate is properly installed and verified Apple ID credentials are confirmed working (verified via altool) Notarization is configured in both package.json and build arguments Logs 2024-12-29T18:56:37.198Z electron-notarize:spawn spawning cmd: xcrun args: [ '--find', 'notarytool' ] opts: {} 2024-12-29T18:56:38.652Z electron-notarize:spawn cmd xcrun terminated with code: 0 2024-12-29T18:56:38.653Z electron-notarize:notarytool starting notarize process for app: /Users/runner/work/***/***/dist/mac-arm64/***.app 2024-12-29T18:56:38.653Z electron-notarize:helpers doing work inside temp dir: /var/folders/95/0ydz4d79163427j3k5crp3fh0000gn/T/electron-notarize-KxNa7e 2024-12-29T18:56:38.653Z electron-notarize:notarytool zipping application to: /var/folders/95/0ydz4d79163427j3k5crp3fh0000gn/T/electron-notarize-KxNa7e/***.zip 2024-12-29T18:56:38.654Z electron-notarize:spawn spawning cmd: ditto args: [ '-c', '-k', '--sequesterRsrc', '--keepParent', '***.app', '/var/folders/95/0ydz4d79163427j3k5crp3fh0000gn/T/electron-notarize-KxNa7e/***.zip' ] opts: { cwd: '/Users/runner/work/***/***/dist/mac-arm64' } 2024-12-29T18:56:47.906Z electron-notarize:spawn cmd ditto terminated with code: 0 2024-12-29T18:56:47.906Z electron-notarize:notarytool zip succeeded, attempting to upload to Apple 2024-12-29T18:56:47.906Z electron-notarize:spawn spawning cmd: xcrun args: [ 'notarytool', 'submit', '/var/folders/95/0ydz4d79163427j3k5crp3fh0000gn/T/electron-notarize-KxNa7e/***.zip', '--apple-id', '*********', '--password', '*********', '--team-id', '*********', '--wait', '--output-format', 'json' ] opts: {} This is the farthest I've been able to get after pushing through many errors.. I set a timeout of 3 hours and this will now be my 4th time attempting I believe. Configuration package.json json "mac": { "hardenedRuntime": true, "gatekeeperAssess": false, "entitlements": "build/entitlements.mac.plist", "entitlementsInherit": "build/entitlements.mac.plist", "notarize": { "teamId": "APPLE_TEAM_ID WAS MANUALLY PUT HERE AFTER ISSUES WITH SECRETS" } } GitHub Actions Workflow Using samuelmeuli/action-electron-builder@v1 with proper environment variables for APPLE_ID, APPLE_TEAM_ID, and APPLE_APP_SPECIFIC_PASSWORD. What I've Tried Verified Apple Developer account access and Team ID Confirmed certificate installation works Tested credentials using altool (successfully lists providers) Added explicit notarization environment variables Any help would be appreciated!
2
3
478
Dec ’24
Family Control Request Form
I am writing to follow up on my request for Family Control permission, which I submitted through the appropriate form over a week ago. Unfortunately, I have not yet received any response or access to the requested permissions. Could you kindly provide an update on the status of my request? If any further information or action is needed from my end, please let me know.
0
0
363
Dec ’24
can anybody fix this code
from; tkinter; import * from; tkinter; import ttk import random import time import sqlite3 #Connect; to; the; database (create, if it doesnot exist) conn = sqlite3.connect("quiz_database.db") c = conn.cursor() Create the table if it doesnot exist c.execute(""'CREATE TABLE IF NOT EXISTS questions (id INTEGER PRIMARY KEY AUTOINCREMENT, question TEXT, answer1 TEXT, answer2 TEXT, correct_answer INTEGER)""') conn.commit() Sample data (replace with your own questions) sample_questions = [ ("Is the Earth flat?", "True", "False", 2), ("Do birds fly?", "True", "False", 1), ("Is water wet?", "True", "False", 1), ("Can humans breathe underwater?", "True", "False", 2), ] c.executemany("INSERT OR IGNORE INTO questions (question, answer1, answer2, correct_answer) VALUES (?, ?, ?, ?)", sample_questions) conn.commit() class QuizApp: def init(self, master): self.master = master master.title("True/False Quiz") # Initialize variables self.questions = [] self.current_question = 0 self.score = 0 self.start_time = 0 self.time_limit = 60 # Time limit in seconds # Get questions from the database self.load_questions() # Create GUI elements self.question_label = Label(master, text="", font=("Arial", 16)) self.question_label.pack(pady=20) self.true_button = Button(master, text="True", command=lambda: self.check_answer(1), width=15) self.true_button.pack(side=LEFT, padx=10) self.false_button = Button(master, text="False", command=lambda: self.check_answer(2), width=15) self.false_button.pack(side=RIGHT, padx=10) self.feedback_label = Label(master, text="", font=("Arial", 12)) self.feedback_label.pack(pady=10) self.timer_label = Label(master, text="Time Left: 60s", font=("Arial", 12)) self.timer_label.pack() self.progress_bar = ttk.Progressbar(master, orient=HORIZONTAL, length=200, mode="determinate") self.progress_bar.pack(pady=10) self.start_quiz() def load_questions(self): c.execute("SELECT * FROM questions") self.questions = c.fetchall() random.shuffle(self.questions) def start_quiz(self): self.start_time = time.time() self.display_question() self.update_timer() def display_question(self): if self.current_question < len(self.questions): question = self.questions[self.current_question] self.question_label.config(text=question[1]) # Display the question self.progress_bar["maximum"] = len(self.questions) self.progress_bar["value"] = self.current_question + 1 # Update progress bar def check_answer(self, selected_answer): correct_answer = self.questions[self.current_question][4] if selected_answer == correct_answer: self.feedback_label.config(text="Correct!", fg="green") self.score += 1 else: self.feedback_label.config(text="Incorrect!", fg="red") self.current_question += 1 if self.current_question < len(self.questions): self.display_question() else: self.end_quiz() def update_timer(self): elapsed_time = time.time() - self.start_time remaining_time = self.time_limit - elapsed_time if remaining_time > 0: self.timer_label.config(text=f"Time Left: {int(remaining_time)}s") self.master.after(1000, self.update_timer) else: self.end_quiz() def end_quiz(self): self.true_button.config(state=DISABLED) self.false_button.config(state=DISABLED) self.feedback_label.config(text=f"Quiz Over! Your score: {self.score}/{len(self.questions)}") Run the application root = Tk() app = QuizApp(root) root.mainloop() Close the database connection conn.close()
Topic: Code Signing SubTopic: General
1
0
368
Dec ’24
Disappearing External link account entitlement
I've got a Flutter app that is a “reader” app. The External Link Account Entitlement has already been requested and granted. It is already added as an Additional Capability to the App ID. The com.apple.developer.storekit.external-link.account entitlement is already present in the .entitlements file. Also SKExternalLinkAccount key is added to the Info.plist file with the correct URL. ExternalLinkAccount.open() is invoked via a MethodChannel call handler and things work perfectly in debug mode. The modal appears as expected and opens the link in the external browser. Xcode archive is also sucessful and the entitlement seems to be in place when inspecting the app with: codesign -d --entitlements :- ./path/to/app But when trying to distribute the app via Xcode the entitlement disappears. Other entitlements are not affected by this issue, eg.: com.apple.developer.associated-domains for universal links. This happens with automatically managed singing and a manually selected provisioning profile as well. When inspecting the latter in Xcode the necessary capability and entitlement is included. But when distributing to App Store Connect the entitlement disappears with both recommended and custom settings. I ran flutter clean mulitple times. What am I missing here?
3
1
758
Jan ’25
Need Apple Developer Support to assign unique Team Names to my Enterprise and Organization memberships
We have two memberships under the same account (Enterprise and Organization) and that both share the same Team Name, which is causing issues in iOS 18. as per latest email get from Apple regarding security update in iOS 18. How can i get unique Team Names to my Enterprise and Organization memberships. Where should i have to connect? Who can help ?
1
0
481
Jan ’25
Codesign dylib/framework with entitlements
Is it correct to codesign dylib/framewoks with entitlements? My understanding is that only executables need to have the entitlement and the dylibs loaded in that process will automatically inherit those entitlements. However, I am seeing a lot of scripts on the internet that are signing dylibs as well with entitlements. For eg - # sign *.dylibs find "$APP_BUNDLE" -type f -name "*.dylib" -exec codesign --deep --force --verify --verbose --timestamp --options runtime --entitlements "$ENTITLEMENTS_FILE" --sign "$SIGNING_IDENTITY" {} \; Is this even allowed? I know of at least one app that has passed notarization checks as well. If allowed, can a dylib have more entitlements than the process that loaded it?
2
0
899
Jan ’25
Electron Builder is getting stuck on Signing DMG
Hello Team, I am building an Electron app and building platform-related installers line exe, appimage and dmg. To build an installer, I am using the electron builder library. When I do code signing and notarization, the signing process gets stuck without any error. I have verified certificate and other information are correct. Below are more details. Versions @electron/notarize": "^2.5.0 @electron/rebuild": "3.3.0 electron": "26.2.1 electron-builder": "^25.1.8 electron-devtools-installer": "3.2.0 Current Setup CircleCI pipeline Developer ID Application certificate is properly installed and verified Notarization is configured in both package.json and build arguments I see the last log as below where it gets stuck without any error. • selecting signing options file=release/build/mac-arm64/xxxx Assistant.app entitlements=assets/entitlements.mac.plist hardenedRuntime=true timestamp=http://timestamp.apple.com/ts01 requirements=undefined additionalArguments=[] Package.json "build": { "productName": "xxxxx - Your AI Work xxxxx", "executableName": "xxxx xxxxx", "artifactName": "xxxxx-Assistant-${version}-${arch}.${ext}", "appId": "org.erb.xxxx", "asar": true, "asarUnpack": "**\\*.{node,dll}", "files": [ "dist", "node_modules", "package.json", "assets/tray.ico", "!**/*.lproj/**/*", "!**/locale.pak", "!locales/**/*" ], "afterSign": ".erb/scripts/notarize.js", "mac": { "timestamp": "http://timestamp.apple.com/ts01", "identity": "xxxxx Technology Inc (xxxxxxxx)", "target": [ "dmg", "zip" ], "electronLanguages": [ "en-US" ], "icon": "build/mac-icon/Logo512x512.icns", "type": "distribution", "hardenedRuntime": true, "entitlements": "assets/entitlements.mac.plist", "entitlementsInherit": "assets/entitlements.mac.plist", "gatekeeperAssess": false }, "dmg": { "icon": "build/mac-icon/xxxxxxLogo512x512.icns", "contents": [ { "x": 130, "y": 220 }, { "x": 410, "y": 220, "type": "link", "path": "/Applications" } ] }, "directories": { "app": "release/app", "buildResources": "assets", "output": "release/build" }, "extraResources": [ "./assets/**" ] } Entitlement <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <!-- Required for Electron/Chromium JIT --> <key>com.apple.security.cs.allow-jit</key> <true/> <!-- Required for basic Electron functionality --> <key>com.apple.security.inherit</key> <true/> <!-- Required for network communication (REST APIs) --> <key>com.apple.security.network.client</key> <true/> </dict> </plist> I have made the following verification. I already tried on multiple macos with different processors. Verified on a high-speed network. Certificate is exported to .p12 and verified. All Env Variables are set with the correct value. (APPLE_APP_SPECIFIC_PASSWORD+APPLE_ID+APPLE_TEAM_ID ) I have tried with CSC_LINK/CSC_KEY_PASSWORD + Keystore as well. Appriciate any help.
3
2
936
Jan ’25
xcode unable to find app store provisioning profile in command line build
Hi, I am trying to make my app build on GitHub Action CI pipeline. App builds fine on xcode on my mac. For CI I am using command line xcode. I am getting following error: No profiles for 'com.snslocation.electricians-now' were found: Xcode couldn't find any iOS App Development provisioning profiles matching 'com.snslocation.electricians-now'. Automatic signing is disabled and unable to generate a profile. To enable automatic signing, pass -allowProvisioningUpdates to xcodebuild. (in target 'myapp' from project 'myapp') You can see full log of the build here: https://github.com/nbulatovi/ElectriciansNow/actions/runs/12603115423/job/35127512689 The provisioning profile is present, and verified in the previous steps in the pipeline, however xcode refuses to find it. If I add -allowProvisioningUpdates error stays. I tried manually mapping app id to profile name. Is there a way to get any debug log from xcode profile search, to see why is it not picking up the correct profile? Or can you maybe help in some other way? xcode version is 15.4, iOS SDK 17.5
0
0
622
Jan ’25
Pushkit not listed in Identifiers->Capabilities
I get the error message in Xcode signing certificate Provisioning profile "iOS Team Provisioning Profile: com.example.app" doesn't include the pushkit entitlement. I have push notifications ticked in my Identifier in the online developer account. There is no other dedicated pushkit capability available to select. Push notifications, time sensitive notifications and background mode-> voice over ip are added as capabilities in the Xcode project. The team provisioning profile for the app states under its enabled capabilities: both push notifications and time sensitive notifications. Is pushkit part of another capability that I need to select? I have read the guide below and it just says to add the push notification capability. https://developer.apple.com/documentation/pushkit/supporting-pushkit-notifications-in-your-app I have gone round and round in circles trying to get this profile to work for this, so any pointers would be much appreciated. Thanks
1
0
559
Jan ’25