In my sandboxed MacOS app I want to access OSLogStore programmatically to fetch logs for multi-component application (app, libraries, deriver) for further analysis. According to the documentation, - https://developer.apple.com/documentation/oslog/oslogstore/3366102-local the app should have com.apple.logging.local-storeentitlement. I have added this entitlement "by hand" to the entitlement file as I I can't find a correspondent entry in the Xcode -> Sign & Capabilities interface. When I run the app, I get Unsatisfied entitlements: com.apple.logging.local-store error and the app doesn't start. If I remove the entitlement, the app can't get access to the logd subsystem. How can I add com.apple.logging.local-store to my app? Should I request this not visible via Xcode configuration UI from apple? Thanks!

Hi, My application doesn't start playback anymore after signing it with entitlements. <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.files.user-selected.read-only</key> <true/> <key>com.apple.security.device.audio-input</key> <true/> <key>com.apple.security.device.microphone</key> <true/> <key>com.apple.security.assets.music.read-write</key> <true/> <key>com.apple.security.network.server</key> <true/> </dict> </plist> regards, Joël

How to change Bundle ID in "Certificates, Identifiers & Profiles" (Edit your App ID Configuration) ? Which certificate is needed for a free Mac application (.app) ? The application need only save\restore disk data (no extension, no wifi, no In-App Purchase, etc). A very simple basic 3 windows application (type math Calculator). Do I need set some "Capabilities" (App Services) ?

Hi All, I submitted a Family Controls Request Form but haven't heard back. I didn't get any case id when I submitted the request, so how do you track it and know when It is approved? I'm currently developing an app that requires the main target and also the app extension to both use Family Controls. Does this mean I need to request forms for both app bundles separately or just the main app? This is really worrying for us as our project is almost ready and we are unable to launch it :( . Would appreciate any responses. Thanks,

Previously, we did Notarization with the help of altool, but it has now been decommissioned by Apple. We need to use the Notary tool for Notarization.
My application is not on App-store.So I tried storing credentials in the keychain, but encountered an error after providing all the details, including appleid, app-specific password, and teamid. it is showing this below error. Error: HTTP status code: 401. Unable to authenticate. The application is not allowed for primary authentication. Ensure that all authentication arguments are correct.
 We created app- specific password using the same Apple ID account which also has the certificates with which we are trying to Notarize our application. Initially, we were not able to access this Apple ID account because the employee that created this account has now left the organisation and we do not had enough information for access. We contacted apple and we got Alisas to original Apple ID account after that we were able to create app-specific password. We are not sure if this alias account access is affecting our issue or may be there is some particular setting that could affect the authorisation. Below are the complete info regarding the issue.
 mohd.faizan@KELLGGNLPTP1659 ~ % xcrun notarytool store-credentials --verbose --apple-id “XXXX" --password “YYYY” --team-id “ZZZZ” [11:32:40.047Z] Debug [MAIN] Running notarytool version: unknown (0), date: 2024-04-23T11:32:40Z, command: /Applications/Xcode.app/Contents/Developer/usr/bin/notarytool store-credentials --verbose --apple-id XXXX --password private --team-id ZZZZ This process stores your credentials securely in the Keychain. You reference these credentials later using a profile name. Profile name: NotaryProfile Validating your credentials... [11:32:48.390Z] Info [API] Initialized Notary API with base URL: https://appstoreconnect.apple.com/notary/v2/ [11:32:48.392Z] Info [API] Preparing GET request to URL: https://appstoreconnect.apple.com/notary/v2/test?, Parameters: [:], Custom Headers: private&lt;Dictionary&lt;String, String&gt;&gt; [11:32:48.393Z] Debug [AUTHENTICATION] Delaying current request to refresh app-specific password token. [11:32:48.393Z] Info [API] Preparing GET request to URL: https://appstoreconnect.apple.com/notary/v2/asp?, Parameters: [:], Custom Headers: private&lt;Dictionary&lt;String, String&gt;&gt; [11:32:48.394Z] Debug [AUTHENTICATION] Authenticating request to '/notary/v2/asp' with Basic Auth. Username: XXXX, Password: private, Team ID: ZZZZ [11:32:48.396Z] Debug [TASKMANAGER] Starting Task Manager loop to wait for asynchronous HTTP calls. [11:32:50.102Z] Debug [API] Received response status code: 401, message: unauthorized, URL: https://appstoreconnect.apple.com/notary/v2/asp?, Correlation Key: 5WDGB4XPJJAUCMTFMR6TUYYRPI [11:32:50.103Z] Error [TASKMANAGER] Completed Task with ID 2 has encountered an error. [11:32:50.103Z] Debug [TASKMANAGER] Ending Task Manager loop. Error: HTTP status code: 401. Unable to authenticate. The application is not allowed for primary authentication. Ensure that all authentication arguments are correct.


Can anyone help me in resolving this issue?  What steps do I need to take to fix this? Thanks in advance for the help.

I'm encountering a peculiar issue with my macOS installer application when hardened runtime is enabled (--options runtime) during code signing, and I'm hoping to get some guidance on how to resolve it. Issue Description: My installer application is designed to prompt users for system credentials upon launch. After entering the correct credentials and clicking "OK", users should see the next screen to proceed with the installation process. However, with hardened runtime enabled, the application stops responding after the credential entry step. The next screen, where users should proceed with installation, does not appear. If I codesign without using hardened runtime, my installer works fine. However it fails during notarization. What I've Tried: I have reviewed Apple's documentation on hardened runtime and notarization to ensure I'm following best practices. I've checked the Console logs for any relevant error messages or warnings, but haven't found any conclusive information. Additional Information: The application is an installer built using bitrock installbuilder. It relies on prompting users for system credentials using standard macOS authentication mechanisms. Initially the installer is in tar.gz format which I extract to get .app file. This file is codesigned. Next I create a .DMG of the codesigned .app file and codesign the DMG before sending it for notarization. Request for Assistance: I'm seeking guidance on how to address this issue with my installer application not proceeding after credential entry when hardened runtime is enabled. Are there any specific configurations, entitlements, or best practices that I might be missing? Or are there alternative approaches I should consider to ensure compatibility while still meeting Apple's security requirements for notarization? Any insights or advice from your experiences would be greatly appreciated. Thank you in advance for your help!

Hi, We have an app that installs a number of system extensions. According to this documentation the app must be located in the Applications folder to be activated so when the app launches we check that it is running from /Applications (or a subfolder) and if it isn't we inform the user and exit. This has been working fine until a recent submission whereupon installing the app via TestFlight casuses it to be translocated when run and our check to fail. So, a couple of questions: Is it expected that an app installed via TestFlight (or indeed the AppStore) can be translocated when it is run? If yes to the above, how can we ensure that out app is running from Applications and can therefore activate its extensions? Thanks Alan

[7268:372225] Failed to create an FPSandboxingURLWrapper for file:///Users/####/Downloads/mod##06-9-19.pdf. Error: Error Domain=NSPOSIXErrorDomain Code=1 "couldn't issue sandbox extension com.apple.app-sandbox.read-write for 'file:///Users/####/Downloads/mod##06-9-19.pdf' PS- Used ### to hide info I am facing an error with apple sandbox in my dot NET MAUI project here is the entitlements file I don't know Why I'm getting the in my understanding with user-selected.read-write it should work

Hi there :) We are trying to install our application from Xcode to an iPhone 14 Pro. After building the app, we need to go to General -> VPN & Device Management to trust the certificate. Unfortunately, the certificate is not showing on the iPhone, and we can not install the app. Does anyone know how we can solve this problem? Thank you very much in advance for your help!

Hello, I apologize for my poor English. Due to the discontinuation of the altool command line tool for notarizing client applications on Mac, we are transitioning from the altool command line to the notarytool command line. However, when attempting to add a profile to Keychain, the following command returns an error if the userID or password is incorrect: xcrun notarytool store-credentials "AC_PASSWORD" --apple-id "mailadress" --team-id "TEAMID" --password xxxx-xxxx-xxxx-xxxx Although the password and other credentials have been entered correctly multiple times, it is possible that a step is being missed. The current process is as follows: Belonging to the Apple Developer Program of the client. Generating an app-specific password from the apple ID account page with TEAMID. Adding a profile to Keychain with the above information using the notarytool command line, where the error occurs. If anyone has experience using the notarytool or has notarized Mac applications using an alternative method, any advice on the steps would be greatly appreciated. Thank you in advance.

I distribute an application in a zip file from my website. the application needs access to some files next to it to run properly. The application is correctly signed and notarized and stapled.Of course if I download it from my website, it gets the quarantine attribute. When I try to open it for the first time, a gatekeeper warning saying that the application comes from the internet, but has been checked by apple and no malware has been detected is displayed. My impression is that the application has been correctly signed and notarized. but If confirm that I wan to open it, the quarantine attribute is not deleted. spctl -a -v /path/to/Myapp.app path/to/Myapp.app: accepted source=Notarized Developer ID

I am building plug-ins for audio software. I am using the JUCE framework and I am building with VScode / CMake / Ninja / LLVM I want to package the output, which are two bundles "Sinensis.component" (the AU plugin) and "Sinensis.vst3" (the vst3 plugin) I am using this script : codesign -s "Developer ID Application: $DEVELOPER_ID" --timestamp --force -o runtime -i "$PLUGIN_NAME".component "$PLUGIN_NAME".component/Contents/MacOs/"$PLUGIN_NAME" #--options=runtime pkgbuild --install-location /Library/Audio/Plug-Ins/Components --sign "Developer ID Installer: $DEVELOPER_ID" --timestamp --identifier "$IDENTIFIER"au --version "$VERSION" --root "$PLUGIN_NAME".component "$PLUGIN_NAME"_au.pkg codesign -s "Developer ID Application: $DEVELOPER_ID" --timestamp --force -o runtime -i "$PLUGIN_NAME".vst3 "$PLUGIN_NAME".vst3/Contents/MacOs/"$PLUGIN_NAME" #--options=runtime pkgbuild --install-location /Library/Audio/Plug-Ins/VST3 --sign "Developer ID Installer: $DEVELOPER_ID" --timestamp --identifier "$IDENTIFIER"vst3 --version "$VERSION" --root "$PLUGIN_NAME".vst3 "$PLUGIN_NAME"_vst3.pkg productbuild --synthesize --package "$PLUGIN_NAME"_au.pkg --package "$PLUGIN_NAME"_vst3.pkg distribution.xml productbuild --distribution distribution.xml --resources Resources/ "$PLUGIN_NAME".pkg productsign --sign "Developer ID Installer: $DEVELOPER_ID" "$PLUGIN_NAME".pkg "$PLUGIN_NAME"_installer.pkg --timestamp xcrun notarytool submit --keychain-profile "thomas" "$PLUGIN_NAME"_installer.pkg --wait xcrun stapler staple "$PLUGIN_NAME"_installer.pkg feeding it distribute.sh Sinensis "Thomas Xxxxxx (<personal identifier>)" <indentifier for the package> 101 I am using --force because of a post on the juce forum that I strangely cannot link to here. tl;dr the binary is signed at the build stage and need --force to overwrite with my signature But it ends up with error 65 Conducting pre-submission checks for Sinensis_installer.pkg and initiating connection to the Apple notary service... Submission ID received   id: 38ba301b-f857-4408-b665-9e11e8647ca1 Upload progress: 100,00 % (6,10 MB of 6,10 MB)    Successfully uploaded file   id: 38ba301b-f857-4408-b665-9e11e8647ca1   path: /Users/thomas/Desktop/Sinensis_installer.pkg Waiting for processing to complete. Current status: Invalid............ Processing complete   id: 38ba301b-f857-4408-b665-9e11e8647ca1   status: Invalid Processing: /Users/thomas/Desktop/Sinensis_installer.pkg CloudKit query for Sinensis_installer.pkg (1/dc8136b4b82a4e9c9f7b5e6064238488e97f04ad) failed due to "Record not found". Could not find base64 encoded ticket in response for 1/dc8136b4b82a4e9c9f7b5e6064238488e97f04ad The staple and validate action failed! Error 65. Looking at the log via xcrun notarytool log return {   "logFormatVersion": 1,   "jobId": "75fa5853-d19d-42a5-9069-4ed0d8f735be",   "status": "Invalid",   "statusSummary": "Archive contains critical validation errors",   "statusCode": 4000,   "archiveFilename": "Sinensis_installer.pkg",   "uploadDate": "2024-04-19T10:11:07.372Z",   "sha256": "da6457f73d1b93995392f844a25f4b9bc9750eac0555ae72854b14e270e32685",   "ticketContents": null,   "issues": [     {       "severity": "error",       "code": null,       "path": "Sinensis_installer.pkg/Sinensis_au.pkg Contents/Payload/Library/Audio/Plug-Ins/Components/Contents/MacOS/Sinensis",       "message": "The signature of the binary is invalid.",       "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735",       "architecture": "arm64"     },     {       "severity": "error",       "code": null,       "path": "Sinensis_installer.pkg/Sinensis_vst3.pkg Contents/Payload/Library/Audio/Plug-Ins/VST3/Contents/MacOS/Sinensis",       "message": "The signature of the binary is invalid.",       "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735",       "architecture": "arm64"     }   ] } codesign -vvv --deep --strict Sinensis.vst3 returns Sinensis.vst3: valid on disk Sinensis.vst3: satisfies its Designated Requirement pkgutil --check-signature Sinensis_installer.pkg returns Package "Sinensis_installer.pkg": Status: signed by a developer certificate issued by Apple for distribution Signed with a trusted timestamp on: 2024-04-19 10:21:59 +0000 Certificate Chain: 1. Developer ID Installer: Thomas Guillory (53B2GD4XYM) Expires: 2027-02-01 22:12:15 +0000 SHA256 Fingerprint: E8 D7 4A 6D CD 19 56 A2 39 C9 15 00 09 06 EA 98 01 B0 AF 85 59 AA AE 26 71 89 56 9B 54 EF 48 B3 ------------------------------------------------------------------------ 2. Developer ID Certification Authority Expires: 2027-02-01 22:12:15 +0000 SHA256 Fingerprint: 7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03 F2 9C 88 CF B0 B1 BA 63 58 7F ------------------------------------------------------------------------ 3. Apple Root CA Expires: 2035-02-09 21:40:36 +0000 SHA256 Fingerprint: B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C 68 C5 BE 91 B5 A1 10 01 F0 24 I tried to unpack the .pkg using pacifist as recommended in multiple thread but the bundle wasn't recognized as such, I may have not follow the correct procedure. I've read the man page for productbuild, codesign and productsign. I've also read the MacOS code signing technical note althought I didn't understood everything clearly (especially on the nested part, which seems relevant). The closest thing I could find was this forum post but the bundles seems to be correctly seen by MacOs as a bundle and not as a folder I really lost at this point may Eskimo come shed some enlightenment on my poor newbie soul 🙏 Have a nice day !

I'm currently befuddled by the entire signing and certificate process. I don't understand what I need, what the team admin needs to do, or how to go about doing it so that I can build the project. We've managed to have this working in the past but I guess the system has changed somewhat. Here's what we have going: A Unity project which hasn't changed from a few years ago. I build the project in unity, open the Xcode project and this: There's an issue with the Signing and Capabilities. If I choose automatic setup it shows an error saying that it requires a development team. I had the account admin add my Apple ID to the team so I'm not sure why that's an issue still. Do I need to pay the 99$ to be able to building Xcode? If I try to do it manually I select the provisioning profile that the account admin sent me and it auto selects the team associated with the provisioning profile I guess but then there's no singing certificate. The error says: There is no signing certificate "iOS Development" found. No "iOS Development" signing certificate matching team ID "V7D5YBZRMV" with a private key was found. So, if someone could explain to me like I'm 5 the entire signing and certificate process is and let me know what we're doing wrong with the team/provisioning profile/certificate setup I would be very much appreciative.

Hi, I have added associated domains support for our desktop app and it works fine on my machine. But when I deploy it on other machines, it is not launching. It throws ‘The application ““ can’t be opened” message. It works fine when I install provisioning profile on those machines. Xcode is not allowing me to code sign the app manually as part of build process. Till now we were **** the same for other apps. Associated domain need a provisioning profile and I have created one distribution profile and code signed it. Now it works fine only on my machine and not working on other machines. It works only on other machines if I install provisioning profile. What should be the issue? How do I work this macOS app on other machines without installing provisioning profile?

I’m new to Mac packaging, and am confused by the multi-part signing and packaging process. I have built an app, using third party software, that I would like to upload to the Mac store for trial/testing purposes. I have joined the Apple Developers Programme, but am unsure whether I need to invest in third-party certification (e.g. Verisign) or can self-certify my app package. I would be obliged if someone would outline the sequence of steps that I need to follow to create a package that can be offered to users, and confirm whether my AD License is sufficient for me to follow same. Thanks in advance for any advice. Regards, L

I've added my iPhone's correct UDID in the "Devices" section in Apple Developer account, and I created a Development Profile. I then downloaded it (as a .mobileprovision file) and am trying to add it to my connected iPhone via XCode. I'm getting this error message: Failed to install one or more provisioning profiles on the device. Please ensure the provisioning profile is configured to this device. If not, please try to regenerate a new profile. I have ensured the provisioning profile is configured to this device and have tried regenerating it. Same result. My iPhone has "Developer Mode" turned on. How do I troubleshoot this further?

Hello, Can anybody help me with some info about the following situation? We have an app that is published in the store and it is used by the users. We want implement in the app the In App Provisioning flow and we are analyzing all the steps the we need to check. One of the steps is the request for a special entitlement from apple. Let's say that we've checked the following: Request In App Provisioning entitlement Receive the entitlement Create a new provisioning profile with the received entitlement Start the development of In App Provisioning flow in the app At some point a bug is identified in production and we need the develop a hotfix that needs to be published before finishing the In App Provisioning feature. Wil it be possible to publish a new version of the app that doesn't contain the In App Provisioning functionality even though we have received the entitlement from apple? Should we create a new provisioning profile without the entitlement for this new release? Please let me know if you need more info.

**Why does using CameraPicker require user authorization through a pop-up? ** Why don't ImagePicker or PhotoPicker require additional pop-up authorizations for accessing the photo library? All of these are implemented using UIImagePickerController, so why does one require a pop-up and the others do not? Additionally, I thought that by configuring the picker, I would theoretically not need any permissions. If permissions are still required, wouldn’t it make more sense to directly request camera permissions and utilize the native camera functionality? What then are the advantages of using the picker?

I have an app already uploaded to app store and its bundle id is service id not app id and i have an update with this app and when i tried to upload a new versions i found errors with bundle id registration and that is no Provisioning Profiles found for this bundle id so i tried to create new Provisioning Profiles with the service id that already connected with my app on app store connect and no luck to create Provisioning Profiles for service id and i cannot now upload a new updates

Hello, I am having some trouble with an application accessing and running SQlite database queries. The error I am getting is (5642) SQLITE_IOERR_SEEK when trying to sqlite_step_stement in the database. See https://www.sqlite.org/rescode.html#ioerr_seek A bit of background, it is an application in Unreal Engine, and everything was working fine in Unreal Engine 4. The application uses a SQlite database on disk to store and fetch data. This database is saved to the documents folder. (I also tried other folders to see if that would make a difference) But since switching to a new version of the engine, Unreal Engine 5, in a build I am getting errors when trying to read/write to the database. This only happens in a build .app file. The only big difference I can find is that in the new engine when making a build the codesigning is already done in the engine. I don't see why those settings would break anything though. It also has an entitlements file, but I also edited it and made sure it has the same entitlements settings as my own scripts that are run afterwards. I am overwriting the codesigning with our own CI/CD scripts afterwards. The .app file is codesigned, notarized and stapled by that script. Also I use an entitlements file to set certain values. It doesn't seem to be a code related issue, as everything is working fine when running the application "in editor". But only when creating a final .app build. It doesn't matter if this build is in Debug or Shipping. My first thought was to try more entitlements settings. But I tried the following and I am still getting the same errors: &lt;?xml version="1.0" encoding="UTF-8"?&gt; &lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt; &lt;plist version="1.0"&gt; &lt;dict&gt; &lt;key&gt;com.apple.security.cs.debugger&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.cs.disable-executable-page-protection&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.cs.disable-library-validation&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.automation.apple-events&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.app-sandbox&lt;/key&gt; &lt;false/&gt; &lt;key&gt;com.apple.security.cs.allow-dyld-environment-variables&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.cs.allow-jit&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.cs.allow-unsigned-executable-memory&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.files.downloads.read-write&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.network.client&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.network.server&lt;/key&gt; &lt;true/&gt; &lt;/dict&gt; &lt;/plist&gt; I also am thinking that it might be a different issue as the application is able to create a database file in the documents folder, just not able to do the read write inside the database. These values are just set to try if any of these settings "fix" the issue, but thus far no luck. As there is nothing I can find in Unreal Engine related forums, and I also do not have a lot of experience with all the options when making Mac builds. I was hoping someone on this forum could think of a reason why a .app file would have problems with reading and writing to a SQlite database.