Error "Launch failed." after code signing with entitlements

The most common reason for this is that you’re using a restricted entitlement that’s not authorised by your profile. I talk about this in some detail in Resolving Trusted Execution Problems. A good place to start is to run syspolicy_check against your app.

When it comes to fixing this, I have two posts that explain how to sign code by hand:

• Creating Distribution-Signed Code for Mac

• Packaging Mac Software for Distribution

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

So I have read through the Creating Distribution-Signed Code for Mac and it better fits my example as I am trying to sign .app file with contents inside it. Here's the rough structure of the app:

test.app
└── Contents
    ├── CodeResources
    ├── Info.plist
    ├── MacOS
    │   └── test (Unix Executable File)
    ├── Resources
    │   └── icon.icns
    └── _CodeSignature
        └── CodeResources

When running the codesign -d -vv here's the output:

Executable=.../test.app/Contents/MacOS/test
Identifier=...
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20400 size=91065 flags=0x20002(adhoc,linker-signed) hashes=2842+0 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements=none

Since the test (exec) is a main executable, I think it is a bundle and therefore concluded:

| File        	| Bundle? 	| Main Exec 	|
|-------------	|---------	|-----------	|
| test (exec) 	| yes     	| yes       	|
| test.app    	| yes     	| yes       	|

so I need to add -o runtime and --entitlements when codesigning, here's my Info.plist (this is different to the one from the tree above):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
	<dict>
		<key>NSCameraUsageDescription</key>
		<string>camera access needed</string>
		<key>NSMicrophoneUsageDescription</key>
		<string>microphone access needed</string>
		<key>com.apple.security.device.audio-input</key>
		<true />
		<key>com.apple.security.device.camera</key>
		<true />
		<key>com.apple.security.device.microphone</key>
		<true />
	</dict>
</plist>

so I signed the executable first using the command below:

codesign --timestamp --verbose --sign "Developer ID Application" --options=runtime --entitlements Info.plist test.app/Contents/MacOS/test

but unfortunately I still have the error where the .app is not failing to launch. I have tried the below too:

• I tried using the Info.plist from the tree which is inside the .app but it gave an error saying 'invalid entitlements`
• I have tried without the --entitlements and -o runtime and it runs now but no permission popups and syspolicy_check shows its good to go.

fixed this by using a different entitlements file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.device.usb</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
    <key>com.apple.security.device.camera</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
  </dict>
</plist>

which works fine while signing and launches perfectly.