I’ve got a run of the mill Drag&Drop DMG installer. It works as expected when the drop target is /Applications. However I deliver plugins which I want to be copy to somewhere below /Library/Aplication Support/. Here too, everything works fine until I upload and download the dmg to my webserver. Now when dropping the plugins onto the target alias they just slide back. No error, no dialog asking for permissions, no nothing… just silently sliding back. And I haven’t the faintest idea how to address this. Would somebody please be my hero of the day and point me into the right direction, pretty please?
The plugins and the dmg are codesigned and notarized. They work as expected when moving them to the plugins folder directly. It’s only the alias that will not work. The alias btw. is a soft link created using ln - s.
Not sure this is the right category to post in. But it feels like it’s a probably a permission/entitlements issue.
General
RSS for tagDemystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.
Post
Replies
Boosts
Views
Activity
I'm new to iOS development so forgive me if this question sounds naive. I have an iPhone 15 Pro currently registered to a coworker but I would like to test my apps on that iPhone when he is not working on it. In order for me to test on that phone, do I need to wipe that iPhone and re-register under my name? Is there anyway to switch between accounts on the iPhone?
Hi,
I want to resign my app with a different certificate. Is it possible to keep the entitlements (including com.apple.application-identifier)? I want to resign the whole app including the plugins and frameworks, but I saw --deep was considered harmful.
Sorry, I'm a bit confused. Any help would be appreciated.
I have an XPC service that embeds Python. It executes a python script on behalf of the main app.
The app and xpc service are sandboxed. All seems to work just fine in the development environment but the script fails in the released version.
I disabled writing pycache by setting the PYTHONDONTWRITEBYTECODE environment variable because pycache tries to write inside my app bundle which fails (I believe I can redirect the pycache directory with PYTHONPYCACHEPREFIX and may experiment with that later).
Specifically this line fails in the release version only (not from Xcode):
PyObject *pModule = PyImport_Import(moduleNameHere);
if (pModuleOwnedRef == NULL)
{
// this is null in release mode only.
}
Any ideas what can be going wrong? Thanks in advance.
Hi, I'm shipping a GUI app based on Golang outside App Store distribution, for the distribution, I have already sign and notarize the .App and the .Pkg installer, now there is a feature called self-update on my app which basically
app check if there is any update
the same program request a sudo access to rewrite current binary file content
the program will restart after the update completed
Now, I have already sign the updated binary via signing and notarization process, and I take the compiled Golang binary inside Content/MacOS to be used for self-update proses
but it doesn't work as expected, the updated binary are fail to run with error "Can't open the app" or if we try to call it on CLI, it will show "Killed 9"
what did I'm missing? thankyou
Hi,
If anyone can please advise -- If signing a framework inside a XCFramework is recommended/mandatory?
I'm trying to use XPC communicate between a command line tool (launched from Terminal) and a macOS application. My code currently works when the app is launched from Xcode, but not if I launch the built app from the command line (open path-to-foo.app) or if I try and distribute the packaged application (via "Development" distribution). Notably, the XPC works if the command line tool is launched from the terminal as long as the app itself is launched from Xcode.
I publish the XPC service using NSXPCListener(machServiceName: <team-identifier>.com.example.my-app.service) and connect to it using NSXPCConnection(machServiceName: machServiceName). Both my command line tool and my main app identical "app group" entitlements for $(TeamIdentifierPrefix)com.example.my-app and I verified the team identifier substitution was correct in both the app and command line tool after doing distributing for "App Store", exporting, unpacking the pkg and running codesign as described here: https://developer.apple.com/documentation/xcode/embedding-a-helper-tool-in-a-sandboxed-app
I've developed a mobile app in Visual Studio 2022 on Windows 11 on the MAUI platform. I'm Pair to a remote Mac machine to test/debug on an iOS Simulator. I was previously able to test on the remote mac machine simulator with not problems. I added some features including Geolocation and now I get the following error:
error MSB6006: "codesign" exited with code 3.
These are the last few lines in the Output window:
1> [xma][info]: Starting remote task execution for 'TriStar.Mobile.DriverPortal': Xamarin.MacDev.Tasks.CodesignVerify
1> [xma][info]: Sending Request Xamarin.Messaging.Build.Contracts.ExecuteTaskMessage to topic xvs/build/17.2.8053/execute-task/TriStar.Mobile.DriverPortal/8f2f6e4002fCodesignVerify
1> [xma][info]: Received Response of Xamarin.Messaging.Build.Contracts.ExecuteTaskMessage to topic build2424827232benbl/+/xvs/build/17.2.8053/execute-task/TriStar.Mobile.DriverPortal/8f2f6e4002fCodesignVerify
1> CodesignVerify: 2024-05-31T17:36:08.1417751-05:00 - Logging messages
1> Environment Variables passed to tool:
1> CODESIGN_ALLOCATE=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate
1> /usr/bin/codesign --verify -vvvv "-R=anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.1] exists and (certificate leaf[field.1.2.840.113635.100.6.1.2] exists or certificate leaf[field.1.2.840.113635.100.6.1.4] exists)" bin/Debug/net8.0-ios/iossimulator-arm64//TriStar.Mobile.DriverPortal.app
1> bin/Debug/net8.0-ios/iossimulator-arm64//TriStar.Mobile.DriverPortal.app: valid on disk
1> bin/Debug/net8.0-ios/iossimulator-arm64//TriStar.Mobile.DriverPortal.app: satisfies its Designated Requirement
1> test-requirement: code failed to satisfy specified code requirement(s)
1> C:\Program Files\dotnet\packs\Microsoft.iOS.Sdk\17.2.8053\tools\msbuild\iOS\Xamarin.Shared.targets(2059,3): error MSB6006: "codesign" exited with code 3.
Is there a problem or conflict with my entitlements?
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
</dict>
The remote Mac is a Mac-In-Cloud running xCode 15.3 and Visual Studio 2022.
My dev machine is running Windows 11 and VS 2022
In my Windows VS MAUI project I have
<PropertyGroup Condition="'$(TargetFramework)'=='net8.0-ios'">
<EnableCodeSigning>true</EnableCodeSigning>
<CodesignKey>Apple Development: BENJAMIN BLA... (7AGK....)</CodesignKey>
<ProvisioningType>automatic</ProvisioningType>
<CodesignProvision>VS: com.tristarfreightsys.driverportal Development</CodesignProvision>
</PropertyGroup>
VS: com.tristarfreightsys.driverportal Development is the Provisioning Profile automatically generated by VS.
My Development Certiifcate and Distrubution Cert are in the Mac Keychain and in my VS
I encountered a signature issue, codesign -f -s "Developer ID Application: ***" /Users/leagsoft/Desktop/uninstall
/Users/leagsoft/Desktop/uninstall: replacing existing signature
Warning: unable to build chain to self-signed root for signer "Developer ID Application:***"
/Users/uninstall: errSecInternalComponent
but using Sodu can sign normally
Summary
We have a .net 8 application that consists of 2 components, a GUI app and a launch daemon. The .pkg file for the GUI app is created by Visual Studio, and this .pkg is then bundled with the launch daemon into one installer using the packagesbuild utility.
The problem we're facing is that our customer's MDM system is refusing to install the app because of a missing lock icon in the installer, which makes it look as if the app was not signed even though it is (shown on the right in the image below).
Installer package contents
The .pkg file created by packagesbuild contains the GUI app .pkg file shown on the left in the image above, signing of this file is handled by the .net build process.
It also contains two third party .dylib files (one for intel, the other for arm), which are re-signed with the following command:
codesign --sign "Developer ID Application: [...]" \
--force --options runtime --no-strict \
"<file-path>"
The launch daemon is build with .net and then signed using this command:
codesign --sign "Developer ID Application: [...]" \
--force --options runtime --no-strict \
--entitlements "<entitlements-path>" \
"<file-path>"
I don't know if it's relevant, but there are also several .plist and .json files.
Final package signing
The .pkg file created by packagesbuild is signed using:
productsign --sign "Developer ID Installer: [...]" \
--cert "Developer ID Installer: [...]" \
"com.optimidoc.cloudclient.pkg" \
"com.optimidoc.cloudclientsigned.pkg"
After signing, the package is notarised with xcrun notarytool.
Both the signing and notarisation finish without error, which I've validated by running pkgutil --check-signature "<file-path>"
Package "com.optimidoc.cloudclientsigned.pkg":
Status: signed by a developer certificate issued by Apple for distribution
Notarization: trusted by the Apple notary service
Signed with a trusted timestamp on: 2024-06-13 11:41:57 +0000
Certificate Chain:
1. Developer ID Installer: OptimiDoc s.r.o. (2YMBVCM8TM)
Expires: 2028-03-01 07:37:30 +0000
SHA256 Fingerprint:
02 E2 C1 A0 06 E1 C1 A2 FF 70 BD CD A5 47 43 B2 DB CF 62 BB 6D D4
90 69 3E 7C C8 A7 29 73 7D 69
------------------------------------------------------------------------
2. Developer ID Certification Authority
Expires: 2031-09-17 00:00:00 +0000
SHA256 Fingerprint:
F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F
D1 44 71 5F 35 06 43 D2 DF 3A
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
SHA256 Fingerprint:
B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
68 C5 BE 91 B5 A1 10 01 F0 24
What I've tried
I played around with the signing process for a few days but I was unable to figure out where the installer UI gets the certificate information from.
I've tried limiting the files included in the final .pkg file. First I tried only including the GUI app .pkg with a known good signature. I also tried only including the launch daemon executables. All to no avail.
In regard to the packagesbuild utility, I noticed the --identity option, but at the moment I'm stuck with an "unknown error" message:
The command is:
packagesbuild "com.optimidoc.cloudclient.pkgproj" -v \
--identity "Developer ID Installer: [...]" \
--keychain "/Library/Keychains/System.keychain"
And the output I get is:
Building Project (11:56:49) at path: [...]
------------------------------------------------------------------------------
Build Folder (done)
Package "com.optimidoc.cloudclient"
Payload
Assemble file hierarchy (done)
Split forks (done)
Create bill of material (done)
Create pax archive (done)
Scripts
Assemble file hierarchy (done)
Split forks (done)
Create pax archive (done)
PackageInfo (done)
Create xar archive
==============================================================================
ERROR:
Description:
Unknow Error
==============================================================================
Build Failed
I think the --identity option is the way forward, but I don't know how to debug the "unknown error" message. I've sunk a few days into this problem already, so any help would be greatly appreciated. I'll update the post if I have any news.
Hello, I've just got a new computer and now I want to transfer my developer account (certificates, keys etc.) to the new computer. Right now my developer membership has expired since I'm not doing any apps right now, but I might start again in the future.
I'm not sure if I need to transfer anything, or if I will just get new certificates and keys when (if) I restart my membership?
What do I need do, before I reset my old computer? I have developed apps for both for iOS and macOS.
A few hours ago my app could be loaded , built and run without a problem. Now, after opening the app again with Xcode I get the message
Command CodeSign failed with a nonzero exit code
The app cannot be built. I don't know how to solve this problem.
Please, can anyone help?
Best regards
Gerhard
1) The situation in general:
1A) I begun USB-DExt project for Mac & iPADsOS>=17.
1B) I started-from scratch with
DriverKitSampleApp
1C) For these two different targets (Mac,iPAD; using IDE XCode15.0), I couldn't find another way to build the sample project from Apple, beside this: now I have two handmade sets of ini-profiles and two respective "command-files".
2) My current palliative solution comprises of two specific ~"command-files" (each one runs in a directory with specific DriverKitSampleApp.entitlements,project.pbxproj)_ :
2A) my current file "cpy.command" for target "MAC"
## Destination "Mac"
## DriverKitSampleApp.entitlements: "com.apple.developer.driverkit.userclient-access"
## item0: "com.ry.dexsample1.driver"
## Build Settings "DriverKitSampleApp":Signing:Code Signing Identity:"Sign to Run Locally"
## "NullDriver":Signing:Code Signing Identity:"Sign to Run Locally"
## "NullDriver":"AD_HOC_CODE_SIGNING_ALLOWED=YES"
cp DriverKitSampleApp.entitlements ../DriverKitSampleApp
cp project.pbxproj ../RyDExtSmpl1.xcodeproj
2B) my current file ~"cpy.command" for target "iPAD"
## Destination "iPAD"
## Build Settings "DriverKitSampleApp":Signing:Code Signing Identity:"Apple Development"
## "NullDriver":Signing:Code Signing Identity:"Apple Development"
## "NullDriver":"AD_HOC_CODE_SIGNING_ALLOWED=NO"
cp DriverKitSampleApp.entitlements ../DriverKitSampleApp
cp project.pbxproj ../RyDExtSmpl1.xcodeproj
2C) This state is inconvenient (predicting that I will switch between MAC and iPAD dozens thousands of times when debugging this project)
3) The question
3A) I need to build the Apple's sample project "DriverKitSampleApp" just selecting one of two possible targets (Mac,iPad) in XCode-IDE.
3B) Option1: what developer(or team's entitlements) do I need for "3A"?
3C) Option2: what adjustments of project's configuration files do I need for "3A"? .
My dev Acct expired. I renewed, now when trying run/load the app from Xcode onto my phone, it complains that it's not registered or there's no cert. (sorry, don't have it with me right now to get the actual text)
Instructions say to look at VPN & Device Mgt, but the info it says is not there.
Hi,
I am trying to release a small application which bundles a conda environment and a python script. I am using Platypus to turn it into a .app, and I include all necessary resources (libraries, binaries etc) inside the Resources directory. My application works correctly before code signing, and is portable between machines (so I don't think it is the case that the conda environment is missing something). However, after signing, it crashes when it runs one of the programs within the conda environment.
I am first signing all .so, .dylib and all files in conda_env/bin as follows:
# Within the conda environment directory in Resources
find bin -type f | xargs -n1 codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)"
find . -name "*.dylib" -o -name "*.so" -type f | xargs -n1 codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)"
I am then signing the .app itself
codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)" my_app.app
Finally, I convert it into a .dmg (with appdmg) and sign that.
codesign -f --sign "Developer ID Application: Whatever (123456789)" --timestamp my_app.dmg
I submit to the notary service, which succeeds, and then I staple the ticket to the .dmg:
xcrun notarytool submit my_app.dmg --keychain-profile my_notarytool_keychain_id --wait
xcrun stapler staple my_app.dmg
spcl is happy with the signed .app and .dmg and accepts them both.
spctl -a -vv my_app.app
# my_app.app: accepted
# source=Notarized Developer ID
# origin=Whatever (123456789)
spctl -a -vv -t install my_app.dmg
# my_app.dmg: accepted
# source=Notarized Developer ID
# origin=Whatever (123456789)
I have a valid Developer Application ID. All good, right?
Except, during execution, the signed .app crashes. When I look in the Console, the error log always looks similar - something like:
Exception Type: EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid))
Termination Reason: Namespace CODESIGNING, Code 2 Invalid Page
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 libsystem_platform.dylib 0x186e15848 sys_icache_invalidate + 40
1 libllvmlite.dylib 0x2a022f8e8 llvm::sys::Memory::protectMappedMemory(llvm::sys::MemoryBlock const&, unsigned int) + 384
2 libllvmlite.dylib 0x29d765528 LLVMPY_TryAllocateExecutableMemory + 92
3 libffi.8.dylib 0x103abc04c ffi_call_SYSV + 76
etc
I think all the .dylib, .so, and binaries are signed in my codesign scripts, except for the libsystem_platform.dylib mentioned in the first line of the log. Could this be the problem?
How can I find if I am not signing something that is being used? Are there other types of files that I should be signing that I am missing?
I've been trying to fix this for several days and I feel I have tried everything (constructing the conda env in different ways, signing in different ways, e.g. with/without --deep, with/without signing each type of library/binary) to no avail... Any help would be greatly appreciated!
All the best,
George
Getting this error on iOS 17.5.1
not sure how to solve it
I've been given an Xcode project which produces a command line tool which links to a dylib. I have the dylib, but not its source code.
I change the signing option for the command line tool target so it is signed automatically by my personal team.
On an attempt to run the tool, it fails to load the dylib, because the dylib is signed with a different certificate. I manually codesign the dylib with the same certificate I am using for the command line app.
Now, I can build the app, but not run it. If I try to do so, I see four dialogs telling me “libXXX.dylib” can’t be opened because Apple cannot check it for malicious software, then the console tells me "'/path/to/libXXX.dylib' not valid for use in process: library load disallowed by system policy)"
I found an old document about Gatekeeper (https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html) which suggests that Gatekeeper just won't let me do this - I can't just put the dylib next to the executable, although the dynamic linker finds the dylib, Gatekeeper doesn't like it because the dylib isn't inside the app bundle (there is none), and isn't in one of the well-known places.
I dealt with this by making a do-nothing app which I can sign with my personal certificate. Then I replace the signature on the dylib (and its dependent dylibs) with my own. I add the command line tool and all its dylib dependencies to the do-nothing app, then add those files into the Copy Bundle Resources phase of the do-nothing app.
Now, the command line tool and its dylibs all live in do-nothing.app/Contents/Resources, and I can run the tool from there without Gatekeeper complaining.
Is there an easier way (aside from asking my supplier for static libraries)? And if this is the only way, is Contents/Resources the right place to put command line tools and the dylibs they link to?
I need help, when I run code without a sandbox it works well. however, when I enabled it, it gave me (Thread 3: "launch path not accessible")!
How can I fix that?
let task = Process()
task.launchPath = "/Users/alielzieny/Documents/TerrierSectraFix/TerrierSectraFix/Frameworks/python3"
task.arguments = ["/Users/alielzieny/Documents/TerrierSectraFix/TerrierSectraFix/SectraFix.py", selectedDirectoryURL.path, destinationDirectoryURL.path]
let pipe = Pipe()
task.standardOutput = pipe
task.launch()
task.waitUntilExit()
let data = pipe.fileHandleForReading.readDataToEndOfFile()
if let output = String(data: data, encoding: .utf8) {
print(output)
}
Hi,
I am trying to create a new Identifier for my app. When I write down the Bundle ID I am getting this popup:
An attribute in the provided entity has invalid value
An App ID with Identifier 'de.{domain}.app is not available. Please enter a different string.
Can anyone please help? The domain is mine and no apps have been released yet. I can't find a solution for this
I got the python app notarized and downloaded it fine.
However, if you are caught by Gatekeeper and open the information window, you will see a lock and even if you enter the password to open the lock, it will not work.
xattr -d com.apple.quarantine ./test.app
You have to exclude it from the gatekeeper directly.
I wonder if the downloaded app is unavoidable... or if there is another way.