When checking that a .dmg file is correctly stapled with the command
xcrun stapler validate -v file.dmg
I intermittently get errors like
Properties are {
NSURLIsDirectoryKey = 0;
NSURLIsPackageKey = 0;
NSURLIsSymbolicLinkKey = 0;
NSURLLocalizedTypeDescriptionKey = "Disk Image";
NSURLTypeIdentifierKey = "com.apple.disk-image-udif";
"_NSURLIsApplicationKey" = 0;
}
Codesign offset 0x1eb82c90 length: 15891
Stored Codesign length: 15891 number of blobs: 5
Total Length: 15891 Found blobs: 5
Props are {
cdhash = {length = 20, bytes = 0x07d207070853a23966374ae1b36e921148b3a5f3};
digestAlgorithm = 2;
flags = 73728;
secureTimestamp = "2024-07-26 06:08:31 +0000";
signingId = "SIGNED-file.dmg...
[ Message content over the limit has been removed. ]
}
Headers: {
"Content-Type" = "application/json";
}
Response is (null)
error is Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={_kCFStreamErrorCodeKey=-2102, NSUnderlyingError=0x6000012b4a80 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "(null)" UserInfo={_kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4}}, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask <82266119-065E-480C-B012-F30B48DB0F44>.<1>, _NSURLErrorRelatedURLSessionTaskErrorKey=(
"LocalDataTask <82266119-065E-480C-B012-F30B48DB0F44>.<1>"
), NSLocalizedDescription=The request timed out., NSErrorFailingURLStringKey=https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup, NSErrorFailingURLKey=https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup, _kCFStreamErrorDomainKey=4}
I am not able to pin down the cause of this, could it be rate limiting on the API?
Any other thoughts as to the cause?
Thanks.
General
RSS for tagDemystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.
Post
Replies
Boosts
Views
Activity
Hi,
I am a developer and app manager using a personal account. I am encountering an issue where the automatic signing feature in Xcode is not working, and I receive the error message: "Signing for 'Runner' requires a development team." Additionally, I cannot access the "Certificates, Identifiers & Profiles" section, even though I have already added my account to Xcode.
How can I fix this issue? Is it possible to run or upload the app without this signing process?
I am developing a PCIDriverKit dext, and testing on Sequoia Beta (Version 15.0 Beta, 24A5298h). Both the dext and the "owning" application build on Xcode 16.0 beta 4. I can run the owning application and register the dext.
When the OS attempts to load the dext, though, code signing validation errors occur:
2024-07-30 15:54:02.386 Df kernel[0:ae6a] Driver com.company.Dext-Loader.dext has crashed 0 time(s)
2024-07-30 15:54:02.386 Df kernel[0:ae6a] DK: Dext_Loader_Driver-0x100001464 waiting for server com.company.Dext-Loader.dext-100001464
2024-07-30 15:54:02.388 Df kernelmanagerd[112:abb5] Found 1 dexts with bundle identifier com.company.Dext-Loader.dext
2024-07-30 15:54:02.388 Df kernelmanagerd[112:abb5] Using unique id a0cf49ca3ea45f5d54a3e8644e2dde6b0e8666c649c1e9513ca4166919038b53 to pick dext matching bundle identifier com.company.Dext-Loader.dext
2024-07-30 15:54:02.388 Df kernelmanagerd[112:abb5] Picked matching dext for bundle identifier com.company.Dext-Loader.dext: Dext com.company.Dext-Loader.dext v34 in executable dext bundle com.company.Dext-Loader.dext at /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext
2024-07-30 15:54:02.389 I kernel[0:ae71] igmp_domifreattach: reattached igmp_ifinfo for ifp XHC
2024-07-30 15:54:02.389 I kernel[0:ae71] mld_domifreattach: reattached mld_ifinfo for ifp XHC2
2024-07-30 15:54:02.389 Df kernelmanagerd[112:abb5] DextRecordTable read from plist: {
com.company.Dext-Loader.dext:
MRS-> Optional(( path: /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext; state: loaded ))
history-> [
( path: /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext; state: loaded )
]
}
2024-07-30 15:54:02.389 Df kernelmanagerd[112:abb5] Launching dext com.company.Dext-Loader.dext com.company.Dext-Loader.dext 0x100001464 a0cf49ca3ea45f5d54a3e8644e2dde6b0e8666c649c1e9513ca4166919038b53
2024-07-30 15:54:02.390 I kernelmanagerd[112:abb5] [com.apple.km:DextLaunch] Skipping addBreadcrumbForDextWithIdentifier for <private> 0
2024-07-30 15:54:02.389 Df kernel[0:ae71] ifnet_attach: Waiting for all kernel threads created for interface XHC2 to get scheduled at least once.
2024-07-30 15:54:02.389 Df kernel[0:ae71] ifnet_attach: All kernel threads created for interface XHC2 have been scheduled at least once. Proceeding.
2024-07-30 15:54:02.390 Df kernelmanagerd[112:abb5] Launching driver extension: Dext com.company.Dext-Loader.dext v34 in executable dext bundle com.company.Dext-Loader.dext at /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext
2024-07-30 15:54:02.479 E kernel[0:a9fb] (Sandbox) 1 duplicate report for Sandbox: imagent(633) deny(1) mach-lookup com.apple.contactsd.persistence
2024-07-30 15:54:02.479 E kernel[0:a9fb] (Sandbox) Sandbox: taskgated-helper(2985) deny(1) user-preference-read kCFPreferencesAnyApplication
2024-07-30 15:54:02.483 Df kernel[0:ae73] (AppleMobileFileIntegrity) AMFI: code signature validation failed.
2024-07-30 15:54:02.483 Df kernel[0:ae73] (AppleMobileFileIntegrity) AMFI: bailing out because of restricted entitlements.
2024-07-30 15:54:02.483 Df kernel[0:ae73] (AppleMobileFileIntegrity) AMFI: When validating /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext/com.company.Dext-Loader.dext:
Code has restricted entitlements, but the validation of its code signature failed.
Unsatisfied Entitlements:
2024-07-30 15:54:02.483 Df kernel[0:ae73] mac_vnode_check_signature: /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext/com.company.Dext-Loader.dext: code signature validation failed fatally: When validating /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext/com.company.Dext-Loader.dext:
Code has restricted entitlements, but the validation of its code signature failed.
Unsatisfied Entitlements:
2024-07-30 15:54:02.483 Df kernel[0:ae73] validation of code signature failed through MACF policy: 1
2024-07-30 15:54:02.483 Df kernel[0:ae73] check_signature[pid: 2984]: error = 1
2024-07-30 15:54:02.483 Df kernel[0:ae73] proc 2984: load code signature error 4 for file "com.company.Dext-Loader.dext"
2024-07-30 15:54:02.485 Df kernelmanagerd[112:abb5] [com.apple.libxpc.OSLaunchdJob:all] <OSLaunchdJob | handle=46B92B57-A90A-4EBD-8EF4-54313C6EE332>: submitAndStart completed, info=spawn failed, error=162: Codesigning issue
2024-07-30 15:54:02.483 Df kernel[0:ae73] (Sandbox) /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext/com.company.Dext-Loader.dext[2984] ==> com.apple.dext
2024-07-30 15:54:02.485 E kernelmanagerd[112:abb5] [com.apple.libxpc.OSLaunchdJob:all] <OSLaunchdJob | handle=46B92B57-A90A-4EBD-8EF4-54313C6EE332>: job failed to spawn, plist={
ProcessType => Driver
_ManagedBy => com.apple.kernelmanagerd
CFBundleIdentifier => com.company.Dext-Loader.dext
_JetsamPropertiesIdentifier => com.company.Dext-Loader.dext
LimitLoadToSessionType => System
_DextCheckInPort => <mach send right: 0xbd486ccc0> { name = 15679, right = send, urefs = 2 }
UserName => _driverkit
_NullBootstrapPort => true
ReslideSharedCache => false
LaunchOnlyOnce => true
Label => com.company.Dext-Loader.dext-0x100001464
RunAtLoad => true
ProgramArguments => [<capacity = 8>
0: /Library/SystemExtensions/B1BF8CDC-CB24-4F25-A8CA-D7A60D814861/com.company.Dext-Loader.dext.dext/com.company.Dext-Loader.dext
1: com.company.Dext-Loader.dext
2: 0x100001464
3: com.company.Dext-Loader.dext
]
SandboxProfile => com.apple.dext
}
The Xcode project uses these signing options:
Automatically manage signing
Team: Company
Provisioning Profile: Xcode Managed Profile
Signing Certificate: Apple Development: ()
The same project, with the same signing options, builds and loads its dext without issues from Xcode 15.3 on Sonoma 14.5. That same dext binary from Xcode 15.3 loads and passes the signature checks on Sequoia, but using Xcode on Sequoia is when the signature validation fails.
Can anyone suggest a way to resolve these signature validation errors? (Other than just developing on Sonoma and testing on Sequoia?)
Hi,
When postinstall tries to run another binary inside the ./scripts folder I package with pkgbuild, it gets killed by taskgated when the postinstall script tries to run it.
└── Contents
├── Helpers
├── Info.plist
├── MacOS
│ ├── UI
│ └──Worker
├── PkgInfo
├── Resources
│ ├── com.ui.plist
│ ├── com.worker.plist
│ └── icon.icns
├── _CodeSignature
│ └── CodeResources
└── embedded.provisionprofile
scripts:
├── token_installer
├── postinstall
├── token_installer
├── postinstall
How I am signing:
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force out/myapp.app/Contents/MacOS/UI
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force out/myapp.app/Contents/MacOS/Worker
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force ./scripts/token_installer
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force ./scripts/postinstall
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force out/myapp.app
echo "pkgbuilding..."
pkgbuild --root ./out/myapp.app --sign "$DEVELOPER_ID" --identifier com.myapp.app --version 1.0 --install-location /Applications/myapp.app --scripts ./scripts ./out/myapp.pkg
echo "productbuilding..."
# productbuild --distribution ./Distribution.xml --package-path ./out/myapp.pkg --resources . ./out/MyAppInstaller.pkg
productbuild --product requirements.plist --distribution ./Distribution.xml --package-path ./out/myapp.pkg --resources . ./out/MyAppInstaller.pkg
productsign --sign "Developer ID Installer: My Company Inc (***)" --force ./out/MyAppInstaller.pkg ./out/MyAppInstallerSigned.pkg
Sidenote: all binaries that are not the main executable, UI, get killed by taskgated, but I figured I will wrap the Worker in its own app Inside Helpers. I just do not see the point in doing that for the token_installer, since it should only be called once ever, during postinstall.
Is there a way to make it run without having to include it in the app bundle itself?
Build issue when creating an Apple Watch standalone app archive
This is an Apple Watch standalone app. (Without an iPhone app)
Even if you create an Apple Watch standalone app as a new project in Xcode, two targets are created: "iPhone target + Apple Watch target".
The iPhone target cannot be built or modified.
Usually, builds or archives are created with the Apple Watch target.
It's been a while since I updated the app, so I tried to fix it, add new features, and update it.
When I created an archive, the version kept being created as 1.0 - 1.
I entered 1.1 - 8 for the Apple Watch target.
In the previous Xcode version, when I clearly modified the version and build version of the Apple Watch target, it was reflected in the archive file.
However, in the current Xcode, it is not reflected.
Does anyone know how we can fix this issue?
I facing issue where the system extension i try to install have message:
no related kext found for sysex 'com.apple.usbsoundriver'
com.apple.usbsoundriver:extension failed to validate! uninstalling...
uninstalling invalid extension com.apple.usbsoundriver
Is internet access is required for system extension validation? I install the driver without internet access.
This work in some others machine, only fresh reformated Mac machine without internet connection have this issue. Why is this so?
I don't know why we’re up to Xcode 16 and this stuff is still so damn difficult.
First of all, I don't know why I can't just send a .app I built for my M1 MacBook Pro to my friend who also has an M1 MacBook Pro. But even after going through the quarantine steps, he gets an alert saying the app can't be opened.
So I'm trying to do direct distribution of an archive. But that gives me two errors:
There is a problem with the request entity
You already have a current Developer ID Application Managed (With Kext) certificate or a pending certificate request.
No profiles for 'com.latencyzero.VideoBox' were found
Xcode couldn't find any Developer ID provisioning profiles matching 'com.latencyzero.VideoBox'.
The signing is managed by Xcode. CloudKit access works.
Hi,
I'm trying to upload my electron app to the App Store.
The app uploads fine to App Store Connect but runs into the following problem while processing:
Unable to Sign. This package doesn't meet the current code signing requirements. For more information, see the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html and Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html Specifically, codesign generated the following errors: [ com.electron.easy-csl-electron.pkg/Payload/easy-csl-electron.app: resource fork, Finder information, or similar detritus not allowed] (90303)
Getting to this point was already a real challenge. I'm trying to use electron forge and submit my package to the App Store for which to my knowledge doesn't exist any guide at all.
So I'm kinda stuck here: I don't know what "resource fork, Finder information, or similar detritus" is and where it came from and when I search the Internet for this problem I can't find any way to solve it. I tried reading the documentation links provided but I have no idea where to even start :/
Would anybody be able to help me?
Thanks,
Ludwig
Helo, I'm trying to upload my React Native App to test with TestFlight but in the archives when I validate the app I received the following error:
Missing signing identifier at "/var/folders/72/pp85df852gxbzn51b2b34blw0000gn/T/XcodeDistPipeline.~~~PCbJ98/Root/Payload/
Failed to cloud sign "/var/folders/72/pp85df852gxbzn51b2b34blw0000gn/T/XcodeDistPipeline.~~~PCbJ98/Root/Payload/Click+". Please file a bug report at https://feedbackassistant.apple.com.
Hi again, experts
I have a problem :D
My app craseh on startup, when creating it in AppStore Mode and I have absolutely no idea, why.
The only difference betweed my Developer-ID-Mode and AppStore-Mode is, tha differnet certificates are used and a tool runs, that does something with the info.plist.
(and the stapler tool, that runs in devID-Mode, is of course not used in appstore-mode)
Here is, what I do, when creating the binary:
/usr/bin/plutil -convert binary1 "/Users/me/somewhere/myapp.app/Contents/Info.plist"
(the above line is not used in Dev-ID-Mode)
/usr/bin/codesign --entitlements "/Users/me/somewhere/myapp.entitlements" --deep -s "DeveloperAppCert" -f "/Users/me/somewhere/hansimaticoffice.app"
/usr/bin/productbuild --component "/Users/me/somewhere/hansimaticoffice.app" "/Applications" --sign "MacDeveloperInstallerCert" "/Users/me/somewhere/hansimaticoffice.pkg"
Any hint?
I have a security agent plugin that uses NSXPCConnection to communicate with a launch daemon. This works well, but I want to make sure the launch daemon has not been compromised. I added code to call setCodeSigningRequirement in my module that handles the client side of the NSXPCConnection. However, when used in the security agent plugin, remoteObjectProxyWithErrorHandler reports an error
NSCocoaErrorDomain Code=4102 "The code signature requirement failed."
If I call my xpc module from a test application, I do not receive an error and everything works as expected. I have tried different code signing requirements. Even with just "anchor apple generic" I still get the error.
The console log shows two entries of interest
com.apple.SecurityAgentHelper.arm64 default 09:13:29.677567-0500 SecurityAgentHelper-arm64 EOGSecurityServiceClient biometricAuthorization remote proxy error: Error Domain=NSCocoaErrorDomain Code=4102 "The code signature requirement failed." UserInfo={NSDebugDescription=The code signature requirement failed.}
I have been having this problem since xcode cloud came out, it is a shame that this tool cannot be used, I have this problem that xcode cloud always fails to form the code, I have already tried deleting the xcode cloud certificates.
Invalid Signature. Code failed to satisfy specified code requirement(s). The file at path “MyApp.app/MyApp” is not properly signed. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate. Verify that the code signing settings in Xcode are correct at the target level (which override any values at the project level). Additionally, make sure the bundle you are uploading was built using a Release target in Xcode, not a Simulator target. If you are certain your code signing settings are correct, choose “Clean All” in Xcode, delete the “build” directory in the Finder, and rebuild your release target. For more information, please consult https://developer.apple.com/support/code-signing.
multiprocessing.Queue() method of python getting "PermissionError: [Errno 1] Operation not permitted" error if it is sandboxed:
CODE:
import multiprocessing
tensorflow_coordinates_queue = multiprocessing.Queue()
ERROR:
./test_temp9
Traceback (most recent call last):
File "/Applications/test_temp9.app/Contents/MacOS/test_temp9.py", line 4, in <module>
File "/Applications/test_temp9.app/Contents/MacOS/multiprocessing/context.py", line 103, in Queue
File "/Applications/test_temp9.app/Contents/MacOS/multiprocessing/queues.py", line 43, in __init__
File "/Applications/test_temp9.app/Contents/MacOS/multiprocessing/context.py", line 68, in Lock
File "/Applications/test_temp9.app/Contents/MacOS/multiprocessing/synchronize.py", line 162, in __init__
File "/Applications/test_temp9.app/Contents/MacOS/multiprocessing/synchronize.py", line 57, in __init__
PermissionError: [Errno 1] Operation not permitted
BUNDELED WITH NUITKA:
echo *** | sudo -S python3.9 -m nuitka --run --standalone --macos-disable-console --macos-create-app-bundle --macos-app-mode=ui-element --enable-plugin=pyside6 --macos-app-icon=icons/app_icon.png --include-data-dir=icons=icons test_temp9.py
SIGNED WITH FOLLOWING SH:
sign.txt
sign2.txt
ENTITLEMENTS:
app.entitlements.txt
I am having an issue when archiving in Jenkins. The log says:
SignatureCollection /Users/***/Library/Developer/Xcode/DerivedData/***/Build/Intermediates.noindex/ArchiveIntermediates/***/BuildProductsPath/Release-iphoneos/Some.xcframework-ios.signature
error: signature-collection failed: The operation couldn't be completed. (XCBUtil.CodeSignatureInfo.Error error 0.)
I am able to build and archive without any issue locally.
I first built WordPuzzleAids over 2 years ago. I built it on my MacBook Pro, using Xcode and Swift. The destination for the build was my iPhone. Two weeks ago, the app stopped working on the iPhone: I thought I might need to rebuild it on the on the MacBook and "re-deliver" it to the iPhone. The build failed with:
CodeSign /Users/paddy/Library/Developer/Xcode/DerivedData/WordPuzzleAids-dnwilitxxdvpzablseyseujsllag/Build/Products/Debug-iphoneos/WordPuzzleAids.app (in target 'WordPuzzleAids' from project 'WordPuzzleAids')
cd /Users/paddy/Projects/ThirdParty/WordPuzzleAids
Signing Identity: "Apple Development: John Patterson (G9M8AH9CTD)"
Provisioning Profile: "iOS Team Provisioning Profile: *"
(650d11d4-ecd2-4458-a146-3cb55438e9dc)
/usr/bin/codesign --force --sign 1FC4588FA2EAD7DCF9AAC9CDC823B567D76BCBE8 --entitlements /Users/paddy/Library/Developer/Xcode/DerivedData/WordPuzzleAids-dnwilitxxdvpzablseyseujsllag/Build/Intermediates.noindex/WordPuzzleAids.build/Debug-iphoneos/WordPuzzleAids.build/WordPuzzleAids.app.xcent --timestamp\=none --generate-entitlement-der /Users/paddy/Library/Developer/Xcode/DerivedData/WordPuzzleAids-dnwilitxxdvpzablseyseujsllag/Build/Products/Debug-iphoneos/WordPuzzleAids.app
/Users/paddy/Library/Developer/Xcode/DerivedData/WordPuzzleAids-dnwilitxxdvpzablseyseujsllag/Build/Products/Debug-iphoneos/WordPuzzleAids.app: errSecInternalComp
I have attached the build documentation file
Build WordPuzzleAids_2024-08-29T21-17-09.txt
I'm trying to sign an app to run locally because development provisioning does not work for unspecified reasons.
I'm adding NSAllowsLocalNetworking to the app transport security section of the entitlements and the result is that the selection to sign the app locally vanishes from the signing section in Xcode.
I need to access a local web application which does not provide HTTPS.
I'm not only very confused about this but actually pretty ******. Is this once again Apple playing games for absolutely no reason?
Why can't I build and run an application on my system that does not have to do anything with Apple, the app store, customers or anything?
This is just for me and I cannot make it work.
I am a developer working on iOS apps.
I would like to report an issue occurring in iOS 18 beta and iOS 18.1 beta.
Our company has two Enterprise accounts, and we are developing two apps:
A app / TeamId: ABCDEFG
B app / TeamId: HIJKLMN
When we distribute these apps, which have different TeamIds, and install them on a device running iOS 18 beta,
both apps install successfully, but only one app will run.
(Other app crashed immediately after being launched.)
This issue does not occur on versions prior to iOS 18.
I would like to know if this is a problem that will be resolved in future updates, or if it is a policy change.
PLATFORM AND VERSION
macOS
Development environment: Other: Python
Run-time configuration: macOS 14.6.1
DESCRIPTION OF PROBLEM
We have created application using python and created .app using pyInstaller. We want to get the location access using python based application which we are trying to run on MacOS 14.6.1. Without including NSLocationUsageDescription in our info.plist, it is working fine but not getting location permission pop up. After including NSLocationUsageDescription in info.plist application got corrupted.
STEPS TO REPRODUCE
We are using below commands to sign the application
codesign --force -s "Developer ID Application: Pitney Bowes (72NX38Y9GF)" -v DeviceHub.app --deep --strict --options=runtime --entitlements ../info.plist DeviceHub.app
ditto -c -k --keepParent --rsrc --sequesterRsrc --arch 'x86_64' DeviceHub.app DeviceHub.zip
xcrun notarytool submit DeviceHub.zip --keychain-profile "DHAgentProfile" --wait
xcrun stapler staple DeviceHub.app
We have developed an electron app which we want to extend with an action extension. The action extension is written in swift in Xcode. Our plan was to build the .appex file and insert it into the PlugIns folder in our electron app, but I don't think this is the right way to do it?
If we insert the .appex file before notarization then we get an error that we are "replacing existing signature".
If we manually insert it after the notarization then we get an error with the app is damaged and can’t be opened.
Can anybody provide a procedure for this kind of merge I would imagine that it goes something like:
Sign app
Sign extension
Add extension to App
Notarize app
For signing the app we use electron-builder.
Hi,
I've developed an application which reside under /Applications.
Inside the main application bundle (/Applications/mainApp.app) there are sub-app that contain security extension. Here's the relevant path
/Applications/mainApp.app/Contents/Helpers/subApp.app/Contents/Library/SystemExtensions/com.myComp.type.systemextension/
So far I could load the extension by running the subApp and make sure it calls the extension activation API. but seems like starting from Sonoma (i'm using version 14.6.1 )it stopped working, and I get crash dump on signature failure which trying to open the subApp.app.
in the crash log I get reason of invalid code sign. I also get the following hints
Binary Images:
0x1050a0000 - 0x10512bfff dyld_path_missing (*) <f635824e-318b-3f0c-842c-c369737f2b68> /dyld_path_missing
0x104d9c000 - 0x104d9ffff main_executable_path_missing (*) <1df5f408-cb16-304f-8b38-226e29361161> /main_executable_path_missing
Is it possible that new OS version have new validation rule that enforce something about the location of the app that can start extensions ?