Post not yet marked as solved
Context : I'm developing a python app with Tkinter GUI on a 2020 M1 Macbook Air.
I have already built, signed, and notarized the app successfully on the native arm64 architecture - so far so good.
Now I am trying to do the same for x86_64, on the same machine. I've built a conda environment for x86_64, built the app with pyinstaller, and verified that it runs when I double-click on AppName.app. So far so good.
The problem happens when I sign it. After signing with the same command I used for the arm64 version:
codesign -s "Developer ID Application: MY_CERTIFICATE_NAME" -v --deep --timestamp --entitlements entitlements.plist -o runtime "dist/MyAppName.app" --force
Entitlements file just sets com.apple.security.cs.allow-unsigned-executable-memory to true - apparently necessary for python programs.
The app now crashes when I double-click. The crash-log contains the line:
Termination Reason: Namespace ROSETTA, Code 0
rosetta error: unable to mmap __TEXT: 1
/var/db/*/libffi.8.dylib.aot
When I try to run from command line with
./projects/eagle_eyes_video_scanner/dist/EagleEyesScan.app/Contents/MacOS/main
I get another error:
rosetta error: unable to mmap __TEXT: 1
/var/db/oah/ffdfb26a8f1f835406614fae08b99665733faafa40599b6bc0aace0981564015/4893345e2743c970aa1c71f137e03f8e791c82b6b7354da038bebfac5673be73/libffi.8.dylib.aotzsh: abort ./projects/eagle_eyes_video_scanner/dist/EagleEyesScan.app/Contents/MacOS/mai
I don't know if this libffi is central to the problem or just the first thing to fail.
So, how can I sign my app without breaking it?
I am working on an open source weather app for distribution outside the Mac App store: https://sourceforge.net/projects/heat-meteo
The project builds and runs fine in Xcode.
The batch build script was using ALTOOL which can’t/shouldn’t be used anymore. I am trying to set it up for notarytool.
This is what I think is now happening.
Again, all works fine in the Xcode debugger.
In Xcode, the build is setup with Automatically manage signing for both Debug and Release. They are using my Apple Development account, 4V7….
What I have read if that if I want to distribute outside of the Mac App store, it must be signed with my Developer ID Application, 7VN….
I tried to do an xcodebuild then codesign to switch from 4V7 to 7VN. That actually worked. codesign -dv --verbose=4 shows the correct account. However when I do that, codesign --display --verbose shows I lost the hardened runtime and then notarytool fails because hardened runtime isn’t set. The hardened runtime flag IS set before the codesign command.
I can physically turn off Automatically manage signing in Xcode for Release, but how to I select my Developer ID Application account? It does not appear to be a choice.
If it matters, the application needs both WeatherKit and Location entitlements and they are set to YES in the entitlements file.
I’m guessing, and this pure guessing, I need to adjust something in https://developer.apple.com/account but I don’t know what.
Thanks in advance.
Ed
Post marked as Apple Recommended
Developing a ios app in Unreal Engine 5. Everything was alright. Until it wasn’t.
Build to iOS device. Click. Cooking. Building… “ERROR: CodeSign Failed”
D4mn it! hahaha
Here’s the log:
UATHelper: Packaging (IOS): Command CodeSign failed with a nonzero exit code
UATHelper: Packaging (IOS): ** BUILD FAILED **
UATHelper: Packaging (IOS): The following build commands failed:
UATHelper: Packaging (IOS): CodeSign /Users/jordansktorres/My\ Drive/PROJECTS/CRUZEIRO-DO-SUL/ValenteGO/ValenteGO_V1/Binaries/IOS/Payload/ValenteGO_V1.app (in target ‘ValenteGO_V1’ from project ‘ValenteGO_V1’)
UATHelper: Packaging (IOS): (1 failure)
UATHelper: Packaging (IOS): Took 12,659139s to run env, ExitCode=65
UATHelper: Packaging (IOS): ERROR: CodeSign Failed
UATHelper: Packaging (IOS): (see /Users/jordansktorres/Library/Logs/Unreal Engine/LocalBuildLogs/Log.txt for full exception trace)
UATHelper: Packaging (IOS): AutomationTool executed for 0h 1m 51s
UATHelper: Packaging (IOS): AutomationTool exiting with ExitCode=32 (Error_FailedToCodeSign)
UATHelper: Packaging (IOS): RunUAT ERROR: AutomationTool was unable to run successfully. Exited with code: 32
PackagingResults: Error: Failed to Code Sign
I have deleted the binaries, build, intermediate, and saved folders. I have generated and created new certificates. I have deleted UE5 and re-install it again. I have thrown the project into the garbage can and created a whole new project file with the same content folder. It all led to the same result. “ERROR: CodeSign Failed”
Please, someone, anyone, give me a light here. hahaha
Post not yet marked as solved
I have signed Safari app using product-> archive with automatic sign option using developer ID and notarised to distribute out side of App Store.
Finally , I have observed that Safari is showing extension only in develop mode by selecting allowing unsigned apps option.
why safari treating properly signed as unsigned ? Is my understanding correct?
Hello all!
My project ic C++ project with CMake and need to create in CMakeLists.txt functionality of automatic code sign for specific team and product. Is there any way to do it?
Is there any examples or manuals?
My CMake is 3.26.3
Hi,
So I am bundling a FileProvider Extension with my electron application and have noticed a very strange behavior. When I package my application and install/launch it from any directory everything runs perfect. However the exception is when I install it to/launch it from the /Applications folder.
Specifically I receive Cannot create domain: Error Domain=NSFileProviderErrorDomain Code=-2001 "The application cannot be used right now." which maps to providerNotFound. Seems that the provider is failing to instantiate altogether, and therefore I lack any extension functionality.
After I have run the app from the /Applications folder once if I try and run the app from any other directory it fails and I get the same error message.
Anybody have any clues as to what may be changing in my environment that driving this behavior?
Post not yet marked as solved
The .NET Runtime has shipped an lldb extension that looks to extend LLDB functionality to be able to reason about .NET managed code. This has been working for a long time, but now it fails to load with the error error: this file does not represent a loadable dylib. Loading works if I use a self-compiled version of LLDB. I can't really debug XCode's LLDB, but there are some logs that seemed to hint it was signing checks failing for library validation, but neither Developer nor Application signing would satisfy these. LLDB resides within the XCode bundle at /Applications/Xcode.app/Contents/Developer/usr/bin/lldb. codesign confirms that the bundle enforces library validation. Is there any way to confirm this is the issue? It looks like:
Library Validation failed: Rejecting '/*/libsosplugin.dylib' (Team ID: none, platform: no) for process 'lldb(77691)' (Team ID: none, platform: yes), reason: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
and
Library Validation failed: Rejecting '/*/libsosplugin.dylib' (Team ID: UBF8T346G9, platform: no) for process 'lldb(77691)' (Team ID: none, platform: yes), reason: mapping process is a platform binary, but mapped file is not
If that's the issue, what's the suggested way forward to have loadable lldb plugins? If not, what's the recommended way to diagnose this? lldb logging is verbose, but doesn't provide any information around this.
Post not yet marked as solved
Hi!
We're using AdHoc builds for internal testing and that worked fine for the last couple of years.
Recently, we've noticed that the installation of those builds fails on all devices that have iOS 16.4 or iOS 16.5 installed. When tapping on the icon, iOS shows an alert saying "Unable to Install APPNAME. This app cannot be installed because its integrity could not be verified"
The same builds can be installed normally on all devices that are still on 16.1, 16.2 or 16.3. We're building using Xcode 14.3, devices are registered correctly and developer mode is enabled everywhere.
Did someone else run into this issue?
Thanks,
Klemens
Hi! I am currently trying to upload my iOS app to App Store Connect. Unfortunately, code signing fails with the following error: "Code object is not signed at all.", referencing a binary Metallib (created with metal-tt and an mtlp-json script). I am using Xcode's automatically managed signing and the binary metallib is located inside the "Resources" directory of a framework that I am including with "Embed and sign" in the app. Could anyone give some guidance on what I need to change to make code signing work? Thank you.
I'm getting a code signing crash when I try to register a helper app as a login item, and I think this is new with macOS 13.4. That is, the crash log contains this:
Exception Type: EXC_CRASH (SIGKILL (Code Signature Invalid))
Exception Codes: 0x0000000000000000, 0x0000000000000000
Termination Reason: CODESIGNING 4 Launch Constraint Violation
I'm seeing one suspicious message in the system log:
tccd Prompting policy for hardened runtime; service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for accessing={TCCDProcess: identifier=com.jwwalker.AutoPairs.uiapp,
pid=91471, auid=501, euid=501, binary_path=/Applications/AutoPairs 4.0.1a1/AutoPairs4.0.1a1.app/Contents/MacOS/AutoPairs}, requesting={TCCDProcess: identifier=com.apple.appleeventsd, pid=531, auid=55, euid=55, binary_path=/System/Library/CoreServices/appleeventsd},
I can't figure out why the OS would think that I need an Apple Events entitlement.
I've looked a the thread Resolving Code Signing Crashes on
Launch, but it hasn't enlightened me. One problem I ran into is at the step
certtool d "authorised0.cer"
I get the output
CSSM_CL_CertGetAllFields: CSSMERR_CL_UNKNOWN_FORMAT
Post not yet marked as solved
i've benn developed ios app by using Xcode 13.
and there's no error shown while upload appstore.
recently i was update Xcode 14 from Xcode 13.
i was try to upload appstore met this error message.
**Asset validation failed
Invalid Signature. A sealed resource is missing or invalid. The file at path “YOURAPPNAME.app/YOURAPPNAME” is not properly signed. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate. Verify that the code signing settings in Xcode are correct at the target level (which override any values at the project level). Additionally, make sure the bundle you are uploading was built using a Release target in Xcode, not a Simulator target. If you are certain your code signing settings are correct, choose “Clean All” in Xcode, delete the “build” directory in the Finder, and rebuild your release target. For more information, please consult https://developer.apple.com/support/code-signing. (ID: 4e57c179-501e-40d2-8e49-b7483b87d73d)**
i was googling for this solution but there's no way.
please, give me little any hint.
thank you.
I got an email from Apple, "Your Developer ID Installer Certificate will no longer be valid in 30 days". So I went to my certificates page on developer.apple.com, and I see the attached photo.
Basically, yes, I have a Developer ID Installer Certificate that expires 2023/07/01; but I also have one that expires 2025/12/08, and one that expires 2026/01/09, and one that expires 2026/12/15, and another that expires 2026/12/16! Why do I have all these certificates? I have no idea. There is a "+" button to add a new one; but given that I already seem to have ones that won't expire for several more years, do I need to? There does not seem to be a "-" button, or any way to clear out this cruft.
I then recalled that perhaps I have managed my certificates in Xcode in the past, not on this page (or maybe I have done both, at different times?). So I went to Xcode, and things seem to be rather a mess there too, but in a different way (second image attached).
Here, I seem to have lots of stale certificates that are in gray and say "Not in Keychain" – how do I clear those out? Again there does not seem to be a "-" button. And the newer ones that I saw on developer.apple.com do not seem to be listed here, maybe – it's hard to compare, though, because on developer.apple.com it shows the expiration date but not creation date, whereas in Xcode it shows creation date but not expiration date.
What should I do? Note that I am not a member of multiple different teams, or anything like that; I'm a solo developer. This stuff is really confusing and does not seem to be well-documented anywhere that I have found. Am I just being dense?
Post not yet marked as solved
A dependency of one of my Swift Packages is preventing my project from compiling because "the signature cannot be verified" and "code sign verification failed." Is there a way to disable signatures for 3rd party SDKs in Xcode 15? Thank you!
Post not yet marked as solved
I updated my keychain certificate. At that time I forgot to always trust and build. When I did so, I was prompted repeatedly to enter my username and password in a dialog. There were so many that I rejected them all in the process. Then I went to the keychain, changed the certificate to always trust, and built again. But I got an error and was told to change the trust setting back to default. So I did as I was told and built again. Then I was asked to enter my username and password again and again, so this time I entered them all correctly. However, it still did not work.
After building Xcode, I found a Repair button in the provisioning file settings, so I pressed it and built again. After entering the dialog, I got Build Sccess, but it could not start and I got an issue dialog. How do I get it to build on a real machine?
Details Could not launch “Runner” Domain: IDEDebugSessionErrorDomain Code: 3 Failure Reason: failed to get the task for process 14356 User Info: { DVTErrorCreationDateKey = "2023-06-06 06:48:35 +0000"; DVTRadarComponentKey = 855031; IDERunOperationFailingWorker = DBGLLDBLauncher; RawUnderlyingErrorMessage = "failed to get the task for process 14356"; } -- Analytics Event: com.apple.dt.IDERunOperationWorkerFinished : { "device_model" = "iPhone10,3"; "device_osBuild" = "15.4.1 (19E258)"; "device_platform" = "com.apple.platform.iphoneos"; "launchSession_schemeCommand" = Run; "launchSession_state" = 1; "launchSession_targetArch" = arm64; "operation_duration_ms" = 22537; "operation_errorCode" = 3; "operation_errorDomain" = IDEDebugSessionErrorDomain; "operation_errorWorker" = DBGLLDBLauncher; "operation_name" = IDEiPhoneRunOperationWorkerGroup; "param_consoleMode" = 0; "param_debugger_attachToExtensions" = 0; "param_debugger_attachToXPC" = 1; "param_debugger_type" = 5; "param_destination_isProxy" = 0; "param_destination_platform" = "com.apple.platform.iphoneos"; "param_diag_MainThreadChecker_stopOnIssue" = 0; "param_diag_MallocStackLogging_enableDuringAttach" = 0; "param_diag_MallocStackLogging_enableForXPC" = 1; "param_diag_allowLocationSimulation" = 1; "param_diag_checker_tpc_enable" = 1; "param_diag_gpu_frameCapture_enable" = 0; "param_diag_gpu_shaderValidation_enable" = 0; "param_diag_gpu_validation_enable" = 0; "param_diag_memoryGraphOnResourceException" = 0; "param_diag_queueDebugging_enable" = 1; "param_diag_runtimeProfile_generate" = 0; "param_diag_sanitizer_asan_enable" = 0; "param_diag_sanitizer_tsan_enable" = 0; "param_diag_sanitizer_tsan_stopOnIssue" = 0; "param_diag_sanitizer_ubsan_stopOnIssue" = 0; "param_diag_showNonLocalizedStrings" = 0; "param_diag_viewDebugging_enabled" = 1; "param_diag_viewDebugging_insertDylibOnLaunch" = 1; "param_install_style" = 0; "param_launcher_UID" = 2; "param_launcher_allowDeviceSensorReplayData" = 0; "param_launcher_kind" = 0; "param_launcher_style" = 0; "param_launcher_substyle" = 0; "param_runnable_appExtensionHostRunMode" = 0; "param_runnable_productType" = "com.apple.product-type.application"; "param_runnable_type" = 2; "param_testing_launchedForTesting" = 0; "param_testing_suppressSimulatorApp" = 0; "param_testing_usingCLI" = 0; "sdk_canonicalName" = "iphoneos16.2"; "sdk_osVersion" = "16.2"; "sdk_variant" = iphoneos; } -- System Information macOS Version 12.6.3 (Build 21G419) Xcode 14.2 (21534) (Build 14C18) Timestamp: 2023-06-06T15:48:35+09:00
Post not yet marked as solved
Can we use digital signatures for our Swift Packages? Or is this only for XCFrameworks?
I have an old application I have not modified since near three years. I can still send the macOS build to store. That's OK. But I got a validation error while distributing the iOS version to store.
Targets were set to automatically manage signing. I have changed both parent app and extension to use two different manually created signing profiles ant it show in Xcode signing profile: Apple Distribution. macOS build still use automatically manage signing.
In a second time I saw that even if I get the successfully uploaded message for macOS build, in fact there is still only the 2020 version available in App Store Connect...
What I am doing wrong ? Any ideas please ?
Post not yet marked as solved
I decided to change the app to a different UI as the existing one is limited and the new one has more functions. I don't want my users to download a new app. I just want them to update. I have the keystore files and all the other files generated when I build my first app. How do I add it to an already exported app? ready for PlayStore testing?
Post not yet marked as solved
I have an app that was built on my first mac, i got a new one and moved the code and everthing to this new mac. I exported the private key and certificate from the old mac to the new one. Tried everthing on the internet about signing an app, but it just doesn't work. Now i'm stuck in a loop on xcode. I get the message "Revoke Certificate", when i click it, xcode create a new one, but it's already expired(despites it saying that will expire in 2024), if i try to manage certificates and create from there, nothing happens. If i delete the expired certificate from keychain, the revokate certificate message comes back. Any tips?
Post marked as Apple Recommended
I've encountered some applications that are validly signed (as reported by codesign dvv / SecStaticCodeCheckValidity), but the notarization ticket has been revoked:
% codesign -v revoked.app
% stapler validate revoked.app
The ticket for revoked.app has been revoked. Gatekeeper will prevent it from running.
% spctl -a -vvv -t install revoked.app
revoked.app: notarization indicates this code has been revoked
What is the recommended / supported approach to perform this check programmatically? In other words, replicate stapler validate or spctl -a -vvv -t install but with APIs). Ideally an API that returns errSecCSRevokedNotarization
I can extract the app's code signing information, cdhashes or notarization ticket (from Contents/CodeResources). Was toying with SecAssessmentTicketLookup and SecTrustEvaluateWithError but so far, no luck.
And SecRequirementCreateWithString(CFSTR("notarized")... and SecStaticCodeCheckValidity just returns errSecCSReqFailed which yes is correct, but doesn't tell us that the ticket was revoked.
Post not yet marked as solved
Hi, team.
I want to verify identity and accept change with commands as the same Xcode 15 does in the "Verify app dependencies with digital signatures" video because I would like to build my app with a CI tool.
Are there any ways to do that? If I can, could you tell me how?
I searched for how to check the identity with the codesign command but couldn't find the way.
Thank you.
