Xcode 14 signing & capabilities requires a DriverKit development profile

Xcode version : 14.0 Beta 3

macOS version : 13 Beta 3(22A5295i)

Hi, I'm signing the DriverKit in Developer ID Application type profile with Developer ID Application (With Kext) type certificate on Xcode.

But status shows error with"Xcode 14 and later requires a DriverKit development profile enabled for IOS and macOS.Visit the developer website to create or download a DriverKit profile"

I have downloaded all profiles and Certificates to my Mac and installed all of them, then checked the website.

I'm wondering what's different between "Development type" & "Developer ID Application type" profile ? and the reason why

"2022-07-22 14:41:54.162815+0800 0x22ee2    Error       0x0                  138    0    kernelmanagerd: Error occurred while handling request "DextLaunch(arguments: Optional(["Driver Extension Server Name": com.asix.dext.usbdevice, "Check In Token": 371, "Driver Extension Server Tag": 4294975444, "CFBundleIdentifier": com.asix.dext.usbdevice, "DriverKit Reslide Shared Cache": 0, "kOSBundleDextUniqueIdentifier": <222f1e51 f5e890f7 b467c2a0 da761dbd 9b14dc5f 1bf56ff6 4eeab6b2 fed9683c>]))": Error Domain=NSPOSIXErrorDomain Code=8 "Exec format error"

error code show on when I starting the app.

I'll appreciate that someone can give me some idea or suggestions.

Thanks a lot.

Up vote post of asix Down vote post of asix
4.3k views
Posted by
asix
Reply

  • Hi, Drewbadour You said "XCode14 DriverKit profiles have changed to support DriverKit on iPadOS" Causes the "provisioning profiles" we used in XCode13 to produce "Platform: maOS" in Xcode14 "Doesn't match platform DriverKit" and cannot be used. So does Apple know about this problem and how to fix it? I tried make a new Distribution DriverKit provisioning profiles for Xcode 14, but failed. If Asix, or anyone else, has found a solution to this problem, I hope to respond, thank you!

    —
    erich-areca

  • I have the same issue. Would be glad to replace my DriverKit distribution provisioning profile with a new one for macOS and iOS. But how does one create one? Under "Register a New Provisioning Profile", "Distribution" and "Developer ID", the Profile Type on the next page is already "macOS", not "macOS and iOS".

    —
    thomasPSL
Add a Comment

Accepted Reply

I got the same error in Xcode 14

"Xcode 14 and later requires a DriverKit development profile enabled for iOS and macOS. Visit the developer website to create or download a DriverKit profile."

Must be a bug in Xcode14 Beta 3, the old DriverKit profile is recognized in Xcode 13 but not in Xcode 14.

Posted by
erich-areca
Up vote reply of erich-areca Down vote reply of erich-areca
Post marked as solved

  • DriverKit profiles have changed to support DriverKit on iPadOS. The provisioning profiles you have used with Xcode 13 will not work with DriverKit targets for Xcode 14.

    —
    Drewbadour

  • On the other hand, we need to new a profile in Certificates, Identifiers & Profiles page? If so, there is nothing changed after I new a Distribution profile.

    Could you please give us the detail setting steps to make a new Distribution DriverKit profiles to signing in Xcode 14?

    Thanks.

    —
    asix

  • Hi, Drewbadour You said because "XCode14 DriverKit profiles have changed to support DriverKit on iPadOS" Causes the "provisioning profiles" we used in XCode13 to produce "Platform: maOS" in Xcode14 "Doesn't match platform DriverKit" and cannot be used. So does Apple know about this problem and how to fix it? I tried make a new Distribution DriverKit provisioning profiles for Xcode 14, but failed. If Asix, or anyone else, has found a solution to this problem, I hope to respond, thank you!

    —
    erich-areca

Replies

DriverKit code must be signed with restricted entitlements, that is, entitlements that must be authorised by a provisioning profile. For more background on that concept, see TN3125 Inside Code Signing: Provisioning Profiles.

Historically the capabilities to authorise the use of those entitlements were managed, that is, their use had to be specifically allowed by Apple. For more background on that, see Developer Account Help > Reference > Provisioning with managed capabilities.

I’m not a DriverKit expert but my understanding is that this year we have split this by profile type:

  • For development profiles, these capabilities are no longer managed. Any developer can add them to any App ID using the Developer web site, and they will flow through to development provisioning profiles created from that App ID.

  • These capabilities are still managed for distribution profiles.

If you go into developer account and edit an App ID, you’ll see a bunch of new DriverKit capabilities there, many of which have the “Development only. Distribution approval required.” note.

I'm signing the DriverKit in Developer ID Application type profile with Developer ID Application (With Kext) type certificate

I generally recommend against configuring your project to use a Developer ID signing identity because those are precious [1] and should be managed very carefully. For day-to-day development you should always use an Apple Development signing identity.

With the above-mentioned changes, it should be possible to use Apple Development signing with DriverKit without any approvals from Apple. Neat-o!

I'm wondering what's different between "Development type" & "Developer ID Application type" profile ? and the reason why

Developer ID profiles go hand-in-hand with Developer ID signing identities. The signing identity allows you to sign code that can be run on any Mac (without going through the Mac App Store). A Developer ID profile allows Developer ID signed code to use restricted entitlements.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] For what I mean by this, see my posts on this thread.

Posted by
eskimo
Post not yet marked as solved Up vote reply of eskimo Down vote reply of eskimo

  • Quinn, thanks for the cogent explanation. There do appear to be some issues with the approach you outlined (as a non-expert, of course). Alas, I will need to fit it into a bit larger space in a full reply as opposed to a comment. See below.

    —
    jbrisbin
Add a Comment

Hi I'm wondering how to signing profile in Xcode 14 and install successfully on any other macOS 13 without install any profile or entitlements .

Does Beta version in macOS require develop profile to test until formal OS version release? Before formal OS version , I can't signing in app with distribute profile?

thanks

Posted by
asix
Up vote reply of asix Down vote reply of asix
Add a Comment

Does Beta version in macOS require develop profile to test until formal OS version release?

The trusted execution system does not change behaviour between beta and final OS releases. Use of restricted entitlements must be authorised by a provisioning profile. The difference here is the type of profile. In general:

  • A development profile is restricted to a specific set of machines.

  • A distribution profile allows the app to run on all machines.

One thing to note here is that there’s a specific DriverKit App Development profile. I’ve not actually played with that (I did warn you that I’m not an expert on DriverKit :-) but it looks relevant.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment

Thanks for your replay

The trusted execution system does not change behaviour between beta and final OS releases. 

When I sign in with distribution profile in signing & capabilities, Xcode 14 Beta will tell me the error code that "Xcode 14 and later requires a DriverKit development profile enabled for iOS and macOS. Visit the developer website to create or download a DriverKit profile." .

I have no idea how to deal with it because that profile works in Xcode 13 macOS 12 ,and the Apple documents are nothing relevant with that. If nothing wrong between signing and profile, could it possible to a bug in Xcode14 Beta 3 or macOS 13 Beta.

thanks

Posted by
asix
Up vote reply of asix Down vote reply of asix
Add a Comment

I got the same error in Xcode 14

"Xcode 14 and later requires a DriverKit development profile enabled for iOS and macOS. Visit the developer website to create or download a DriverKit profile."

Must be a bug in Xcode14 Beta 3, the old DriverKit profile is recognized in Xcode 13 but not in Xcode 14.

Posted by
erich-areca
Up vote reply of erich-areca Down vote reply of erich-areca
Post marked as solved

  • DriverKit profiles have changed to support DriverKit on iPadOS. The provisioning profiles you have used with Xcode 13 will not work with DriverKit targets for Xcode 14.

    —
    Drewbadour

  • On the other hand, we need to new a profile in Certificates, Identifiers & Profiles page? If so, there is nothing changed after I new a Distribution profile.

    Could you please give us the detail setting steps to make a new Distribution DriverKit profiles to signing in Xcode 14?

    Thanks.

    —
    asix

  • Hi, Drewbadour You said because "XCode14 DriverKit profiles have changed to support DriverKit on iPadOS" Causes the "provisioning profiles" we used in XCode13 to produce "Platform: maOS" in Xcode14 "Doesn't match platform DriverKit" and cannot be used. So does Apple know about this problem and how to fix it? I tried make a new Distribution DriverKit provisioning profiles for Xcode 14, but failed. If Asix, or anyone else, has found a solution to this problem, I hope to respond, thank you!

    —
    erich-areca

Quinn, thanks for the cogent explanation. I feared my project would stall waiting for entitlements to debug. There do appear to be some issues with the approach you outlined (as a non-expert, of course). It appears that the App ID page has not been updated for several additions to DriverKit. Specifically:

  1. userclient access com.apple.developer.driverkit.userclient-access
  2. promiscuous userclient com.apple.developer.driverkit.allow-any-userclient-access
  3. BlockStorageDeviceDriver com.apple.developer.driverkit.family.block-storage-device
  4. SCSIPeripheralsDriverKit nowhere specified but perhaps com.apple.developer.driverkit.family.scsi-peripherals

It appears to me that without these entitlements supported, you can't build and debug sample DriverKitUserClientSample, SimpleAudioDriverExtension or, most important to me, my project -- which needs userclient access and SCSIPeripheralsDriverKit.

I look forward to Sharing and Enjoying your response. John Brisbin

Posted by
jbrisbin
Up vote reply of jbrisbin Down vote reply of jbrisbin

  • com.apple.developer.driverkit.userclient-access is a restricted entitlement, due to having custom values granted for each developer. It won't be available automatically. Please use allow-any-userclient-access instead, if you haven't been granted userclient-access. com.apple.developer.driverkit.allow-any-userclient-access is available. Check the "Additional Capabilities" tab of your dext's ID. You can run the mentioned samples by using allow-any-userclient-access.

    —
    Drewbadour

  • The two other mentioned entitlements are restricted entitlements and will require you to receive the entitlements via a request to Apple before you will be able to sign code with them.

    —
    Drewbadour

  • Drewbadour, I don't want to sign code for distribution beyond registered machines. I want to debug code in the "Development only. Distribution approval required." model that Quinn described, but for the devices that my client builds. Of course, these are restricted entitlements, just as the others are that are already on offer. I hope that these are not considered uniquely untouchable for some reason.

    —
    jbrisbin
Add a Comment

Xcode 14 and later requires a DriverKit development profile enabled for iOS and macOS. Visit the developer website to create or download a DriverKit profile.

I have the same issue. My driverkit driver is for macOS. I do not know how to create a profile for iOS&macOS exactly. HELP!!!

Posted by
Vannes
Up vote reply of Vannes Down vote reply of Vannes
Add a Comment