Questions tagged [code-signing]
The code-signing tag has no usage guidance.
116
questions
1
vote
0
answers
28
views
How to staple Apple notarization tickets (without using 'xcrun stapler')
Recently (as of 2023-11-01) Apple has changed their notarization process.
I took the opportunity to drop Apple's own tools for this process (notarytool) and switch to a Python-based solution using ...
- 111
0
votes
0
answers
29
views
Grepping output from Codesign
I am trying to filter codesign command output using the following command, but it doesn't seem to work:
codesign -d --entitlements - /Applications/Safari.app | grep -i "*sandbox"
- 21
0
votes
1
answer
24
views
How does Intune know about custom macOS developer certificates
We (an organization) want to start with (re-)packaging of macOS applications and distribution with Intune. I am aware that I will need to sign a .pkg file with a Developer Certificate for distribution ...
- 103
0
votes
0
answers
78
views
Notarisation on macOS Sonoma
Is notarisation required to execute code on macOS Sonoma.
Note, I'm not speaking about code sign, where the binary is signed with any key (which is acceptable prior to Sonoma) but rather notarisation, ...
- 1,316
0
votes
0
answers
37
views
KASAN & KCOV kernel extensions are unsigned? is this normal?
While trying to find an issue with my computer, I was going through my kexts on profiler and Kasan.kext and Kcov.kext appear to have both been unsigned and recently modified. This had me wondering if ...
- 397
0
votes
0
answers
144
views
iOS Distribution Certificate has no password
I'm following Expo's guide on signing an iOS app: https://docs.expo.dev/app-signing/local-credentials/#ios-credentials
They mention I need a distribution certificate (.p12 file) with a password. ...
- 101
1
vote
1
answer
285
views
Xcode sign MacOS binary AdHoc with entitlement (for coredump)
I want to enable coredumps for a locally used MacOS binary. I'd like Xcode to sign the binary appropriately.
Currently I need to run the following two commands after the binary is generated to enable ...
- 141
2
votes
1
answer
444
views
macOS 13.1 launchd job fails with OS_REASON_CODESIGNING
I have mongod running in the background, installed through homebrew. I've updated to macOS 13.1 yesterday and now mongod fails to start. The launchd sys log shows the following error:
2022-12-14 09:50:...
- 1,177
0
votes
1
answer
316
views
Mac OS “sandbox” on Mac OS
I need to test some signing/notarization issues with Gatekeeper and I need a completely “new” and “fresh” system for that so that I can test the app like a completely new user.
Is there an easier way ...
- 1
1
vote
1
answer
1k
views
not valid for use in process: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
I'm trying to run a 3rd party application through the Spyder Python IDE. I'm able to import the code and it runs through the command line using the Terminal application but Spyder appears to be more ...
- 11
0
votes
0
answers
768
views
Installing an iphone app on an m1 mac
I'm trying to install a particular app on my mac using playcover,
The app goes through applicationDidFinishLaunching and applicationDidBecomeActive but immediately crashes due to a segfault,
I was ...
1
vote
0
answers
152
views
What does the ":-" parameter do?
I'm trying to understand the codesign command. Both of the following works fine:
codesign -d --entitlements :- /Applications/Numbers.app/
codesign -d --entitlements - /Applications/Numbers.app/
I'm ...
- 945
0
votes
0
answers
1k
views
Codesign: The specified item could not be found in the keychain
I am trying to codesign one VST plugin in Terminal. I added a self-signed certificate to the login keychain. I try to codesign using the following command:
sudo codesign --force --deep --sign Ozone\ 9\...
- 101
2
votes
0
answers
153
views
Managing APFS snapshots without purchasing developer certificate
I want to manually create, delete, and restored to snapshots on my APFS volumes (external, for data use, so not limited by SIP). I'm using snaputil, but maintaining APFS snapshots require two ...
- 2,503
3
votes
0
answers
483
views
Why can I still modify my Code Signed Electron app?
We developed a macOS app with Electron. We code-signed and notarized it using Electron-Forge, which generated an *.app package, inside a Contents/_CodeSignature/CodeResources file with an entry for ...
- 131
0
votes
1
answer
2k
views
Disable / enable amfid on per-application basis
I want to create and manage snapshots on my Data partition, but because I don't have a developer certificate and apple-granted entitlements (like com.apple.developer.vfs.snapshot), I have to either ...
- 2,503
2
votes
0
answers
505
views
errSecInternalComponent when using codesign from within a daemon
I have my own running daemon application that listens to a network port and executes some different commands based on the coming request. All is working fine except when trying to execute the ...
- 121
1
vote
1
answer
1k
views
Where can I find the syntax for macos spctl (gatekeeper) rules?
I'm trying to code-sign an electron app for submission to the "Mac App Store". As expected, it has been a tremendous pain for 101 reasons.
However, I have now discovered a ray of light in ...
- 123
1
vote
1
answer
175
views
Does a Code-Signed application require security permissions?
I am contemplating whether to purchase a Personal Apple CodeSign certificate, for 99$/year. I have a medium-sized user base, and an app that is installed multiple times a month by each user. Upon ...
- 13
0
votes
0
answers
169
views
What is the correct certificate to setup for AppleScript apps?
In the past I haven't been code signing but with the new security features that are in current operating systems I thought I should to prevent user issues.
Under Certificates, Identifiers & ...
- 1,054
1
vote
0
answers
79
views
Problem with signing GDB on Big Sur
I am trying to make GNU debugger gdb work on macOS 11.6 Big Sur.
You need to sign the binary to make it work.
I use instructions from here: https://sourceware.org/gdb/wiki/PermissionsDarwin
However, ...
- 163
2
votes
1
answer
934
views
Application get sigkill on launch
When I launch certain applications, they don't launch. Running them in iTerm gets sigkill. Running them in gdb does not output any debug information. Running them with dtruss does not output any debug ...
- 2,503
2
votes
0
answers
80
views
How to code sign hidden files?
I have a hidden dylib file that is preventing notarization. The LogFileURL indicates the file is not signed and does not have a valid time stamp.
I tried to sign the file separately using the path to ...
- 153
21
votes
1
answer
6k
views
Why am I able to run my own app without code signing?
I have a little open-source Qt app I wrote and then compiled on my Mac. I ran macdeployqt and copied it to my /Applications folder, and it runs without complaint.
Ultimately I plan to sign this app ...
- 333
1
vote
0
answers
168
views
Disabling application signing/integrity protection
I'm using a macOS 10.15 Parallels virtual machine for development purposes. It is very slow (compared to a macOS 10.13 VM), and I spend a couple of hours extracting XCode.
Now, when I try to open ...
- 2,503
1
vote
1
answer
279
views
GPG constantly throwing "no such file or directory" when doing operations
So I want to create a GPG so I can use it. I did gpg --gen-key, put in the information but it threw theNo such file or directory error (see below).
❯ gpg --gen-key
gpg (GnuPG) 2.3.1; Copyright (C) ...
- 21
1
vote
2
answers
260
views
Distribute an app directly to customers: MacOS vs. iOS
I have a Developer Program subscription ("Enrolling as an Individual", not as an Organization).
With MacOS, it's possible to code-sign / notarize an app, and ship the .dmg / .pkg to ...
- 123
0
votes
1
answer
113
views
Do I need the Developer Program to sign an app for my own use?
I installed iTerm2 from MacPorts; since it was built from source, it wasn’t notarized. If I want to sign it for my own usage (not distributing any app), do I need to (pay $99 and) join the Developer ...
- 583
1
vote
1
answer
1k
views
inscrutable rules for disallowing binaries on a new Apple Silicon (Big Sur) machine [closed]
EDIT: This problem appears to have been a bug in the Apple code signing mechanism, and has been fixed in the 11.1 Big Sur release candidate. At the moment I write this, you need to enrol in the Apple ...
2
votes
0
answers
702
views
Apps downloaded from Mac App Store won't start due to invalid signature
I'm currently trying to resurrect my 2010 MacBook Pro 15" while my 2015 is away for repairs. The latest it can run is macOS 10.13.6.
After installing all the latest OS updates and security ...
- 5,891
8
votes
4
answers
6k
views
What harm will denying ocsp.apple.com do?
After the recent issue of trustd trying to connect to Apple's overloaded servers, and causing slowdowns to Macs around the world, one discussion page suggested a temporary fix:
This command in ...
- 33.8k
1
vote
0
answers
1k
views
Codesign states code object is not signed at all
I have noticed this before too on some executable files. Recently, I downloaded cmake and used codesign to check if it's digitally signed but it states, it's not signed at all:
% codesign -v /Volumes/...
- 131
2
votes
1
answer
2k
views
Fixing: "There are no devices registered in your account" without a Lightning cable Xcode 11.0
Using Xcode, when I try to sign my app, I get an error that says:
Failed to create provision profile
There are no devices registered in your account on the developer website. Plug in and select a ...
1
vote
1
answer
731
views
Handling permissions to run a bash script
I'm sending a bash script as a .command file to a friend. This person is not very tech savvy which is why I'm sending it in the first place, the goal is for the .command file to run through the shell ...
- 145
1
vote
1
answer
210
views
which certificate/identifiers/profilers should be used for python script to be distributed as a pyinstaller build/bundle outside the app store?
My program works as follows
In a while loop, it checks for the active window change - AppKit library used
from AppKit import NSWorkspace
active_window = (NSWorkspace.sharedWorkspace()....
- 165
6
votes
2
answers
7k
views
How to code-sign my python script / package packaged for mac using pyinstaller without using xcode?
I have written a python script and bundled it using the PyInstaller.
The executable file inside the dist folder works fine on my Mac. But not on someone else's Mac even if they've set "App Store ...
- 165
2
votes
1
answer
317
views
Executing bundled shell command in a hardened runtime application
I have written a Java application which I want to distribute in form of a macOS application bundle. The application needs to execute a command line application which is also part of the bundle. The ...
0
votes
0
answers
46
views
macOS Server: How to sign enrollment profiles?
I am wondering how to sign enrollment profiles for macOS Server. Ideally, I would like to avoid paying money. In any case, how do you do it?
- 1,182
4
votes
2
answers
3k
views
Signed pkg using productbuild --distribute but codesign says "code object is not signed at all"
I am signing my package during distribution using
SIGN_IDENTITY_INSTALLER="Developer ID Installer: Pxxxxxxx, LLC (AXXXXXXXXX)"
productbuild --distribution final-distribution.xml --package-path /tmp/...
3
votes
0
answers
783
views
How to view expiration date of code signing cert?
I know pkgutil --check-signature and codesign -d -vvv but neither of them show the expiration date. Is there a way to view the expiration date of a code signing cert? Say for instance...macOS ...
- 131
1
vote
1
answer
300
views
Need to solve “Can’t be opened because it is from an unidentified developer" by any other way than changes the Security and Privacy settings
We have created one .app application which will place some files under the user location “/Users//Library/” on executing that.
Basically, that app is a shell script app in which .app file is created ...
- 11
33
votes
1
answer
65k
views
macOS Catalina: "App is damaged and can't be opened. You should move it to the trash."
Experiencing a problem with several apps after installing macOS Catalina.
When the app is downloaded from the internet I get the error:
"APP NAME" is damaged and can't be opened. You should move ...
- 447
2
votes
0
answers
430
views
How to add Sudo Insults with TouchID without disabling SIP
I am following a guide to recompile sudo with insults. However, I felt uncomfortable disabling SIP so I modified it a bit to allow me to use it with SIP enabled. Unfortunately recompiling sudo broke ...
- 366
1
vote
0
answers
231
views
How can I programmatically (CLI or code) retrieve the certificate used to sign an app bundle?
I'm interested in knowing when the key used to sign one of my macOS applications has changed after an update. How can I get information about which developer certificate was used to sign a given ...
- 123
7
votes
1
answer
35k
views
Xcode 10: Failed to create Provisioning Profile - There are no devices registered
When I try to create a profile to build an iOS app by going to Project → General → Signing, and selecting my Team (Personal), I get two errors:
Failed to create provisioning profile.
There are ...
- 173
2
votes
1
answer
884
views
Bypassing Gatekeeper in macOS Mojave 10.14.5
At least until macOS Mojave 10.14.4, a user could run any application on a Mac, signed or not, by right clicking it in Finder and manually selecting Open.
Does this still work for all applications ...
- 111
1
vote
2
answers
2k
views
How to create an identity who can be used for signing code from custom certificate?
I want to codesign one of my applications by using my own certificate (not created with Keychain Access).
First, I create a v3.ext file:
keyUsage = digitalSignature
Then, I created my certificate ...
- 143
1
vote
1
answer
1k
views
codesign still tries to access other keychains when adding --keychain parameter
we have a automated codesigning setup on our CI/CD infrastructure which is using the codesing command to resign a iOS application with a certificate located in a specific keychain. The codesign script ...
- 21
0
votes
1
answer
614
views
Is paid Apple Developer Program subscription required to distribute test IPA file?
I am building an Ionic app, and I want to distribute it to a few people in my organization.
Ionic Cordova iOS build command runs successfully. Now i need to generate the IPA file to install the app ...
- 43
5
votes
1
answer
1k
views
Deploy iOS app on personal devices
I've been working on a small iOS app, intended as a gift to some family members. To my dismay, I'm finding a lot of barriers to attempting to deploy the app. It largely revolves around signing the app ...
