Hi,
I am facing an issue with login persistence using firebase, but basically, it seems that I need to ensure I enable the Keychain Sharing within the Identities capabilities, the problem is, it is not even on the list.
Thank you much
Demystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
Hi guys,
I am new to publishing apps on Apple Store. I used python, pyside6, torch, pyinstaller to build an app for Apple Store.
For codesigning, I used the correct "Developer ID Application" to sign the code. When I validate the .app file (codesign -vv --strict ), I got the following
my_app.app: valid on disk
my_app.app: satisfies its Designated Requirement
Next, I used ditto to "ditto -c -k --sequesterRsrc --keepParent my_app.app my_app.zip" to zip it.
Then, I submitted this my_app.zip file for notarization with "xcrun notarytool submit ..." and got the following "accepted" message.
Received new status: Accepted
Current status: Accepted...............
[20:08:54.530Z] Info [API] Submission in terminal status: Accepted
Processing complete
After that, I want to staple it with "xcrun stapler staple my_app.app", but I got the following
Could not validate ticket for my_app.app
The staple and validate action failed! Error 65.
To further investigate it, I ran "spctl -a -vvv my_app.app" and got
my_app.app: rejected
source=Unnotarized Developer ID
origin=Developer ID Application...
I don't know why this would happen after notarization accepted. Could someone help me understand this issue? Thanks!
I am trying to build a release for an application that installs a DriverKit driver. I created a Developer ID Application Profile with a valid certificate but I'm coming across this error in Xcode 16.3 that is preventing me from archiving:
Xcode 14 and later requires a DriverKit development profile enabled for iOS and macOS. Visit the developer website to create or download a DriverKit profile.
I thought I needed a Dev ID Application profile to distribute the application and that a Development profile is for testing. Is there something I'm missing?
I am using a Sonoma VM (14.6) where i have installed xcode 16.2. When i try login into apple id into xcode, i am getting this error. I know i am entering the correct credentials.
Not sure why this issue is.
In other Sequioa and Tahoe VM , i was able to login.
I have a pass type id that expired.
I created a CSR in keychain access on my Mac.
I uploaded the CSR and generated a new cert.
I downloaded the new cert and imported into keychain access.
I don't see the associated private key and I cannot export a .p12 certificate.
It's possible I started with the wrong key to generate the CSR or maybe I inadvertently deleted key while trying to locate the cert after importing. I'm not sure how to determine which.
I do still have the private key from the cert that expired. But, I cannot figure out how to sign a cert again, my only option now is download.
I've been searching the forum and while there may be an answer, I may just be looking for the wrong thing.
I could use some help if anybody would be so kind.
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
APNS
Signing Certificates
Wallet
Hello,
I had a successful attempt at notarization earlier today in my build pipeline. I've been using the same system for building my macOS application for over a year now. However, subsequent builds seemed to fail. I found a couple similar topics which makes this seem not not an isolated incident:
https://developer.apple.com/forums/thread/782950
https://developer.apple.com/forums/thread/783347
https://developer.apple.com/forums/thread/783283
In my case I use the following command to submit the notarization:
xcrun notarytool submit FilePath.dmg --apple-id "myappleid@gmail.com" --password "redacted_obviously" --team-id "my-team-id" --wait
I left a previous run go for over an hour and the "Current status: In Progress.................. etc" filled the whole terminal.
I manually checked the progress of the submissions using the command below:
xcrun notarytool log --apple-id "myappleid@gmail.com" --password "redacted_obviously_again" --team-id "my-team-id" [run id]
And they all result in the following output:
Submission log is not yet available or submissionId does not exist
Is anyone else experiencing this? Are there any possible solutions?
Topic:
Code Signing
SubTopic:
Notarization
This is my .entitlements file:
Code signing:
codesign --sign -vvv --timestamp --options=runtime --force --entitlements ./UES.entitlements -s "Developer ID Application: XXX. (XXXXXXX)" ./UES.app
I work fine in the macOS 13.x system, but the "killed" error occurs in macOS11.x. The system log is displayed as follows:
(If codesign remove the --entitlements ./UES.entitlements, it will operate normally)
2025-04-21 13:58:27.039638+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:27.039762+0800 0xd5bbf Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:27.039815+0800 0xd5bbf Default 0x0 0 0 kernel: proc 29354: load code signature error 4 for file "UES"
2025-04-21 13:58:27.040720+0800 0xd5bc0 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29354, /Applications/UES.app/Contents/MacOS/UES
2025-04-21 13:58:27.045974+0800 0xd58be Error 0x0 66405 0 CoreServicesUIAgent: [com.apple.launchservices:uiagent] handle LS launch error: {\n Action = oapp;\n AppMimimumSystemVersion = "10.13";\n AppPath = "/Applications/UES.app";\n ErrorCode = "-10826";\n}
2025-04-21 13:58:39.121619+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:39.121832+0800 0xd5e0f Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:39.121861+0800 0xd5e0f Default 0x0 0 0 kernel: proc 29415: load code signature error 4 for file "UES"
2025-04-21 13:58:39.122571+0800 0xd5e10 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29415, /Applications/UES.app/Contents/MacOS/UES
2025-04-21 13:58:46.297915+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:46.298031+0800 0xd5f85 Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:46.298072+0800 0xd5f85 Default 0x0 0 0 kernel: proc 29485: load code signature error 4 for file "UES"
2025-04-21 13:58:46.300248+0800 0xd5f86 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29485, /Applications/UES.app/Contents/MacOS/UES
What causes the pattern to be narrow?
1.Provisioning profile "xxx" doesn't include signing certificate "Developer ID Application: xxxxx".
2.Provisioning profile "xxx" doesn't match the entitlements file's value for the com.apple.developer.networking.networkextension entitlement.
I decoded the profile,
<dict>
<key>com.apple.developer.system-extension.install</key>
<true/>
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>packet-tunnel-provider-systemextension</string>
<string>app-proxy-provider-systemextension</string>
<string>content-filter-provider-systemextension</string>
<string>dns-proxy-systemextension</string>
<string>dns-settings</string>
<string>relay</string>
<string>url-filter-provider</string>
<string>hotspot-provider</string>
</array>
<key>com.apple.security.application-groups</key>
<array>
<string>xxxxx</string>
<string>xxxxx</string>
</array>
<key>com.apple.developer.networking.vpn.api</key>
<array>
<string>allow-vpn</string>
</array>
<key>com.apple.application-identifier</key>
<string>xxxxx</string>
<key>keychain-access-groups</key>
<array>
<string>xxxxx</string>
</array>
<key>com.apple.developer.team-identifier</key>
<string>xxxxx</string>
</dict>
Kindly help me to resolve this.
Hi Apple Developer Community,
I'm experiencing an issue with Family Controls entitlements for my iOS app that I'd like to discuss and see if others have encountered similar problems.
Background:
My app (BrightStart) uses Family Controls to help users build healthy morning routines by temporarily blocking distracting apps until they complete a sunlight exposure session. The core functionality relies on automatic time-based blocking (e.g., block social media apps from 6-8am daily).
The Problem:
I have Family Controls working perfectly in development builds, but I'm blocked from distributing via TestFlight due to entitlement issues with my Device Activity Monitor extension.
Technical Details:
Main app bundle ID: app.brightstart.app
✅ Has both "Family Controls (Development)" and "Family Controls (Distribution)" options available
Extension bundle ID: app.brightstart.app.BrightStartMonitorExtension
❌ Only shows "Family Controls (Development)" - no Distribution option
Error when archiving for TestFlight:
❌ Provisioning profile failed qualification
Profile doesn't support Family Controls (Development).
Family Controls (Development) feature is for development only.
Please use Family Controls (Distribution) for distribution.
Impact:
Cannot upload to TestFlight for beta testing
Native FamilyActivityPicker falls back to mock UI in distributed builds
Automatic scheduled app blocking (via DeviceActivityMonitor) doesn't function in production
Questions for the community:
Has anyone successfully gotten "Family Controls (Distribution)" enabled for a Device Activity Monitor extension?
Is this a known limitation, or should I expect this option to be available?
Are there alternative approaches for time-based automatic app blocking that work in distribution builds?
Should I contact Apple Support directly about enabling this entitlement for the extension?
Btw, Cursor wrote this summary above, so it could be just hallucinating the issue? Would really appreciate anyone's thoughts here.
we have organization account
I'm the admin of team. and i have additional resources:
Additional Resources
Access to Reports
Access to Certificates, Identifiers & Profiles.
Access to Cloud Managed Distribution Certificate
Create Apps
Generate Individual API Keys
Issues:
i can't find my team certificate in Xcode
I don't have access to https://developer.apple.com/account/resources/
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
I'm attempting to upload an updated version of our macOS app for distribution via the App Store. We've done this without issue before, but I am now receiving a warning when I upload the app via Transporter:
"Cannot be used with TestFlight because the signature for the bundle at “AXON Studio.app” is missing an application identifier but has an application identifier in the provisioning profile for the bundle. Bundles with application identifiers in the provisioning profile are expected to have the same identifier signed into the bundle in order to be eligible for TestFlight." (90886)
I just recently started seeing this warning when I upload our application via Transporter. Before this warning started happening, I was using the exact same process and scripts to build/package/codesign our application. NOTE: we are not using Xcode to build our application, so we can't take advantage of any codesigning/packaging automation provided by Xcode (the app is written in C#/.NET 6.0), so we are doing all build/package/codesign steps using the appropriate macOS command line utilities. Also, I have verified that the app bundle and its contents have valid signatures.
Does anyone have any idea what may have changed to cause this warning, or how I might go about determining the root cause so I can fix it?
I have created a Mac Catalyst version of the same app, and it was transferred from an old account to a new one. However, the Mac Catalyst build has been stuck in progress for several days when attempting to notarize it.
After many days, I got the rejection with the following error:
Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.
I have already tried to create a new developer ID certificate, but it still has the same issue. On the other hand, the iOS app is working fine and has been published in the App Store.
Could you please assist us in resolving this issue as quickly as possible? Your prompt help would be greatly appreciated.
productsign Command Appears to Succeed but Package has No Valid Signature
Category: Security, macOS, Code Signing
Question:
productsign command, when signing a PKG created with productbuild, appears to succeed with a success message (Wrote signed product archive to ...) but spctl verification results in rejected, source=no usable signature, indicating that the signature was not actually applied.
Details:
Goal: To sign a distribution package created with productbuild using a Developer ID Installer certificate.
Certificate Used:
Developer ID Installer: [Company Name] ([Team ID])
This certificate was issued by Previous Sub-CA and is not the latest G2 Sub-CA recommended by Apple. We cannot create a new G2 Sub-CA certificate as we have reached the limit of 5.
productsign Command:
productsign --sign "Developer ID Installer: [Company Name] ([Team ID])" [input.pkg] [output.pkg]
productsign Output:
Wrote signed product archive to [output.pkg] (Appears as a success message).
spctl Signature Verification:
spctl -a -vv [output.pkg]
Result: rejected, source=no usable signature
Notarization Service Results (Behavioral difference between Macs):
On Mac A, the submission status was Accepted.
On Mac B, the status was Invalid, with the notarization log message being The binary is not signed..
Troubleshooting Steps Taken:
We attempted to sign both component and distribution packages with productsign, and in both cases, the signature was not recognized by the system.
We skipped productsign and relied on the notarization service's auto-signing, but the notarization log still reported The binary is not signed., and the notarization failed.
We have confirmed that the certificate and private key are properly associated in Keychain Access.
My Questions:
Given that we are using an older Previous Sub-CA certificate and cannot create a new one, why does productsign appear to succeed when the signature is not being applied?
What could cause the behavioral difference where notarization is Accepted on Mac A but Invalid on Mac B?
Is this a known issue with Apple's tools, or is it possibly caused by the specific structure of our PKG?
What is the recommended workflow or debugging method to successfully sign and notarize a PKG under these circumstances?
Thank you for your assistance
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
Xcode
Gatekeeper
Signing Certificates
Developer ID
Hello,
I get this message when building from a .net maui app. I think I followed all the steps. I've downloaded my provisioning profile from developer.apple.com and my instructions (you tube) said to double click it and XCode will open. It does that but I don't see where the provisioning profile goes in xCode. I followed another link which told me to delete everything in /Users/username/Library/MobileDevice/Provisioning Profiles and after doing that I don't see any files reappearing when I click the provisioning profile from finder. Did I mess myself up following internet articles again?
I'm running XCode Version 16.2 (16C5032a) under accounts I can see my appleid linked but I don't see the provisioing profile I loaded.
Sorry very new at Mac development (and kinda cheating using Maui)
Save me apple gods,
Steven
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Your development team has reached the maximum number of registered iPhone devices.
I am use the free provisioning file.
So how can I delete old device and use my new iPhone to develop my app.
only way is use a paid account?
or register a new Apple ID?
Topic:
Code Signing
SubTopic:
General
Looking for some assistance and having an Apple Signing Certificate for our Audio Units Plugin.
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Xcode automatic signing consistently fails for the macOS target when adding the App Groups capability, even though the Developer Portal is correctly configured.
Error:
Provisioning profile “Mac Team Provisioning Profile: com.example.testapp.mobile” doesn’t support the App Groups capability.
Setup:
• Bundle ID: com.example.testapp.mobile
• App Group: $(TeamIdentifierPrefix)group.com.example.testapp.mobile
Troubleshooting Steps Tried (None Helped):
• Changed bundle identifiers and deleted/recreated them in the Developer Portal
• Deleted and recreated App Groups
• Removed and re-added the developer account in Xcode
• Deleted all provisioning profiles from the system
• Cleared Derived Data and Xcode caches
• Even tried on a clean macOS system
This setup used to work previously. The issue seems to have started after the Apple Developer account was renewed.
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
We have two memberships under the same account (Enterprise and Organization) and that both share the same Team Name, which is causing issues in iOS 18. as per latest email get from Apple regarding security update in iOS 18.
How can i get unique Team Names to my Enterprise and Organization memberships.
Where should i have to connect? Who can help ?
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
I’ve been having problems with MacOS builds. I’m making a release Appstore build and uploading it to Testflight. However when running it instantly crashes, and report screen shows the following:
Current flow:
I sign all files in PlugIns/ (we have a number of .bundle), and I’ve tried combinations of signing with/without --entitlements, as well as with/without --deep.
After this I sign Frameworks/GameAssembly.dylib and Frameworks/UnityPlayer.dylib. Again, I’ve tried combinations of with/without --entitlements and --deep, also not signing them at all.
After signing PlugIns and frameworks, I sign the .app, also tried this with/without --deep (always with --entitlements).
Finally I make a .pkg and upload to Testflight.
It’s not the game, as I can make an enterprise version that runs fine.
We have some restricted entitlements, such as Apple Arcade.
Building from an M1 mac, and architecture is Universal (Intel + ARM).
Unity documentation says to use --deep, but Apple documentation highly recommend against it.
So basically, my question is, how and in what order should I sign the files?
Much obliged!
I have an app that runs as a status bar app, mostly. I have set the following in the info.plist file for the app:
<key>Application is agent (UIElement)</key>
<true/>
However, I get a compile error:
Provisioning profile Mac Team Provisioning Profile: yout.Drive doesn't include the Application is agent (UIElement) entitlement.
Checking the entitlements, I do not see this entitlement anywhere. Where and how do I set this?