Hi, I've an OSX app packages up outside of XCode (because it's based on a legacy cross-platform build system). The layout looks like this: App App/Contents <- info.plist is here App/Contents/Frameworks <- Dylibs go here App/Contents/MacOS <- Main executable and bash startup script go here App/Contents/Resources <- Non-executable resources. There are no helper apps, etc that I know of. info.plist, the Frameworks, Main Executable and App are all signed. The Main Executable includes entitlements with the sandbox entitlements. On startup, we crash in the usual Sandbox place: 0 libsystem_secinit.dylib 0x7ff811fcc2a5 _libsecinit_appsandbox.cold.9 + 49 1 libsystem_secinit.dylib 0x7ff811fcb636 _libsecinit_appsandbox + 1749 2 libsystem_trace.dylib 0x7ff8044029e9 _os_activity_initiate_impl + 50 3 libsystem_secinit.dylib 0x7ff811fcaf20 _libsecinit_initializer + 67 4 libSystem.B.dylib 0x7ff811fe08a1 libSystem_initializer + 292 5 dyld 0x20905939f invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const::$_0::operator()() const + 185 (Even though I'm not signing the bash startup script, which invokes the main executable, it's still getting signed and has entitlements. And I'm not using --deep. I've tried setting com.apple.security.inherit - that didn't work. I've tried explicitly signing the bash startup script - that didn't work. It fails not matter how I start the app - by clicking on it, command line, just launching the main executable via the command line, and of course using LLDB. Any ideas? Crash report enclosed. ProgUhost-2024-02-17-171425.ips

Hello, we have a universal app that runs on iOS and iPadOS today but we're having an issue where it crashes on launch on visionOS. When I try to run our app, I see messages like these in the console logs: AMFI: constraint violation /private/var/containers/Bundle/Application/***/***.app/Frameworks/***.framework/*** has entitlements but is not a main binary I see these for what seems to be all of our internal frameworks, we use cocoapods for all of these. The following output is from running: codesign -d --entitlements :- ***.framework <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict></dict></plist> Why would this cause a crash on launch for visionOS, but not iOS or iPadOS? Why does AMFI think there are entitlements for the framework when they are empty?

Since the macOS 14.2 update, services installed with SMAppService are required to be sandboxed when the main app is sandboxed as well (113037504). I had developed a daemon to communicate with the pmset interface, as that requires root privileges to make changes. Since the macOS 14.2 this daemon executable has to be sandboxed as well if I want my main app to be sandboxed. When sandboxing the daemon, it requires a temporary exception entitlement as the pmset command writes to one of the following two preference located in /Library/Preferences/: com.apple.PowerManagement.plist com.apple.PowerManagement.{UUID}.plist The specific command I use writes to the latter, which includes some specific UUID, that is specific to that device. When I use the: com.apple.security.temporary-exception.shared-preference.read-write entitlement with com.apple.PowerManagement.0000 where 0000 is the exact UUID string as on my Mac, the daemon is able successfully use the pmset command. This results however in that on other user devices it would not work as the UUID in the preference name would be different. When I try setting it to a wildcard variation such as com.apple.PowerManagement.*, the command doesn't run anymore as this format for the exception entitlement seems to be unsupported. My question is now, is there any way to get an exception entitlement which accounts for the unique identifier or is that impossible and must I disable the sandbox altogether? (as I have to use a daemon, I am not developing for the Mac App Store and a sandbox isn't strictly necessary so it wouldn't break my app. Its more I would prefer to use sandboxing if possible) Thanks in advance! For reference, this is the error I get when the entitlement is set incorrectly or not set: rejecting write of key(s) AC Power in { com.apple.PowerManagement.0000, kCFPreferencesAnyUser, kCFPreferencesCurrentHost, /Library/Preferences/com.apple.PowerManagement.0000.plist, managed: 0 } from process 15694 (pmset) because setting preferences outside an application's container requires user-preference-write or file-write-data sandbox access

I'm trying to run the Checking IDs with the Verifier API Sample Code. The display request app works fine but when i try to run the data request app i get this error for provisioning profile : Provisioning profile "iOS Team Provisioning Profile: com.example.apple-samplecode.verifier-api-sample-data-requestRPTDZQM3C9" doesn't include the com.apple.developer.proximity-reader.identity.read entitlement. and I'm not able to fins how to add this entitlement to the app. I tried to add it from capabilities but it's not available there, only the tap to present ID on iPhone (Display Only) is available. Is this entitlement restricted to a specific country or I need to request access to it from somewhere? or Is there anyway to add it to run the app?

I am using Godot 4.2.1 and C# (.NET 8.0.1) to create an app. In Godot the app is exported to an XCode project so it can then be built to run on IOS devices. Access WiFi is checked in the Godot presets I have the multicast entitlement from Apple. Communication over UDP using Unicast to send and receive packets works correctly on iOS, macOS and Android devices. To set the multicast entitlement, the project name is selected in XCode, to open a big dialog box with multiple tabs. Click on the tab Signing and Capabilities. To add the multicast to the project "+ Capability" is clicked, search for "multi" which brings up multicast networking. Click on multicast networking to add it to the project. Then in the same dialog box, click the tab build settings and under "Signing" code signing identity is changed to iOS developer for all Debug and release items. The project is then built and run on the iOS device. The symptom is that no multicast packets are received. The multicast receiving code below works on macOS and Android devices so there must be something going on with the iOS devices that I'm missing. The UDP server is configured in C# code as a _listener: private const string MULTICAST_ADDRESS = "239.255.1.1"; private const int BCON_PORT = 49707; _listener = new UdpClient(); _listener.ExclusiveAddressUse = false; _listener.JoinMulticastGroup(IPAddress.Parse(MULTICAST_ADDRESS)); _listener.Client.Bind(new IPEndPoint(IPAddress.Any, BCON_PORT));

I want to build an iOS VPN app for personal use only, so I need to add the NetworkExtensions capability (according to my understanding) From Apple's documentation on "Adding Capabilities to Your App": The platform, and whether you're a member of the Apple Developer Program, may limit the capabilities available to your app The documentation doesn't explicitly say which capabilities require being a part of the Apple Developer Program. I also don't see why I'd need to be a part of the Apple Developer Program to write software for personal use. Note that, at least to my knowledge, the NetworkExtensions capability does not depend on any service from Apple (as opposed to HealthKit or Game Center). So is there a way to add a Network Extensions capability to an iOS app without joining the Apple Developer Program?

Hello, I requested entitlement 4 times from 4 days ago. But I did not get any kind of response mail. I need entitlement for only development, to check file IO events. Is there any way to request entitlement ? Regards, Daehong

When we added a com.apple.developer.associated-domains entitlement to our apps, they crash on launch with a code signing error on our old 2011 Mac running 10.13.6 High Sierra. The signature is accepted on current Macs, and the associated domains do work. The command line utilities say everything is ok, the entitlement is in the signature and the embedded profile. The apps will run fine on High Sierra without the entitlement. The only guess I have is perhaps High Sierra is rejecting any unknown entitlement? The error is Code has restricted entitlements, but the validation of its code signature failed. Unsatisfied Entitlements: No Unsatisfied Entitlements are listed. Removing the entitlements from the signature lets the apps run on High Sierra.

Years ago, JSCore on non-macOS disabled JIT, leading to much worse performance than could possibly be achieved with JIT on. Has anything changed recently to permit greater optimizations for JSCore on mobile platforms? (iPadOS, visionOS). My guess is ”no” since the docs still llist only macOS under the MAP_JIT flag, but as far as I know, Apple could still choose to enable JSCore optimizations behind the scenes if this option were available to developers.

Hi, our account holder did the networking.multicast entitlement request on November 24th through the appropriate form: https://developer.apple.com/contact/request/networking-multicast but we never received any kind of answer, positive or negative. We also tried to submit again the request 3 weeks ago and still no answer. I already checked if the entitlement was granted without an answer and we don't have it. I tried to write also with the feedback assistant but no answer. What I can do to unblock this situation?

I am developing a Mac application. Within this application, I need to execute certain commands and expressions with root privilege access. I am working to perform this action, and once authenticated, it should persist throughout the entire app lifecycle. Similar to allowing keychain access for Xcode applications by selecting the 'Always allow' permission. Please let me know: 1. Is it possible for a third-party application to exhibit such behavior? 2. If it is possible, what type of permissions do I need to set? 3. Do I need any specific entitlements for this? Thank you for your insights and assistance. Your responses are highly valued, and any guidance you can provide will be greatly appreciated.

There are several questions regaring the following guide about Interoperability requests in the EU. Will other developers be able to use all the APIs that have been created? For non-EU applications? If it's a private API, would there be a list of all the APIs that have been implemented to see who has which one? Will there be a difference in priority between feature requests submitted through Feedback Assistant and interoperability requests?

Hi All, I would like to know if the 'deferred deep link' feature is compatible with the apps hosted in the Enterprise App Store. A 'deferred deep link' is intended to direct the user to the App Store page, where they can download the app. During the initial startup, SFSafariViewController is expected to provide the URL parameters passed as part of the deep link. I would appreciate your assistance in confirming whether the 'deferred deep link' functionality will work seamlessly if we use Enterprise Appstore for distribution. Thanks and regards, Sujith Joseph

Hello! I have never distributed an apple app before. Right now, I am trying to distribute a macOS app. I created a provisioning profile of type "Developer ID Application" and it has the following capabilities enabled. Now, when I download the profile and use it for my app, xcode gives me the following error: Lmk what I need to do since I am super unfamiliar with this process.

Hi, Need information on the Esim entitlement, we are planning to get the Esim Entitlement for our App, as part of the same when we try to submit there is field "Carrier Partner Team ID" while trying to submit request, we have reached out to our carrier on the same, meanwhile would like to understand what the field is refers for. Regards, Sunil Reddy.

I am a novice Swift developer. Referring to the Apple developer documentation and various blogs, I have written example code for DNS Proxy in Network Extension. I inherited NEDNSProxyProvider to create a DNSProxyProvider class in the Extension. Using NEDNSProxyManager and NEDNSSettingsManager, I created a simple app that calls saveToPreferences(...) after loadFromPreferences(...). When saveToPreferences(...) is called, I can confirm that the "DNS Proxy" item is added to the "System Preferences" in the "Enabled" state. However, upon further inspection using console logs, it seems that the init() constructor and startProxy(...) function of DNSProxyProvider are not being called. Additionally, upon checking the console logs: NESMDNSProxySession[Primary Tunnel:MyMyService:{GUID}:(null)] in state NESMVPNSessionStateStarting: plugin NEDNSProxyPlugin(xxxxx.xxxxxx.MyMyService[inactive]) started with PID 0 error Error Domain=NEAgentErrorDomain Code=2 "(null)" These logs are present. Could they be related to the issue? I tried to refer to the link below that seems like a similar issue, but I couldn't find a clear solution or hint. https://forums.developer.apple.com/forums/thread/130063 https://developer.apple.com/forums/thread/680905 https://developer.apple.com/forums/thread/675304 https://developers.apple.com/forums/thread/652708 https://developer.apple.com/forums/thread/678399 I earnestly seek your assistance. Thank you.

I am developing a carkey application. I have applied to MFi and have obtained a com.apple.developer.carkey.session entitlement. By setting session in Entitlement.plist, the program I created can call CarKeyRemoteControl.start and obtain the session. However, even if VehicleReport() is called, information cannot be obtained and the return value is always empty. In the iPhone standard Wallet, a button is displayed below CarKey, and you can lock and unlock it. My question is, com.apple.developer.carkey.session is set in Entitlement.plist, but do I need to set anything else, such as manufacturerIdentifier? . Also, if I need it, what format should I use? for example, What should I do if I want to specify "TEST" for manufacturerIdentifier?

I would like the ability to add to the menu. I can add to the share sheet, but is there something special Chrome gets? Maybe there is an entitlement to add? Thanks, Rob

When I try to submit the app, I get the following error. Is there a way to solve this? Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'UIRequiresFullScreen' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'CFBundleDisplayName' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'UIMainStoryboardFile' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'MinimumOSVersion' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'NSCameraUsageDescription' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'NSPhotoLibraryUsageDescription' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'XSAppIconAssets' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'UILaunchStoryboardName' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'UIStatusBarHidden' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'CFBundleIdentifier' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'UIDeviceFamily' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'CFBundleShortVersionString' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'CFBundleName' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'UISupportedInterfaceOrientations' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'CFBundleVersion' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported. Asset validation failed (90045) Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, key 'NSPhotoLibraryAddUsageDescription' in 'Payload/MyApp.iOS.app/MyApp.iOS' is not supported my Info.plist is And my Entitlements.plist is

I am trying to automatically provision my project within Visual Studio 2022. I successfully connected to my apple dev account. When choosing to account within Configure Automatic Provisioning dropdown, I am getting the following error: There was an error while trying to automatically provision the project: 'You are not allowed to perform this operation. Please, check with one of your Team Admins, or, if you need further assistance, please, contact Apple Developer Program, https://developer.apple.com/support' My team Admins asked me to contact apple. Please help!!!