Unable to install system extension

Question

Created Aug ’20

Replies 2

Boosts 0

Views 2.2k

Participants 2

I have created network system extension. Initially I have used automatic signing and it takes Apple development certificate by default.

Now I want to share this extension with other people. To share with other I have start notarization process.

During notarization I have observed that system extension must me signed with Developer Id certificate.

I have force signed the extension again with Developer Id certificate from terminal. After code signing when I have launch the application it gives me "Invalid code signature or missing entitlements" error.

I have tried to signed extension from Xcode and it gives

Extensioncontainer has conflicting provisioning settings. Extensioncontainer is automatically signed for development, but a conflicting code signing identity Developer ID Application has been manually specified. Set the code signing identity value to "Mac Developer" in the build settings editor, or switch to manual signing in the Signing & Capabilities editor.

How to remove this conflict and properly code sign system extension with Developer Id certificate.

Boost

Answer 1

Systems Engineer OP

Apple

Aug ’20

Accepted Answer

When moving from Development signing in Xcode to signing and Notarizing with Developer ID you will need to ensure that the entitlements between your signed binary and the Developer ID provisioning profile match. For example, take a look at the entitlements on the Developer ID provisioning profile and then the entitlements that are signed with the app. Because you are using is a Network System Extension your will now see -systemextension added to the end of the entitlement string in the provisioning profile. The entitlements in your app, or signed binary, need to match these values in your provisioning profile. A concrete example for using a Content Filter would be:

Code Block <string>content-filter-provider</string>
<string>content-filter-provider-systemextension</string>

This is a common issue when dealing launching a receiving a crash that indicates: "Invalid code signature or missing entitlements."

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

1

Answer 2

Sam96 OP

Aug ’20

Thanks meaton.

I have not cerated provisining profile after adding NetworkExtension capability for my container application and extension. That time I have used Automatic signing and xcode creates provisning profile for me but now when I have tried to codesign the applications with Developer id application certificate it gives me profile related error. Do I need to create new profile for both applications?

0