External Dylib load failing

Question

Created Aug ’20

Replies 1

Boosts 0

Participants 2

Hi,

I've an Application Bundled and signed from the Xcode signature options ( runtime hardening is disabled ). The Application has a provisioning profile with Apple.

We do have dylibs on different workspace/projet that we include in the Framework, library dependencies on link modules.

We tried to disable library-validation using the Xcode option switch. But it always fails with CODESIGNING, Code 0x2

Following is the code signature of the Bundled App -
Identifier=com.forcepoint.ep.ESDaemonBundle

Format=app bundle with Mach-O thin (x8664)

CodeDirectory v=20200 size=1312 flags=0x0(none) hashes=33+5 location=embedded

VersionPlatform=1

VersionMin=659200

VersionSDK=659204

Hash type=sha256 size=32

CandidateCDHash sha256=6036f59a3467b84e3195fb59424a08fd0c738716

CandidateCDHashFull sha256=6036f59a3467b84e3195fb59424a08fd0c738716b6414171f908486a4e33446b

Hash choices=sha256

CMSDigest=6036f59a3467b84e3195fb59424a08fd0c738716b6414171f908486a4e33446b

CMSDigestType=2

Page size=4096

CDHash=6036f59a3467b84e3195fb59424a08fd0c738716

Signature size=4657

Authority=Developer ID Application: WEBSENSE, INC. (C489D5E8E8)

Authority=Developer ID Certification Authority

Authority=Apple Root CA

Signed Time=Aug 18, 2020 at 11:18:30 AM

Info.plist entries=19

TeamIdentifier=C489D5E8E8

Sealed Resources version=2 rules=13 files=1

Internal requirements count=1 size=224

Following is the library signature --

Executable=/Users/mani/GITS/epm-f1e/build/libMsgCom.dylib

Identifier=libMsgCom

Format=Mach-O thin (x8664)

CodeDirectory v=20200 size=553 flags=0x0(none) hashes=13+2 location=embedded

Hash type=sha256 size=32

CandidateCDHash sha256=db2c196b6d8bdf469968679e7f94a85a5750bea1

CandidateCDHashFull sha256=db2c196b6d8bdf469968679e7f94a85a5750bea1f550b6acedbb1c3d26865545

Hash choices=sha256

CMSDigest=db2c196b6d8bdf469968679e7f94a85a5750bea1f550b6acedbb1c3d26865545

CMSDigestType=2

CDHash=db2c196b6d8bdf469968679e7f94a85a5750bea1

Signature size=4657

Authority=Developer ID Application: WEBSENSE, INC. (C489D5E8E8)

Authority=Developer ID Certification Authority

Authority=Apple Root CA

Signed Time=Aug 18, 2020 at 10:21:51 AM

Info.plist=not bound

TeamIdentifier=C489D5E8E8

Sealed Resources=none

Internal requirements count=1 size=204.

Any help would be much appreciated.

Any links or books that explains all of these would be great too !

Thanks much,
Prokash

Boost

Answer 1

DTS Engineer OP

Apple

Aug ’20

Based on the name of your process I presume that you’re building an EndpointSecurity client. If so, be aware that ES clients are not allowed to disable library validation.

If these libraries ship as part of your product, you should solve this problem by signing them with the same signing identity as your sign the main product.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

0