Stapling fails when executed from build server

I'm using a Jenkins Build Server on a Mac Mini running Catalina 10.15.6 to build two macOS apps with almost identical setups (two versions of the same app basically) and so far this has worked well.

When I wanted to build a new version yesterday one of the targets built successfully while the second failed during the stapling phase. The notarization is done from a Python script and the notarization per se worked for both targets and returned no error.

"xcrun stapler staple <target.app>" returns the following error description when executed from the build script for one of the targets:

Processing: <target.app>
Certificate trust evaluation did not return expected result. (5) [leaf AnchorApple AnchorTrusted ChainLength IntermediateMarkerOid LeafMarkersProdAndQA SSLHostname ServerAuthEKU ValidityPeriodMaximums]

Certificate trust evaluation for 24.134.186.233 did not return expected result. CSSMERRTPNOTTRUSTED.

Certificate trust evaluation did not return expected result. (5) [leaf AnchorApple AnchorTrusted ChainLength IntermediateMarkerOid LeafMarkersProdAndQA SSLHostname ServerAuthEKU ValidityPeriodMaximums]

Certificate trust evaluation for 24.134.186.233 did not return expected result. CSSMERR
TPNOTTRUSTED.

Could not establish secure connection to api.apple-cloudkit.com
error is Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLStringKey=<NSLocalizedDescription=cancelled, NSErrorFailingURLKey=<URL I'm obviously not allowed to post here>

CloudKit's response is inconsistent with expections: (null)
The staple and validate action failed! Error 68.

Any idea what might be causing this?
When I'm running the "xcrun stapler staple <target.app>" command from the Terminal it works but it has worked from the build script before and it also works for the other target. I'm a bit lost as I don't know what to look into. Thanks in advance!


Did you ever find a solution for this? I am having the exact same problem all of sudden (began this week) on my Jenkins build server.

stapler fetches notarised tickets from CloudKit. This error suggests that your build server is unable to access CloudKit safely. My best guess is that your build server has some sort of TLS inspection technology employed — either on the Mac itself or on the network to which the Mac is attached — such that the TLS connection is not trusted by CloudKit.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thank you for the response and clarification. Oddly enough, the builds from today began working again, so potentially it is an intermittent issue, somewhere ... either on my server, with the Cloudkit server, or something in between. In any case, this gives me a much better idea of where to go hunting next time this happens. Cheers! - Rob / MOK

Stapling fails when executed from build server
 
 
Q