SystemExtension: Network Extension entitlements

According to the description of this answer I have been able to successfully load the Debug version.

But when I try to use the Developer ID to sign my NetworkExtension , I met a problem, so i manual add "-systemextension" suffix (content-filter-provider-systemextension) in a new entitlements file for Release.

but when i trying to install it ,i get this error message
Error Domain = OSSystemExtensionErrorDomain Code = 9 "(null)" .

And I get the same error when I try to retest the Debug version.

so, can anybody give me some suggestion, thinks!

csrutil status
System Integrity Protection status: unknown (Custom Configuration).

Configuration:
Apple Internal: disabled
Kext Signing: disabled
Filesystem Protections: disabled
Debugging Restrictions: disabled
DTrace Restrictions: disabled
NVRAM Protections: disabled
BaseSystem Verification: enabled

systemextensionsctl developer off

spctl -a -t open --context context:primary-signature -v &(appname)
&(appname): accepted
source=Notarized Developer ID
Answered by WangZiYuan in 650477022

hi  meaton:
Thank you for your reply.
I have found other error messages in the system log.
It is the value of NEMachServiceName that causes the load to fail, and it must be prefixed by the value in app Groups

Regarding:

but when i trying to install it ,i get this error message
Error Domain = OSSystemExtensionErrorDomain Code = 9 "(null)" .

This indicates OSSystemExtensionErrorCodeSignatureInvalid with your code signature.

<https://developer.apple.com/documentation/systemextensions/ossystemextensionerrorcode/ossystemextensionerrorcodesignatureinvalid?language=objc>

Something about how you signed and Notarized your release version is giving you problems.
My recommendation would be to ensure that SIP is enabled and check to make sure that your app is completely signed. For example, everything included in your /Contents directory.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Accepted Answer

hi  meaton:
Thank you for your reply.
I have found other error messages in the system log.
It is the value of NEMachServiceName that causes the load to fail, and it must be prefixed by the value in app Groups

SystemExtension: Network Extension entitlements
 
 
Q