CFBundleIdentifier Collision submitting app with Canon EDSDK

A 100K foot question.

I am trying to submit this for notarization so I can distribute the App on the Mac App Store. I believe this requires that I bundle the framework within my App. Is that the way Apple foresees signed 3rd party frameworks being distributed? 

The notarization process appears to require everything so bundled to have unique identifiers and be signed with my Developer Certificate. It seems to ignore "Disable Library Validation Entitlement” even though it is listed as one of the App’s entitlements. However, changing the signing and identifiers breaks the framework.

How are other users of 3rd party frameworks handling this?

I didn’t respond to your App Store submission issue because I don’t have an immediate answer for that. However, I can answer your Developer ID issue. You wrote:

Is that the way Apple foresees signed 3rd party frameworks being distributed?

Yes.

While the notary service and Gatekeeper require that your product be signed with a valid Developer ID, they don’t require that all code use the same Developer ID. Having said that, using different Developer IDs is not the standard path. You are responsible for the behaviour of any code that you install, and thus you should sign it as your code. At a practical level:

• This simplifies your library validation story.

• Bundling the framework within your app simplifies your app install and uninstall story.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

So if someone could suggest a procedure to remove the signing on a 3rd party framework (including the two included bundles) and replace it with my own signing then that would solve the problem. I could also remove the "Disable Library Validation" and run with a fully hardened runtime.

The parts all have valid Canon signatures and do not need (should not be) replaced with my own certificate because they are not my code.

IMO this is the correct option. If you’re distributing code as part of your product, you should sign it as your code because you are responsible for the behaviour of that code.

I could also remove the "Disable Library Validation" and run with a fully hardened runtime.

IMO this is an incorrect approach. Disabling library validation only makes sense in a limited set of circumstances [1] and using a third-party framework is not one of them.

So I am pretty well stuck at this point.

Indeed. Given the complexity of this issue I recommend that you open a DTS tech support incident so that I can help you one-on-one.

Make sure to include a reference to this DevForums thread, just for context.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] For example, when your app has to load third-party plug-ins that are distributed independently.

Indeed. Given the complexity of this issue I recommend that you open a DTS tech support incident so that I can help you one-on-one.

Make sure to include a reference to this DevForums thread, just for context.

OK That was going to be my next step. Once I get a solution this is worthy of an Apple Tech Note because I have seen this same problem multiple times.

I could also remove the "Disable Library Validation" and run with a fully hardened runtime.

IMO this is an incorrect approach. Disabling library validation only makes sense in a limited set of circumstances [1] and using a third-party framework is not one of them

I think this was caught in a double negative. I currently have to use Disable Library Validation since my current build uses the Library with Canon Signing. If I change the signing to my own then I will be able to run with a fully enabled Hardened Runtime

I verified that I can (and should) resign the 3 parts as follows. Doing so allows you to run with a fully hardened runtime.

where Ψ is the name of an apple distribution certificate

my-machine  Framework % codesign -vvv -f --remove-signature EDSDK.framework/Versions/A/CHHLLite.bundle 
EDSDK.framework/Versions/A/CHHLLite.bundle: replacing existing signature
EDSDK.framework/Versions/A/CHHLLite.bundle: signed  []

my-machine  Framework % codesign -vvv -f --remove-signature EDSDK.framework/Versions/A/EdsImage.bundle 
EDSDK.framework/Versions/A/EdsImage.bundle: replacing existing signature
EDSDK.framework/Versions/A/EdsImage.bundle: signed  []

my-machine  Framework % codesign -vvv -f --remove-signature EDSDK.framework/Versions/A/EDSDK          
EDSDK.framework/Versions/A/EDSDK: replacing existing signature
EDSDK.framework/Versions/A/EDSDK: signed  []


my-machine  Framework % codesign -f -v -s Ψ EDSDK.framework/Versions/A/EdsImage.bundle
EDSDK.framework/Versions/A/EdsImage.bundle: signed bundle with Mach-O thin (x86_64) [com.canon.EdsImage]

my-machine  Framework % codesign -f -v -s Ψ EDSDK.framework/Versions/A/CHHLLite.bundle 
EDSDK.framework/Versions/A/CHHLLite.bundle: signed bundle with Mach-O thin (x86_64) [jp.co.canon.CHHLLite]

my-machine  Framework % codesign -f -v -s Ψ EDSDK.framework/Versions/A/EDSDK          
EDSDK.framework/Versions/A/EDSDK: signed bundle with Mach-O thin (x86_64) [com.canon.edsdk]

In Xcode you should select Frameworks, Libraries,.. to "embed and sign", Link Binary with libraries, and Embed Frameworks

Note that the subject issue remains open.

Another CFBundleIdentifier Collision threads such as https://developer.apple.com/forums/thread/73528 can be marked as a duplicate.

At the request of Apple DTS I submitted FB9567844.

I met with the App Store Connect folks this morning. They indicated they understood my problem.