ITMS-90238: Invalid Signature - The main app bundle Tren at path Tren.app has following signing error(s): a sealed resource is missing or invalid

Question

Created Mar ’24

Replies 1

Boosts 0

Participants 2

Hello, I'm create an app using QT on MacOs with Generate to Xcode, when submitting it to the App Store the upload process was successful but I got email feedback with the message containing the following:

ITMS-90238: Invalid Signature - The main app bundle Tren at path Tren.app has following signing error(s): a sealed resource is missing or invalid . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html and Technical Note 2206 at https://developer.apple .com/library/mac/technotes/tn2206/_index.html for more information.

ITMS-90296: App sandbox not enabled - The following executables must include the 'com.apple.security.app-sandbox' entitlement with a Boolean value of true in the entitlements property list: [[Tren.app/Contents/MacOS/Tren ]] Refer to App Sandbox page at https://developer.apple.com/documentation/security/app_sandbox for more information on sandboxing your app.

I've done the methods available in the community, but it still doesn't work. I hope someone will provide a solution, thank you

Boost

Answer 1

DTS Engineer OP

Apple

Apr ’24

Ignore the second error for the moment. You’ll need to fix the first error before you can tell whether it’s relevant.

My standard practice for debugging such problems is:

Choose Product > Archive to build an Xcode archive for your product.
Use the Xcode organiser to upload that to App Store Connect.
Confirm that you get the same error.
Use the Xcode organiser to export an App Store compatible installer package (.pkg).
Use Transporter to upload that to App Store Connect.
Confirm that you get the same error.
Now that you’ve confirmed that the installer package accurately reflects the problem, extract your app from that installer package [1].
Use codesign to check its signature:

% codesign -d -vvv --deep --strict /path/to/your.app

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] I use a third-party app for this, but you can do it from the command line using the techniques shown in Unpacking Apple Archives.

0