[7268:372225] Failed to create an FPSandboxingURLWrapper for file:///Users/####/Downloads/mod##06-9-19.pdf. Error: Error Domain=NSPOSIXErrorDomain Code=1 "couldn't issue sandbox extension com.apple.app-sandbox.read-write for 'file:///Users/####/Downloads/mod##06-9-19.pdf' PS- Used ### to hide info I am facing an error with apple sandbox in my dot NET MAUI project here is the entitlements file I don't know Why I'm getting the in my understanding with user-selected.read-write it should work

I distribute an application in a zip file from my website. the application needs access to some files next to it to run properly. The application is correctly signed and notarized and stapled.Of course if I download it from my website, it gets the quarantine attribute. When I try to open it for the first time, a gatekeeper warning saying that the application comes from the internet, but has been checked by apple and no malware has been detected is displayed. My impression is that the application has been correctly signed and notarized. but If confirm that I wan to open it, the quarantine attribute is not deleted. spctl -a -v /path/to/Myapp.app path/to/Myapp.app: accepted source=Notarized Developer ID

I'm currently befuddled by the entire signing and certificate process. I don't understand what I need, what the team admin needs to do, or how to go about doing it so that I can build the project. We've managed to have this working in the past but I guess the system has changed somewhat. Here's what we have going: A Unity project which hasn't changed from a few years ago. I build the project in unity, open the Xcode project and this: There's an issue with the Signing and Capabilities. If I choose automatic setup it shows an error saying that it requires a development team. I had the account admin add my Apple ID to the team so I'm not sure why that's an issue still. Do I need to pay the 99$ to be able to building Xcode? If I try to do it manually I select the provisioning profile that the account admin sent me and it auto selects the team associated with the provisioning profile I guess but then there's no singing certificate. The error says: There is no signing certificate "iOS Development" found. No "iOS Development" signing certificate matching team ID "V7D5YBZRMV" with a private key was found. So, if someone could explain to me like I'm 5 the entire signing and certificate process is and let me know what we're doing wrong with the team/provisioning profile/certificate setup I would be very much appreciative.

Hi, I have added associated domains support for our desktop app and it works fine on my machine. But when I deploy it on other machines, it is not launching. It throws ‘The application ““ can’t be opened” message. It works fine when I install provisioning profile on those machines. Xcode is not allowing me to code sign the app manually as part of build process. Till now we were dong the same for other apps. Associated domain need a provisioning profile and I have created one distribution profile and code signed it. Now it works fine only on my machine and not working on other machines. It works only on other machines if I install provisioning profile. What should be the issue? How do I work this macOS app on other machines without installing provisioning profile?

Hello, I am having some trouble with an application accessing and running SQlite database queries. The error I am getting is (5642) SQLITE_IOERR_SEEK when trying to sqlite_step_stement in the database. See https://www.sqlite.org/rescode.html#ioerr_seek A bit of background, it is an application in Unreal Engine, and everything was working fine in Unreal Engine 4. The application uses a SQlite database on disk to store and fetch data. This database is saved to the documents folder. (I also tried other folders to see if that would make a difference) But since switching to a new version of the engine, Unreal Engine 5, in a build I am getting errors when trying to read/write to the database. This only happens in a build .app file. The only big difference I can find is that in the new engine when making a build the codesigning is already done in the engine. I don't see why those settings would break anything though. It also has an entitlements file, but I also edited it and made sure it has the same entitlements settings as my own scripts that are run afterwards. I am overwriting the codesigning with our own CI/CD scripts afterwards. The .app file is codesigned, notarized and stapled by that script. Also I use an entitlements file to set certain values. It doesn't seem to be a code related issue, as everything is working fine when running the application "in editor". But only when creating a final .app build. It doesn't matter if this build is in Debug or Shipping. My first thought was to try more entitlements settings. But I tried the following and I am still getting the same errors: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.security.cs.debugger</key> <true/> <key>com.apple.security.cs.disable-executable-page-protection</key> <true/> <key>com.apple.security.cs.disable-library-validation</key> <true/> <key>com.apple.security.automation.apple-events</key> <true/> <key>com.apple.security.app-sandbox</key> <false/> <key>com.apple.security.cs.allow-dyld-environment-variables</key> <true/> <key>com.apple.security.cs.allow-jit</key> <true/> <key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/> <key>com.apple.security.files.downloads.read-write</key> <true/> <key>com.apple.security.network.client</key> <true/> <key>com.apple.security.network.server</key> <true/> </dict> </plist> I also am thinking that it might be a different issue as the application is able to create a database file in the documents folder, just not able to do the read write inside the database. These values are just set to try if any of these settings "fix" the issue, but thus far no luck. As there is nothing I can find in Unreal Engine related forums, and I also do not have a lot of experience with all the options when making Mac builds. I was hoping someone on this forum could think of a reason why a .app file would have problems with reading and writing to a SQlite database.

I have an non-appstore application, using developer id which I want to transfer to another developer account. How can I go about doing this? How do I transfer the app ID? Will past versions of that app signed with the old account continue to work? Will I have to re-sign them?

I have two apps written in MAUI Mac Catalyst Framework -- one is main app, second is app updater. My updater works this way: it is located in the same directory as main app: firstly it deletes MainApp.app/Contents folder, then unzips new Contents folder that was downloaded from server. I added NSUpdateSecurityPolicy dictionary as in https://developer.apple.com/documentation/bundleresources/information_property_list/nsupdatesecuritypolicy and create application like . It looks that I wrote everything fine pkgbuild --install-location '/Library/Application Support/First' --root root --ownership preserve # aslo signing, etc But on user's macOS, system does not allow to delete Contents folder: I have IO_Access denied exception. Can it be because main app is sandboxing or something else? What I can do wrong? Thanks a lot in advance!

Hey guys! Please, its not possible to remove or reuse an identifier (new app by removing the old one) through the developer portal? https://developer.apple.com/account/resources/identifiers/list Everytime we try to remove there is a message we can't: There is a problem with the request entity The App ID 'xxxxxxxxxxx' appears to be in use by the App Store, so it can not be removed at this time. But the app has been removed!!! Does anyone knows how to delete/reuse an identifier by doing some action in the portal? NOTE: we are low code - no Xcode (yes, so poor) Thank u guys!

I am not enrolled in the Apple developer program and need to create a small Safari app extension helper that will be shared with my colleagues within the company. Is it somehow possible for me to distribute the app in some way without forcing everyone to disable a gatekeeper?

I have two apps that installed by .pkg . They are both signed by Developer Application . One of my apps has purpose of updating another app. It is implemented by deleteting it from folder, and unzipping archive with new .app to it's folder. Even if new app is signed and notarized, has stepled ticket on it, I get error "App is damaged and can't be opened". In Secrity and Confidentiality preferences I have warning that developer is unauthorized, even if this new app is notarized and signed. How can I implement app update to not throw error that app is damaged> Thanks a lot in advance

Hello, I'm create an app using QT on MacOs with Generate to Xcode, when submitting it to the App Store the upload process was successful but I got email feedback with the message containing the following: ITMS-90238: Invalid Signature - The main app bundle Tren at path Tren.app has following signing error(s): a sealed resource is missing or invalid . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html and Technical Note 2206 at https://developer.apple .com/library/mac/technotes/tn2206/_index.html for more information. ITMS-90296: App sandbox not enabled - The following executables must include the 'com.apple.security.app-sandbox' entitlement with a Boolean value of true in the entitlements property list: [[Tren.app/Contents/MacOS/Tren ]] Refer to App Sandbox page at https://developer.apple.com/documentation/security/app_sandbox for more information on sandboxing your app. I've done the methods available in the community, but it still doesn't work. I hope someone will provide a solution, thank you

I am having trouble submitting the next build of my macOS app to the App Store Connect. I keep getting a variation of this error: ITMS-90238: Invalid Signature - The main app bundle MyApp at path MyApp.app has following signing error(s): code has no resources but signature indicates they must be present In subcomponent: MyApp.app/Contents/Frameworks/GoogleAppMeasurement.framework . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html and Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html for more information. ITMS-90238: Invalid Signature - The main app bundle MyApp at path MyApp.app has following signing error(s): code has no resources but signature indicates they must be present In subcomponent: MyApp.app/Contents/Frameworks/GoogleAppMeasurementIdentitySupport.framework . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html and Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html for more information. ITMS-90238: Invalid Signature - The main app bundle MyApp at path MyAppt.app has following signing error(s): code has no resources but signature indicates they must be present In subcomponent: MyApp.app/Contents/Frameworks/FirebaseAnalytics.framework . Refer to the Code Signing and Application Sandboxing Guide at http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html and Technical Note 2206 at https://developer.apple.com/library/mac/technotes/tn2206/_index.html for more information. I am using Firebase framework as a Swift package. I tried updating Swift package to the latest version and that didn't help. I also tried to revert to the last version that was successfully used on the App Store/TestFlight and that didn't help. I have no control over this framework other than not use it or choose a specific version. I also tried to export the app and use the Transporter app and that didn't help. Any suggestions?

In macOS, the App Sandbox is designed to restrict applications' access to system resources and user data, mitigating damage from potential threats. However, I'm unclear on its relationship with permissions and how it effectively reduces such threats. For example, with com.apple.security.device.camera, it seems to me that NSCameraUsageDescription should suffice. If an application is granted permission via NSCameraUsageDescription, configuring com.apple.security.device.camera still doesn't guarantee protection against malicious access to user data, does it? Or, if I haven't configured both com.apple.security.device.camera and NSCameraUsageDescription, could a malicious app still somehow prompt the camera permission dialog or bypass permission checks and access the camera without the com.apple.security.device.camera configuration?

According to the new requirements for binary XCFrameworks they should be code signed. I watched the WWDC23 video 10061-Verify app dependencies with digital signatures and while it helpfully provides the command to sign the framework after building, it doesn’t mention how to sign it when your distribution certificates are of the Cloud managed kind, and therefore not actually in the macOS Keychain. My question is how can I sign a binary XCFramework when the only distribution certificate we have is in the cloud? I am a part of a team in App Store Connect, if that’s relevant. Thanks 🙌

I've developed a crypto token kit extension using the Xcode template. I've successfully added the certificate and its corresponding private key to the keychain. However, when attempting to sign with this certificate, I need to call a command-line interface (CLI) that I've created. The CLI is located at ~/Applications/mycli/cli_executable. My issue arises because the extension is sandboxed, prohibiting direct communication with the CLI. I attempted to remove the sandbox, but that didn't resolve the problem (the extension wasn't being registered without the app sandboxed). Additionally, the CLI relies on a database, so simply copying the file to the app container folder isn't a feasible solution (unless it's a symlink – I'm unsure if this is possible). How can I effectively address this problem and enable communication between the sandboxed extension and my CLI (GoLang app)? Thank you.

Is it possible to read messages from chat.db inside a MacOS app? I'm developing a MacOS app, I'm able to successfully connect to ~/Library/Messages/chat.db but when I try to run a query I get Error preparing select: authorization denied I know other apps like TablePlus are able to read chat.db but these apps are outside of iOS. Thanks in advance!

I hope this message finds you well. I am seeking assistance regarding the Full Disk Access entries. While the following command worked for entries with a bundle ID: sudo tccutil reset All com.mcafee.tp.endpointsecurity I am facing difficulty with entries lacking a bundle ID. The commands I used for specific entries are as follows: sudo tccutil reset SystemPolicyAllFiles /usr/local/McAfee/AntiMalware/VShieldScanner sudo tccutil reset SystemPolicyAllFiles /usr/local/McAfee/fmp/bin64/fmpd Unfortunately, these commands do not seem to remove the entries. Could you provide guidance on how to reset entries without a bundle ID? Note: it’s a Mcafee product and all the files are removed except from full disk entry i just want to remove only the VShieldScanner and fmpd Your assistance in resolving this matter is greatly appreciated & find the attached snap.

We create app but not select Bundle ID. I was create some Certificates, Identifiers & Profiles. But not show one this. Please check bug. Thank Apple!

Could someone let me know if it is possible to create a self-signed Developer ID Installer certificate? Create an installer package using this certificate. And share it with others. This is just to do a simple proof of concept.

Hello, I have an application which is running sandboxed and it also launches a child processes via posix_spawn. I already learned that child processes are running in the same sandbox as the launching application. What I wonder is if there is a way to launch the child with different sandbox profile from the parent application while maintaining the parent-child relationship? My use case is that helper applications doesn't need access to bunch of stuff the parent needs and we want to limit blast radius in case of security problem. I know that's what XPCServices are for, but we have a multi-platform code which is relying on POSIX process model quite heavily. Thank you