Hey all. I "Archived" my XCode application, notarized through XCode, exported the .app and used a program create-dmg to generate a DMG for me. I then notarized this using the xcrun notarytool submit Lyric\ Fever\ 1.7.dmg --keychain-profile "notarytoolProfile" command as well as xcrun stapler staple Lyric\ Fever\ 1.7.dmg, both of which passed. Running syspolicy_check distribution also passes. So does xcrun stapler validate. This dmg still fails when testing using spctl. spctl -a -t open -vvv --context context:primary-signature Lyric\ Fever\ 1.7.dmg generates the following error: Lyric Fever 1.7.dmg: rejected origin=Apple Development: Avi Wadhwa (#######) Furthermore, I uploaded this dmg to github and redownloaded it. This newly downloaded dmg does not open in finder, prompting the "unidentifier developer, malware" message. Yet xcrun stapler validate passes, and so does syspolicy_check distribution. I know as per Eskimo's previous posts that this is not the ideal way to test notarization (and setting a macOS vm is the best method), but if I cannot download my own dmg from GitHub then something is clearly wrong.

I'm trying to notarize an Objective-C app I've written in Xcode 15. However, when I archive the app, it is listed as a "Generic Xcode Archive" instead of an "app archive", so it can't be validated/distributed. I've tried following all the steps in this article: https://developer.apple.com/documentation/technotes/tn3110-resolving-generic-xcode-archive-issue My skip_install is set to NO. My app's dependencies don't show up under "Targets" so I couldn't check the skip_install setting for them. My linked libraries don't use a headers build phase. My install_path is set to $(LOCAL_APPS_DIR). Why am I not getting an "app archive"?

The notarytool service seems to be down, but "Developer ID Notarization Service" is green in the system-status. If I try to submit a DMG for notorization or even just try to get the history it gives this response: Error: internalError(statusCode: Optional(500), strData: nil, jsonData: Optional(["errors": <__NSSingleObjectArrayI 0x60000331d020>( { code = "UNEXPECTED_ERROR"; detail = "<null>"; id = 7S3TTC4N54UMTGOEMVREFQPSNE; links = "<null>"; status = 500; title = "Uncaught server exception"; } ) , "statusCode": 500])) Please try again at a later time. Everything worked a couple weeks ago

I have recently upgraded to macOS 14 and Xcode 15. I gather codesign --deep no longer works. Do I have to explicitly codesign every file in my .app? There are several hundreds of them. Also, I am able to successfully codesign my executable (MyApp.app/Contents/MacOS/MyExecutable), but when I upload for Notarization, it fails with "The signature of the binary is invalid.", identifying the executable specifically. This used to work fine. Why is it failing now?

Greetings to all. I have purchased my developer account and encountered an error message stating "Team is not yet configured for notarization" when attempting to sign my software. Despite my efforts to get in touch with Developer Programs over the past month through numerous phone calls and emails, the only response I receive is that they are unable to assist me at the moment. This situation has become quite distressing. We are encountering obstacles in releasing our software as Apple is impeding our progress. Users are experiencing an "unidentified developer" error message when trying to download it. I am unsure who to reach out to for assistance, especially when Apple support seems unresponsive despite being quick to accept payments.

We have developed an application in which we have a main application and there are several loadable bundles which are loaded from within the main application. We archive the main application and generate the .app file. When we run the app, everything works fine and it loads the bundles. But when notarise the main application, it stops loading the bundles. We think we will need to notarise the bundles as well but not able to find the ways to do it. Any help will be very appreciated.

I am bundling my app in a .dmg that I made. I signed it, notarized it and stapled it. When I install it on a friends Mac, I get the error message," This error may occur if something went wrong when authenticating using Sign in with Apple Error Code 1000 for Sign in with Apple refers to an unknown error that occurred authenticating your Apple ID. Please make sure that you have Two-Factor authentication enabled for your Apple ID. Is this because his Apple ID has not got two factor enabled, or because my Dev account does not? I read somewhere that two factor must be enabled for latest versions of Macs, but again, is this my Apple Dev ID, or their's?

I'm trying to notarize an Objective-C app I've written in Xcode 15. I've mostly been following this guide: https://scriptingosx.com/2021/07/notarize-a-command-line-tool-with-notarytool/. I got the Developer ID Application and Developer ID Installer certificates from Apple developer. I made sure hardened runtime was on in Xcode and chose Developer ID Application under the signing settings before archiving and exporting. After setting up my notarytool profile, I used "xcrun notarytool submit" to submit for notarization. This first attempt went over 24 hours and still said "In Progress" so I cancelled it. For my second attempt I built an installer pkg for my app signed with my Developer ID Installer certificate. I submitted this for notarization with "xcrun notarytool submit" and after over 24 hours of "in progress' it returned "the request timed out". What am I doing wrong in the sign/notarize process?

I am working on an open source app. I have been testing the package installer, and something unexpected is happening: the .pkg won't run on my test machine and will instead show a banner saying "myApp.app can't be opened because Apple cannot check it for malicious software"; nevertheless, if I wait some minutes, the installer will run just fine! After reading through many of ekimo's posts, I assumed it may have something to do with stapler. I was not stapling my .dmg originally, so that's something I may be missing (my app is installed by a .pkg inside a .dmg). Nevertheless, the computer where I am testing the app has internet connection, meaning stapler should not even come into play. Regardless, I decided to staple my .dmg. Running xcrun stapler staple -v myApp.dmg after notarizing produces this result: builder ~ % xcrun stapler staple -v /Users/builder/Data/HEAD/installation/Packages/myApp.dmg Processing: /Users/builder/Data/HEAD/installation/Packages/myApp.dmg Properties are { NSURLIsDirectoryKey = 0; NSURLIsPackageKey = 0; NSURLIsSymbolicLinkKey = 0; NSURLLocalizedTypeDescriptionKey = "Disk Image"; NSURLTypeIdentifierKey = "com.apple.disk-image-udif"; "_NSURLIsApplicationKey" = 0; } Creating synthetic cdHash for unsigned disk image, myApp.dmg. Humanity must endure. Signing information is { cdhashes = ( {length = 20, bytes = 0xdd018313b1c574a403f01dccc96c21705987d76c} ); "cdhashes-full" = { 2 = {length = 32, bytes = 0xdd018313 b1c574a4 03f01dcc c96c2170 ... 918d33f3 d5a74dc3 }; }; cms = {length = 0, bytes = 0x}; "digest-algorithm" = 2; "digest-algorithms" = ( 2 ); flags = 2; format = "disk image"; identifier = ADHOC; "main-executable" = "file:///Users/builder/Data/HEAD/installation/Packages/myApp.dmg"; source = "explicit detached"; unique = {length = 20, bytes = 0xdd018313b1c574a403f01dccc96c21705987d76c}; } Stored Codesign length: 12 number of blobs: 0 Total Length: 12 Found blobs: 0 JSON Data is { records = ( { recordName = "2/2/dd018313b1c574a403f01dccc96c21705987d76c"; } ); } Headers: { "Content-Type" = "application/json"; } Domain is api.apple-cloudkit.com Response is <NSHTTPURLResponse: 0x600003b85ba0> { URL: https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup } { Status Code: 200, Headers { Connection = ( "keep-alive" ); "Content-Encoding" = ( gzip ); "Content-Type" = ( "application/json; charset=UTF-8" ); Date = ( "Mon, 26 Feb 2024 15:34:15 GMT" ); Server = ( "AppleHttpServer/78689afb4479" ); "Strict-Transport-Security" = ( "max-age=31536000; includeSubDomains;" ); "Transfer-Encoding" = ( Identity ); Via = ( "xrail:st53p00ic-qujn15041902.me.com:8301:24R11:grp60,631194250daa17e24277dea86cf30319:59e17ac665e1de7388b8f4e69e92e383:defra2" ); "X-Apple-CloudKit-Version" = ( "1.0" ); "X-Apple-Edge-Response-Time" = ( 99 ); "X-Apple-Request-UUID" = ( "9fc0fe2d-49fd-4e74-b718-660c56edb3bb" ); "X-Responding-Instance" = ( "ckdatabasews:16306401:st42p63ic-ztfb05112901:8807:2409B432:afc827b7b1ebf24829e9c4856d4b69205f23804f" ); "access-control-expose-headers" = ( "X-Apple-Request-UUID,X-Responding-Instance,Via" ); "x-apple-user-partition" = ( 63 ); } } Size of data is 165 JSON Response is: { records = ( { reason = "Record not found"; recordName = "2/2/dd018313b1c574a403f01dccc96c21705987d76c"; serverErrorCode = "NOT_FOUND"; } ); } CloudKit query for myApp.dmg (2/dd018313b1c574a403f01dccc96c21705987d76c) failed due to "Record not found". Could not find base64 encoded ticket in response for 2/dd018313b1c574a403f01dccc96c21705987d76c The staple and validate action failed! Error 65 What does this show? Thank you.

Hello! I'm dealing with a strange code signing issue which is preventing me from distributing a game through Steam. I'm able to sign and notarise the app in Xcode without any issues. I can verify that the app and all frameworks in /Contents/Frameworks/ are signed, and Gatekeeper allows the app to run without complaining. $ spctl --assess -vvv ~/Temp/CodeSigningTest/GoodApp.app /Users/ruairi/Temp/CodeSigningTest/GoodApp.app: accepted source=Notarized Developer ID origin=Developer ID Application: Ruairi Dorrity (3F97UA4BF8) $ codesign --verify -vvv ~/Temp/CodeSigningTest/GoodApp.app --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/ogg.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/ogg.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/mpg123.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/mpg123.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/libmodplug.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/libmodplug.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/freetype.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/freetype.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/Lua.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/Lua.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/vorbis.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/vorbis.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/OpenAL-Soft.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/OpenAL-Soft.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/theora.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/theora.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/love.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/love.framework/Versions/Current/. --prepared:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/SDL2.framework/Versions/Current/. --validated:/Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/SDL2.framework/Versions/Current/. /Users/ruairi/Temp/CodeSigningTest/GoodApp.app: valid on disk /Users/ruairi/Temp/CodeSigningTest/GoodApp.app: satisfies its Designated Requirement However, if I zip the app and upload it to Steam, the app that the Steam client downloads is blocked by Gatekeeper ("damaged and can't be opened") and re-running the above commands shows that the code signing seal has been broken somehow on the downloaded app: $ spctl --assess -vvv ~/Temp/CodeSigningTest/BadApp.app /Users/ruairi/Temp/CodeSigningTest/BadApp.app: cannot find code object on disk $ codesign --verify -vvv ~/Temp/CodeSigningTest/BadApp.app /Users/ruairi/Temp/CodeSigningTest/BadApp.app: code object is not signed at all In subcomponent: /Users/ruairi/Temp/CodeSigningTest/BadApp.app/Contents/Frameworks/love.framework The second command can be re-run, showing a seemingly random framework from /Contents/Frameworks/ each time e.g. $ codesign --verify -vvv ~/Temp/CodeSigningTest/BadApp.app /Users/ruairi/Temp/CodeSigningTest/BadApp.app: code object is not signed at all In subcomponent: /Users/ruairi/Temp/CodeSigningTest/BadApp.app/Contents/Frameworks/ogg.framework Further investigation shows that these frameworks are now unsigned, when they were signed before uploading and downloading: $ codesign --verify -vvv ~/Temp/CodeSigningTest/BadApp.app/Contents/Frameworks/ogg.framework /Users/ruairi/Temp/CodeSigningTest/BadApp.app/Contents/Frameworks/ogg.framework: code object is not signed at all $ codesign --verify -vvv ~/Temp/CodeSigningTest/BadApp.app/Contents/Frameworks/love.framework /Users/ruairi/Temp/CodeSigningTest/BadApp.app/Contents/Frameworks/love.framework: code object is not signed at all ... $ codesign --verify -vvv ~/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/ogg.framework /Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/ogg.framework: valid on disk /Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/ogg.framework: satisfies its Designated Requirement $ codesign --verify -vvv ~/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/love.framework /Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/love.framework: valid on disk /Users/ruairi/Temp/CodeSigningTest/GoodApp.app/Contents/Frameworks/love.framework: satisfies its Designated Requirement I'm stumped as to what's happening here. Is is possible that the app is being modified being the scenes by Steam, which breaks the code signing? This seems unfathomable because it would surely break code signing on every Mac game on Steam, but I really can't understand what else would be going on. I'm sure I need to expand my knowledge on code signing; any pointers, suggestions or assistance is greatly appreciated! Thank you!

hi, team, we used the py2app to build the mac app, the app works well before the codesign. But when I codesign it with the --options runtime the app can't startup. with the below error: /petoi-mac-app/Petoi\ Desktop\ App.app/Contents/MacOS/Petoi\ Desktop\ App ; exit; Traceback (most recent call last): File "/Petoi Desktop App.app/Contents/Resources/__boot__.py", line 147, in <module> _setup_ctypes() File "/petoi-mac-app/Petoi Desktop App.app/Contents/Resources/__boot__.py", line 140, in _setup_ctypes from ctypes.macholib import dyld File "<frozen importlib._bootstrap>", line 983, in _find_and_load File "<frozen importlib._bootstrap>", line 967, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 668, in _load_unlocked File "<frozen importlib._bootstrap>", line 638, in _load_backward_compatible File "ctypes/__init__.pyc", line 551, in <module> File "ctypes/__init__.pyc", line 273, in _reset_cache MemoryError 2024-02-21 19:57:09.168 Petoi Desktop App[93968:1375266] Launch error 2024-02-21 19:57:09.168 Petoi Desktop App[93968:1375266] Launch error See the py2app website for debugging launch issues But if I removed the --options runtime I got the Notarizing Error below. { "severity": "error", "code": null, "path": "PetoiDesktopInstaller.pkg/PetoiDesktopInstaller.pkg Contents/Payload/Applications/Petoi Desktop App.app/Contents/MacOS/Petoi Desktop App", "message": "The executable does not have the hardened runtime enabled.", "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087724", "architecture": "x86_64" } I am looking forward to your insightful reply.

Recently, I completed development on an app that I hope to upload to Kickstarter. I am unsure whether Apple Developer Program Membership incorporates signage and notarization fees. In short, to package my app, will I need to find $99, or $300? Thanks in advance for any advice. Regards, Lar

I tried to submit my app via the Notary Service with this command: xcrun notarytool submit "${DMG_DIR}/${DMG_NAME}" --key "${APP_STORE_API_KEY}" --key-id "${KEY}" --issuer "${ISSUER}" --verbose and I called the API to get the status of the submission, and it said it was rejected without any meta data. I did codesign the app with this command: codesign --force --timestamp --deep --sign "Developer ID Application: MY_NAME" "${DMG_DIR}/${DMG_NAME}" Verify it with this command: codesign -vvv --deep --strict "${DMG_DIR}/${DMG_NAME}" The verification response: /Users/runner/work/1/a/cli/osx-x64/{DMGFILE}.dmg: valid on disk /Users/runner/work/1/a/cli/osx-x64/{DMGFILE}.dmg: satisfies its Designated Requirement Verify the timestamp with this command and response: Executable=/Users/runner/work/1/a/cli/osx-x64/{DMGFILE}.dmg Identifier={IDENTIFIER} Format=disk image CodeDirectory v=20200 size=297 flags=0x0(none) hashes=1+6 location=embedded Signature size=8975 Authority=Developer ID Application: MY_NAME Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=Feb 14, 2024 at 7:40:35 PM Info.plist=not bound TeamIdentifier=TEAM_ID Sealed Resources=none Internal requirements count=1 size=172 I wonder if I missed any steps. Thank you for the help.

In the developer documentation Customizing the notarization workflow it states that the notarytool supports a --webhook flag. When the notarization is complete the Apple notarization server will send the following webhook payload to the webserver that I configured. { "payload": "{\"completed_time\":\"2024-02-13T17:24:37.911Z\",\"event\":\"processing-complete\",\"start_time\":\"2024-02-13T17:24:02.743Z\",\"submission_id\":\"<submission-id>\",\"team_id\":\"<team-id>\"}", "signature": "<signature>", "cert_chain": "<base64-certchain>" } My question is how can I validate that this Webhook is coming from Apple? In that same developer documentation it states the various IP addresses that the stapler requires access too but those are not the same addresses that the notarytool webhook results are coming from. Presumably I should be able to use the signature to validate that the request is coming from Apple, however I have been unable to find any documentation about this webhook flag at all beyond the documentation stating that it exists.

Hello, I'm running into an issue when code signing my .app file on macOS. After introducing the --entitlements flag, I'm encountering an error that prevents the app from launching: Error Messages: App UI: "Cannot open the file" Terminal (using open file.app) The application cannot be opened for an unexpected reason, error=Error Domain=RBSRequestErrorDomain Code=5 "Launch failed." UserInfo={NSLocalizedFailureReason=Launch failed., NSUnderlyingError=0x60000216d620 {Error Domain=NSPOSIXErrorDomain Code=153 "Unknown error: 153" UserInfo={NSLocalizedDescription=Launchd job spawn failed}}} Troubleshooting Details: Without code signing, the app launches and permission pop-ups function correctly (the file tauri generates). With code signing (but without --entitlements), the app launches but there are no permission pop-ups. All scenarios (without signing, with signing, with signing + --entitlements) all have Info.plist in the /Contents of the .app file Notarizing and stapling works fine when I do not include the --entitlements flag when signing. Code for signing with entitlements: codesign --timestamp --sign "Developer ID Application: ()" --options=runtime --entitlements ./src-tauri/Info.plist "${APP_FILE}" Specifications MacBook Air, M2, 16GB macOS Sonoma 14.3.1 Xcode 15.2 (Build version 15C500b)

I am facing a problem in electron's apps notarisations. I have submitted my NodeJS code and the validations takes a long time. Hope, anyone can clarify why it takes so long.

After Apple's maintenance completed this morning I am trying to submit an app for notarization - but I continuously get the "In Progress" status. Normally, the result is returned within a minute or two. Is anyone else seeing this problem? Is there a server problem? I am using AppWraper to Notarize and also using the API to verify the results: https://appstoreconnect.apple.com/notary/v2/submissions/{id}

I'm experiencing consistent notarization issues with my macOS app, where my submissions are stuck "in progress". When I check the status after a while, I'm facing 404 errors, and the notarytool reports that the "submission Id does not exist." I've attempted to notarize it on different days, but with no success or clarifying error messages. Here are some of my notarization attempts that are still in progress: Jan 8, 2024: 25C31477-5893-4CAB-91AE-7900C261A1E4 Jan 15, 2024: Feb 7, 2024: 92B5B694-0952-4AE4-8BA3-2BBF54C96578 Feb 9, 2024: 3B3E047C-2B83-4499-9AE6-0B4F7922F5C2 Feb 10, 2024: C98A25BD-5A27-4112-AC99-6420599E30ED For an unknown reason I was able to notarize the app on 26 January, which was the only time it worked in 2024. As background, I had been notarizing this app without problem in 2023 for many months. I am able to correctly sign the app and export it without the notarization, and use it in my other Macbooks.

VisionOS was just released recently. I am looking for information regarding codesigning and notarization. How will codesigning work for VisionOS apps? What kind of signing tools will be used for VisionOS? Will there be a requirement for provisioning profiles for VisionOS apps? Thanks.

I am seeking clarification on the possibility of notarizing apps without an active Apple Developer Program membership, as I currently possess a 10-year installer signing certificate. However, when attempting to store credentials for notarization, I encounter the following error message: Error: HTTP status code: 403. A required agreement is missing or has expired. This request requires an in-effect agreement that has not been signed or has expired. Ensure your team has signed the necessary legal agreements and that they are not expired.