I'm developing a game for Mac App Store from Unity in which I have a plugin created in Xcode as .bundle file. I am able to codesign and package my game via terminal but problem appears when I try to submit package via Application Loader. I will try to explain everything thoroughly:
Package gets uploaded on iTunes Connect but at the end I get following warning:
WARNING ITMS-90239: "Invalid
Signature. A sealed resource is
missing or invalid. The binary at path
[Panda Commander Air
Combat.app/Contents/Plugins/InAppPurchase.bundle/Contents/MacOS/InAppPurchase]
contains an invalid signature. Make
sure you have signed your application
with a distribution certificate, not
an ad hoc certificate or a development
certificate. Verify that the code
signing settings in Xcode are correct
at the target level (which override
any values at the project level). If
you are certain your code signing
settings are correct, choose "Clean
All" in Xcode, delete the "build"
directory in the Finder, and rebuild
your release target."
I can click on "Next" and finish my submit, but this warning must be resolved because I get mail from iTunes Connect with issues that must be corrected:
UNABLE TO SIGN - This package doesn't
meet the current code signing
requirements. For more information,
see the Code Signing and Application
Sandboxing Guide [1] and Technical
Note 2206 [2].
Specifically, codesign generated the
following error:
webelinx.appstore.panda.pkg/Payload/Panda
Commander Air
Combat.app/Contents/Plugins/InAppPurchase.bundle:
unsealed contents present in the
bundle root
Once these issues have been
corrected, you can then redeliver the
corrected binary.
[1]
http://developer.apple.com/library/mac/#documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html
[2]
https://developer.apple.com/library/mac/technotes/tn2206/_index.html
My plugin actually IS signed in Xcode, I've created new bundle ID and distribution provisioning profile for Mac App Store specifically for this plugin and setup everything in Code Signing tab. Code signing identity is 3rd Party Mac Developer Application and appropriate provisioning profile is selected. When I build this bundle it asks me to allow codesigning, and afterwards when I check it with "codesign -dvvv" command in terminal I can see codesign details. If I don't codesign it, I get another warning when I upload my package which says that bundle is not signed at all. I even tried to do a "Clean all", delete "build" directory and rebuild bundle as suggested in warning, but it has no effect, warning appears again.
How can resolve this warning? Am I missing something important or trying to fix things in wrong way?
Any help will be appreciated because I am out of options at the moment.
Thanks in advance!
OK, I solved my problem. I was missing few things and I found solution here: http://forum.unity3d.com/threads/signing-mac-app-on-os-x-mavericks.206762/.
The thing I still had to do was to manually codesign every file in Contents/Frameworks and Contents/Plugins directories inside .app file and to delete all .meta files inside my plugin. After I did these steps, I codesigned once more whole .app file and created a package which I uploaded on iTunes Connect without warning mentioned above.
Xcode gives me this warning when I build the app for release.
Application failed codesign verification. The signature was invalid, or it was not signed with an Apple submission certificate. (-19011)
Do I need to delete all entries from my keychain and redo getting a certificate, provisioning profile, etc?
I can build and debug on the iPhone and iPad without a problem.
If you know how I can solve this dilemma, please provide exact steps or a way for me to contact you about this.
Thanks
----UPDATE -----
Build Log
Validate build/Release-iphoneos/iApp.app
cd "/Users/iosdeveloper/Documents/Programming/iPad/iApp HD"
setenv PATH "/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin:/Developer/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin"
setenv PRODUCT_TYPE com.apple.product-type.application
/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin/Validation "/Users/iosdeveloper/Documents/Programming/iPad/iApp HD/build/Release-iphoneos/iApp.app"
warning: Application failed codesign verification. The signature was invalid, or it was not signed with an Apple submission certificate. (-19011)
Executable=/Users/iosdeveloper/Documents/Programming/iPad/iApp HD/build/Release-iphoneos/iApp.app/iApp
codesign_wrapper-0.7.10: using Apple CA for profile evaluation
/Users/iosdeveloper/Documents/Programming/iPad/iApp HD/build/Release-iphoneos/iApp.app: valid on disk
/Users/iosdeveloper/Documents/Programming/iPad/iApp HD/build/Release-iphoneos/iApp.app: satisfies its Designated Requirement
test-requirement: failed to satisfy code requirement(s)
codesign_wrapper-0.7.10: failed to execute codesign(1)
- (null)
Here's the checklist I go through when I've hit this:
Clean all targets, exit Xcode, then go drag the build folder from your project to the trash.
Do the Get Info on your project, make sure the Code Signing Entitlements and Code Signing Identity are selected correctly. Do the same for your Targets.
Login to the iOS Provisioning Portal and make sure the Distribution certificate has not expired. Also check the Distribution Provisioning Profile and make sure it is Active. Make sure the Certificate is properly in your Keychain and the Distribution profile is in Xcode Organizer (if you have multiple of the same one, delete all but the correct one and redo step #2).
Look at your Build Results on the failure and identify which profile it is actually using and make sure it is the right one.
You probably need to check what code signing profile is selected in your distribution build properties.
It looks like your target is "Development" but Xcode applied some of distribution settings to it, so the warning simply means your ad-hoc build has no valid AppStore submission certificate. Go to your target settings, choose the Release configuration and uncheck "Validate Built Product" option.
Application failed codesign verification. The signature was invalid, or it was not signed with an Apple submission certificate. (-19011)
i am got the Same Warning Message...
I just Changed to iOs Deployment target 4.3 to 3.2.2 its works perfectly .....
Note: you may have to go to XCode's "Project" and select "Edit Active Target (appname)",
which is near the bottom of the list ... in the new pane that opens, select "Build", then
under "Code Signing Identity" select your distribution provision. Note that this seems
to be editing a different thing than "Project" / "Edit Project" (editing "target" instead
of "project"). I found I had to edit both project and target's code signing identities.
I had exactly the same problem. It was due to installing Xcode 4.0.2 and 4.2 preview 3 at the same time. Removed both (through the provided uninstall scripts):
<Xcodedir>/Library/uninstall-devtools --mode=all
Then rebooted and installed 4.0.2 and it works :/
I have found the codesign process a headache - I always shudder when I get am ready to use Ad Hoc distribution to beta test. After the usual round of errors and failed fix attempts I ignored the "application failed codesign" error and sent the build to a beta tester. It worked without issue.
Very frustrating.
In the build log provided in the -UPDATE- section of the original post the root cause of the failed signature verification is expressed with the text:
"test-requirement: code failed to satisfy specified code requirement(s)". That particular flavor of failed signature verification is almost always caused by mistakenly signing your app with an iPhone Developer profile instead of an iPhone Distribution profile.
It can be confirmed with the steps in "How do I verify the certificate that was used to sign my app?". If the certificate "Identity" is "iPhone Developer: YOUR_NAME" instead of "iPhone Distribution: ..." that is the reason for the "Application failed codesign verification" error, and you can resolve it by performing the following steps:
1a). if you have not yet created an App Store Distribution Provisioning Profile yet, that is done on the "Distribution" tab of the "Provisioning" Section of the iOS Portal site.
Note, the "Distribution" tab is only available to Team Members whose role is either "Agent" (the one who signed up for the iOS Developer Program), or "Admin" (those that the Agent grant access to app-distribution capabilities).
1b). if you're fairly certain you have an App Store Distribution Provisioning Profile installed in your Xcode profile library, you can verify it is an App Store profile as well as the App ID associated to it by using the steps in section How do I confirm my Provisioning Profile is for App Store distribution?
2). verify that your Scheme 'Archive' task is mapped to "Release" using the steps in section:
"Creating an Application Archive"
3). check that you have an your App Store provisioning profile assigned to your "Release" Code Signing Identity using the steps in section
"Assigning Provisioning Profiles to Build Configurations".
Note: it's important to make these changes at the Target level Build Settings, versus the Project level ones, as Target settings override Project ones...you can think of the Project level build settings as 'defaults' to populate target settings (and any future targets) with. Also, Ensure the "All" button is depressed in the upper-left corner of Target Build Settings to reveal the "Code Signing Identity" section.
4). retry your Product > Archive.
If the issue persists after the above, I recommend continuing onto Apple's complete list of potential causes of this error at the following URL "How do I resolve the error: Application failed codesign verification?"
My problem was solved when I noticed that I only had a "team" provisioning profile, and the details in iOS Dev Center told me that it was not a profile fit for development because it had no device attached. So I created a second provisioning profile, which let me check the box for my device so that it had a device attached.
Then when validating or submitting the app from the Organizer window (after pressing 'Build and archive'), I first made the mistake of selecting this new profile as the code signing profile. That was wrong. The profile that worked was iPhone Developer.
Good luck!
PS: This whole submission process is a heap of abacadabra. Do you really have to create a zillion distribution profiles, provisioning profiles, etc.? It hasn't encouraged me in any way to better test my app. I already did that before I chose to upload, and clicking a hundred buttons labeled 'Create','Download' and 'Submit' isn't really a quality control process that added anything (well except being forced to buy an iPad and test on that). Who ever said iOS was developer friendly?
My problem was that the Archive scheme did not have Build Configuration of App Store, but of Release. To change this, go to Product -> Edit scheme, select Archive on left side and change Build Configuration to App Store. I am assuming the code signing is configured properly (with distribution certificate).
You probably created a new certificate without refreshing the provisioning profiles
Create your iOS Distribution Provisioning Profile for App Store Distribution
I solved this by deleting the Archive that's not validating from the Organizer, closed and reopened Xcode and built for Archiving again.
I then chose Archive from the drop down menu. After doing that my app passed validation.
Hope that helps.
Ok I'm no rookie to this stuff. I know what I'm doing, so please dont take me through the basics. I updated Xcode to the newest version the other day, and now every new project and saved projects from the past that HAVE succesfully been built using its own distribution certificate are no longer succeeding with the following error:
The executable was signed with invalid entitlements.
The entitlements specified in your application’s Code Signing Entitlements file do not match those specified in your provisioning profile.
(0xE8008016).
This is happening to ALL my apps! I have six of them, and all of them have never had problems with their certificates, but now I'm getting this error! I'm not even making adhoc builds, so Im not using entitlements, nor is it specified in the code signing entitlements box. That box is blank. Ive tried everything, this is definitely an Xcode issue with updating.
Please help this is extremely frustrating.
This is just a shot in the dark, but maybe try deleting all of your provisioning profiles from Xcode and all of your devices, then download them again from the provisioning portal and reinstall them on everything? I ended up doing that anyway when I upgraded.
In my case I had "code signing" line in my targets and project build settings. Despite it was empty it was still giving me this error, until I deleted it completely in targets and partially in project. So that is what I did:
In Xcode 4.2 I went to my PROJECT\Build Settings found that line "code signing", clicked on it and in Entitlements deleted all lines (they were empty but still there!), so Entitlements disappeared.
I put in "code signing identity":don't code sign
"debug":don't code sign
"Any iOS SDK": choose your provisions here, I used automatic, worked fine
"release":don't code sign
"Any iOS SDK": same as above
Then I went to TARGETS\Build Settings, found the line "code signing" and deleted everything under it so it disappeared from targets.
Now I could build onto the device, not only in simulator.
Hope it helps somebody.
B
I am attempting to deploy my first development iPhone app, and am running into some problems. I have successfully went though the online Provisioning Assistant, but now I am stuck. No matter what I do, I always get the following error.
/usr/bin/codesign failed with exit code 1
Anyone have any ideas why this is happening?
Update:
The Technical Note in my original answer is now deprecated. Apple posted a collection of code signing problems (and some solutions) in a new document: Technical Note TN2407 Code Signing Troubleshooting Index
Check the CODE_SIGN_IDENTITY property in your build settings. Is your provisioning profile selected there?
You also need to enter a valid bundle identifier in your apps .plist.
The identifier has to match the one you provided when generating the profile.
Apple has a technote about that here.
I just came across this error, and here's what I found out in case this helps anyone: I discovered that you can right click the error message in Xcode and choose expand to get more details, including a description of the problem.
In my case, I had two copies of my developer certificate with the same name in different keychain files, and Xcode couldn't figure out which one to use.
It might be strange answer for codesign issue in Xcode 9.0. I was receiving this error too and did not know what to be done, because everything was correct.
I went to the keychain, I had the login option "unlocked". I locked it and compiled my build again. Xcode itself asked me to open access keychain. I gave access and it worked.
Steps were:
Go to keychain
Lock it
Archive the code, build the project again
I had the exact same error, and tried everything under the sun, including what was elsewhere on this page, with no success. What the problem was for me was that in Keychain Access, the actual Apple WWDR certificate was marked as "Always Trust". It needed to be "System Defaults". That goes for your Development and Distribution certificates, too. If any of them are incorrectly set to "Always Trust", that can apparently cause this problem.
So, in Keychain Access, click on the Apple Worldwide Developer Relations Certificate Authority certificate, select Get Info. Then, expand the Trust settings, and for the combo box for "When using this certificate:", choose "System Defaults".
Others have commented that you may have to do this in System and login keychains for these errors.
There could be a lot of reason when you get this kind of error:
Check whether you have selected a provisioning profile which includes the valid Code Signing Identity and a valid Bundle Identifier in Settings. (Goto Build Settings->Signing->Provisioning Profile).
Open Keychain Access and click on lock icon at top left, so it will lock the login keychain and then again click to unlock.
Goto File->Project Settings->Derived Data and delete your project build folder. After that clean and build your app.
I had the same problem the distribution build. It just happened all of sudden. In fact I did not have this problem a few days ago and I had my Ad-Hoc version compile right. This issue came up because my certificate just expired today. So I went create a new provisional following Apple's guidance: (http://developer.apple.com/ios/manage/distribution/index.action).
After spending hours on the net and made sure I had not fallen for what could go wrong. Here is what save me as suggested by Tobias and Dan Ray:
"...discovered that you can right click the error message in Xcode to view details".
"...the issue was an expired certificate on my System keychain. Keychain Access doesn't, by default, show expired certs".
The detailed information told me about ambiguous matching two certificates. One of them happened to be an expired certificate in the System key chain. So I deleted the expired one then it worked! I also had a concern about what to enter in the "common name" when create the distribution certificate using the keychain utility: my name or my company name. In my case, I entered my name. I am guessing it is the same as the title that addressed by the developer's auto responder email.
Great help. Thanks.
If the error immediately preceding the codesign error says something like 'resource fork, Finder information, or similar detritus not allowed'
Then navigate to the .app file in Terminal and type:
xattr -cr < path_to_app_bundle >
ref: https://developer.apple.com/library/content/qa/qa1940/_index.html
What worked for me was adding --deep to Other Code Signing Flags in Build Settings.
More information here: Codesign of Dropbox API fails in Xcode 4.6.3: "code object is not signed at all"
Unfortunate that this ambiguous error condition has 400 different solutions, but I digress.
I had the same problem. In the end it turned out that my private key did not allow codesign to access it. One can see this in the info dialog in keychain application.
I have to agree with Tobias. The error is too generic. When the same thing happened to me I dug into the error message and realized I'd screwed up something in the build properties, but not the code signing. So yeah, I'd dig in to the details.
In my case error was due to the fact that I had two keys on the keychain with the same name. I deleted the old one and that solved the issue.
Going to the detail message show the real problem to me.
after hours of googling and trying out different things, this is what fixed it for me:
Make sure there are no certificates in the System > Certificates tab on Keychain Access. Remove all duplicate certificates from there.
Install the WWDR intermediate certificate under certificates from the provisioning portal, in addition to the developers certificates and make sure you see it in the Login > Certificates tab on Keychain Access.
hope this helps some of you!
Same issue with ambiguous (matches "iPhone Developer: [me] " and /// tweetdeck's library privatedata file. Fixed it by moving file to the trash and re-logging into Tweetdeck, setting up passwords again. What a pain.
I had the same problem but also listed in the error log was this: CSSMERR_TP_CERT_NOT_VALID_YET
Looking at the certificate in KeyChain showed a similar message. The problem was due to my Mac's system clock being set incorrectly. As soon as I set the correct region/time, the certificate was marked as valid and I could build and run my app on the iPhone
I was also getting this error ("/usr/bin/codesign failed with exit code 1"), and when I looked in Keychain Access my developer certificates were marked as "This certificate was signed by an unknown authority". I had recently upgraded to Mac OS 10.8 and have had a couple of other XCode (4.5.2) issues since then. It turns out I did not have the WWDR intermediate certificate installed. I downloaded that from the iOS Provisioning Portal, installed that in Keychain Access, and my project builds again!
When I got this error I wasn't even trying to sign the app. I was writing a test app and didn't care about signing.
In order to get rid of this message I had to select "Don't Code Sign" from Build Settings under Code Signing.
Sometimes your build folder simply needs cleaning - it certainly worked for me. Thanks to loafer-project for the solution.
One possible cause is that you doesn't have permission to write on the build directory.
Solution: Delete all build directory on your project folder and rebuild your application.
I just came across this error and it was because I was trying to write the build file to a network drive that was not working. Tried again from my desktop and it worked just fine. (You may have to "Clean" the build after you move it. Just choose "Clean all Targets" from the "Build" drop-down menu).
Tobias is correct though, dig into the details on the code by right-clicking it to see what your specific problem is.
One thing that you'll want to watch out for (it's a stupid mistake on my part, but it happens), is that the email address attached to the CSR needs to be the same as the email connected to your Apple Dev account. Once I used a new CSR and rebuilt all the certs and provisioning profiles, all was well in applesville.
Another reason,
Check your Developer account is connected with xCode
Kinda old question, but still happens it seems. Another solution:
Occurred for me after reverting a branch in git.
Tried cleaning, cleaning builds, deleting derived and restarting Xcode, but no luck.
Try rebooting the comp.
I had the same unknown error from codesigning that you mentioned. Similar to the answer provided (but a little different), I just locked my keychain access and unlocked it, and I was able to build and run to my device again. If anyone has the same issue, perhaps try that first before going through the trouble of modifying the keychain password.
Throwing my comments into the ring, I just came across this after attempting to refresh my development environment after clicking DENY accidentally on one of the application requests, after searching around I found a number of things that didn't seem to work. This is the full order in which I've attempted the fixes and whether there was a success:
1) Attempted to clear the DerivedFiles and restart XCode - no dice
2) Attempted to Log and Unlock the Keychain, then restart XCode - no dice
3) Attempted to refresh my developer account within XCode - no dice
4) Bit the bullet and just reset my entire keychain, after doing so my developer account was signed out (signed back in), then restarted XCode - no dice
5) Found an article on here that said that we needed to set the [login|local|System]/certificate/Apple Worldwide Developer Relations Certificate Authority to "System default". But in my case it was already set to system default - no dice
6) Then I looked at my actual developer certificate login/my certificates/Mac Developer: and when I looked in there it was correctly set to Confirm before allowing access BUT there was no entries in the lower section. There should be [Xcode, codesign, productbuild]. I deleted the certificate entry and restarted XCode - bingo
The certificate was added and I was then prompted. So what did I do, I pressed "always allow" and then just boned myself.
I had to go back and delete the certificate again, then go through about 20 allow dialogs during a clean build. Once completed, I was able to build completely.
In My Case, after a fews days of research,
All I did to revolve is listed below:
delete all the certificate on your keychain.
goto your apple account. a) download the specify certificate your want to install on your keychain. b)(Optional) Also create and download the require profile.
in Xcode, clean your project. This may take some time.
Build your project.
This should work for similar codesign issues.
Note, during this process the OS would ask for your credential validation.
I use Xamarin and for me this is what worked after trying everything else.
In Visual Studio for Mac I've opened a .xib file so it opens the project in Xcode.
Went to the project settings > Signing and Capabilities, selected the team and then fixed the Signing Certificate.
I think the issue is with the Keychain Access and certificate trust.
Try adding the following certificate Apple Worldwide Developer Relations Certification Authority from https://www.apple.com/certificateauthority/ (Expiry validity 2030)
The trust warning indicated in certificate will be fixed and then try building the iOS application again
Open the project path in terminal and enter the below commands in terminal
1) find . | xargs -0 xattr -c
2) xattr -rc .
This works for me.