App Notarization got stuck, showing In-Progress from last 24 hrs.
This is really frustrating. Can anyone plz update on this?
Demystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
1.Provisioning profile "xxx" doesn't include signing certificate "Developer ID Application: xxxxx".
2.Provisioning profile "xxx" doesn't match the entitlements file's value for the com.apple.developer.networking.networkextension entitlement.
I decoded the profile,
<dict>
<key>com.apple.developer.system-extension.install</key>
<true/>
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>packet-tunnel-provider-systemextension</string>
<string>app-proxy-provider-systemextension</string>
<string>content-filter-provider-systemextension</string>
<string>dns-proxy-systemextension</string>
<string>dns-settings</string>
<string>relay</string>
<string>url-filter-provider</string>
<string>hotspot-provider</string>
</array>
<key>com.apple.security.application-groups</key>
<array>
<string>xxxxx</string>
<string>xxxxx</string>
</array>
<key>com.apple.developer.networking.vpn.api</key>
<array>
<string>allow-vpn</string>
</array>
<key>com.apple.application-identifier</key>
<string>xxxxx</string>
<key>keychain-access-groups</key>
<array>
<string>xxxxx</string>
</array>
<key>com.apple.developer.team-identifier</key>
<string>xxxxx</string>
</dict>
Kindly help me to resolve this.
I am making an iOS step counting app and I have included a widget in the design. I would like to get the widget to pull data from the main app to display step count etc so I created a bundle id for the widget and have been trying to use a group id to link them together. The group capabilities for both seem to be set up/enabled properly with the same App Groups id, but I've been getting an error in xcode which says, "
'Provisioning Profile: "BUNDLE_ID" doesn't include the com.apple.developer.security.application-groups entitlement.' Try Again
But the identifiers do have the App Group id enabled. I have tried automatic signing, manual signing with generated profiles, unchecking and rechecking auto-signing, removing and re-adding the group capability. Creating a new bundle id from scratch, creating a new group id from scratch. Always I get the error. I've really pulled my hair out troubleshooting this and would appreciate support.
I'm happy to answer and questions or share details.
Thank you.
I have app developed in electron.js and python and it works in ios 15 after codesigning but not in ios 14 or below
I need to understand if theres a specific instruction that we need to while building the app or do I need to codesign in lower version? what can I do solve this issue??
Topic:
Code Signing
SubTopic:
Notarization
Hi,
I am experiencing an issue where Xcode displays a "Provisioning profile doesn't support the capability" error for the User Assigned Device Name capability, despite it being approved by Apple and visible in our provisioning profile on the Developer Portal.
Background
We have completed and submitted the required capability request form to Apple for the User Assigned Device Name capability and received approval. The capability appears correctly in our provisioning profile on the Apple Developer Portal and shows among the enabled capabilities alongside other standard capabilities like In-App Purchase and Push Notifications.
Issue
However, Xcode consistently displays the error message when trying to enable the User Assigned Device Name capability in our project settings, preventing successful builds with this functionality.
Troubleshooting Steps Attempted
We have tried multiple troubleshooting steps including:
Regenerating provisioning profiles
Performing clean builds
Clearing DerivedData
Manually installing profiles
Adding the com.apple.developer.device-information.user-assigned-device-name entitlement manually to our entitlements file
Toggling automatic signing on and off
Environment Details
Xcode Version: 16.4 (16F6)
iOS Deployment Target: iOS 13
Profile Type: Distribution provisioning profile
Capability: User Assigned Device Name
Despite the capability being approved by Apple and visible in our provisioning profile, Xcode does not recognize it. This appears to be a synchronization issue between the Apple Developer Portal and Xcode's capability validation system.
Has anyone encountered similar issues with recently approved capabilities, specifically the User Assigned Device Name capability? Could you please provide guidance on how to resolve this capability recognition issue? Any suggestions for resolving this discrepancy between the Developer Portal and Xcode would be greatly appreciated.
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
Xcode
Provisioning Profiles
Hi Apple Developer Community,
I'm experiencing an issue with Family Controls entitlements for my iOS app that I'd like to discuss and see if others have encountered similar problems.
Background:
My app (BrightStart) uses Family Controls to help users build healthy morning routines by temporarily blocking distracting apps until they complete a sunlight exposure session. The core functionality relies on automatic time-based blocking (e.g., block social media apps from 6-8am daily).
The Problem:
I have Family Controls working perfectly in development builds, but I'm blocked from distributing via TestFlight due to entitlement issues with my Device Activity Monitor extension.
Technical Details:
Main app bundle ID: app.brightstart.app
✅ Has both "Family Controls (Development)" and "Family Controls (Distribution)" options available
Extension bundle ID: app.brightstart.app.BrightStartMonitorExtension
❌ Only shows "Family Controls (Development)" - no Distribution option
Error when archiving for TestFlight:
❌ Provisioning profile failed qualification
Profile doesn't support Family Controls (Development).
Family Controls (Development) feature is for development only.
Please use Family Controls (Distribution) for distribution.
Impact:
Cannot upload to TestFlight for beta testing
Native FamilyActivityPicker falls back to mock UI in distributed builds
Automatic scheduled app blocking (via DeviceActivityMonitor) doesn't function in production
Questions for the community:
Has anyone successfully gotten "Family Controls (Distribution)" enabled for a Device Activity Monitor extension?
Is this a known limitation, or should I expect this option to be available?
Are there alternative approaches for time-based automatic app blocking that work in distribution builds?
Should I contact Apple Support directly about enabling this entitlement for the extension?
Btw, Cursor wrote this summary above, so it could be just hallucinating the issue? Would really appreciate anyone's thoughts here.
I recently had to update my certificates for a project. I deleted a few old ones, and I currently have one Development certificate. I needed to create another Development certificate specifically, it's saying "Maximum number of certificates generated." I thought the maximum was two Development certificates? Has anyone else had this issue? Thinking it could be a stuck workflow or something like that.
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
Signing Certificates
Developer Program
Dear Apple Developer Technical Support,
I am encountering an issue with notarizing and stapling both PKG and DMG installers for our Electron-based macOS application COSGrid. Despite receiving successful notarization submission responses via notarytool, the stapling process fails with Error 65.
Environment:
App Name: COSGrid
Bundle Identifier: com.cosgrid.pkg.COSGrid
Developer ID Team ID: YB8S2XZ98K
macOS Version: macOS [15.1]
Xcode Version: [16.0 (16A242d)]
Workflow Summary:
For PKG:
Build via yarn build (Vite + Electron Builder)
Package with pkgbuild
Sign using productsign
Submit for notarization:
xcrun notarytool submit COSGridMZA-2.1.10-arm64.pkg --apple-id "..." --team-id YB8S2XZ98K --password "..." --wait
Conducting pre-submission checks for COSGridMZA-2.1.10-arm64.pkg and initiating connection to the Apple notary service...
Submission ID received
id: a8ff8e09-1ab4-49ed-9f6b-4afb9f09e53a
Upload progress: 100.00% (235 MB of 235 MB)
Successfully uploaded file
id: a8ff8e09-1ab4-49ed-9f6b-4afb9f09e53a
path: /Users/murugavel/Documents/MZA/mza/release/2.1.10/COSGridMZA-2.1.10-arm64.pkg
Waiting for processing to complete.
Current status: Accepted.....................
Processing complete
id: a8ff8e09-1ab4-49ed-9f6b-4afb9f09e53a
status: Accepted
Receive notarization success
Stapling fails:
xcrun stapler staple COSGridMZA-2.1.10-arm64.pkg
Could not validate ticket...
The staple and validate action failed! Error 65.
For DMG:
Sign via codesign
Submit to notarization — success
Attempt to staple:
xcrun stapler staple -v COSGrid-2.1.10-arm64.dmg
Could not validate ticket...
The staple and validate action failed! Error 65.
Additional Verification:
I verified the DMG’s code signature integrity:
Command:
codesign --verify --verbose=4 COSGrid-2.1.10-arm64.dmg
Output:
COSGrid-2.1.10-arm64.dmg: valid on disk
COSGrid-2.1.10-arm64.dmg: satisfies its Designated Requirement
Command:
codesign -dvv COSGrid-2.1.10-arm64.dmg
Output:
Executable=/Users/murugavel/Documents/MZA/mza/release/2.1.10/COSGrid-2.1.10-arm64.dmg
Identifier=COSGrid-2.1.10-arm64
Format=disk image
CodeDirectory v=20200 size=308 flags=0x0(none) hashes=1+6 location=embedded
Signature size=9013
Authority=Developer ID Application: COSGrid Systems Private Limited (YB8S2XZ98K)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=1 Jul 2025 at 11:34:05 AM
Info.plist=not bound
TeamIdentifier=YB8S2XZ98K
Sealed Resources=none
Internal requirements count=1 size=180
**Verified Signature for .pkg **
pkgutil --check-signature COSGridMZA-2.1.10-arm64.pkg
Package "COSGridMZA-2.1.10-arm64.pkg":
Status: signed by a developer certificate issued by Apple for distribution
Signed with a trusted timestamp on: 2025-06-30 13:57:19 +0000
Certificate Chain:
1. Developer ID Installer: COSGrid Systems Private Limited (teamID)
Expires: 2027-02-01 22:12:15 +0000
2. Developer ID Certification Authority
Expires: 2027-02-01 22:12:15 +0000
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
Diagnostic Logs Attached:
Stapler verbose logs for both PKG and DMG
codesign verification output for both PKG and DMG
Notarytool submission logs
Ticket JSON response from Apple API
API request/response headers
Effective electron-builder.yaml config
Key Observations:
codesign verification passes successfully for both artifacts
Notarization submission reports success via notarytool
Stapler fails with Error 65 for both PKG and DMG
Ticket JSON fetched from CloudKit API appears valid
No provisioning profile used (Developer ID distribution only)
Request:
Could you please help investigate:
Why is the stapler unable to validate or attach the ticket even though notarization completes successfully?
Are there any known issues, entitlements, or workflow adjustments recommended in this case?
Is any special handling required for Electron apps’ PKG/DMG packages or Hardened Runtime configurations during stapling?
I can provide the signed DMG/PKG and full notarization logs upon request.
Thank you very much for your assistance — looking forward to your guidance.
Best regards,
Murugavel
COSGrid Systems Private Limited
Hello, we are currently encountering a similar issue. We need to inject our capabilities into a third-party app by re-signing it (not a full re-signing process—just requiring the provisioning profile and certificate to match). However, this seems to affect the functionality of universal links. We've found that this issue only occurs on iOS 18.
We noticed that when re-signing the app, the entitlements related to associated domains are changed to a wildcard:
[Key] com.apple.developer.associated-domains
[Value]
[Array]
[String] *
However, this doesn’t cause any issues on iOS 17.
Through further testing, we discovered that in order for universal links to work properly, we need to restore the original value of com.apple.developer.associated-domains and use a provisioning profile that matches the app's bundle ID. This means our previous re-signing approach using a certificate and provisioning profile from another bundle will no longer work.
We’d like to ask: is this a new restriction introduced in iOS 18? If we manually restore the original com.apple.developer.associated-domains entitlement and use a provisioning profile that matches the app’s bundle ID, will universal links function correctly going forward?
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
Entitlements
Provisioning Profiles
Universal Links
Code Signing
Hi everyone,
I'm trying to add the Side Button Access entitlement to my voice-based conversational app following the documentation, but I'm unable to find it in Xcode.
Steps I followed:
Selected my app target in Xcode project navigator
Went to the Signing & Capabilities tab
Clicked the + Capability button
Searched for "Side Button Access"
Problem:
The "Side Button Access" option does not appear in the capabilities list at all.
Environment:
I'm developing and testing in Japan (where this feature should be available)
Xcode version: Xcode 26.2 beta 3
iOS deployment target: iOS 26.2
Questions:
Is there any pre-registration or special approval process required from Apple before this entitlement becomes available?
Are there any additional requirements or prerequisites I need to meet?
Is this feature already available, or is it still in a limited beta phase?
Any guidance would be greatly appreciated. Thank you!
Hi All,
I am building my own MDM server. It seems that in order for the MDM commands to function an MDM Push Certificate for the APNS framework. And in order to get the MDM Push Certificate from the Apple Push Certificates Portal (https://identity.apple.com/pushcert/) you need to upload your CSR usually provided and sign by the MDM Vendor of your choosing. I am familiar with this process.
But now that I am the MDM Vendor, I am not sure where to get this MDM Vendor CSR Signing Certificate.
I've already submitted a formal request via the "contact us" form. Apple's response pointed me to the documentation on Setting Up Push Notifications and the MDM Vendor CSR Signing Certificate help page (which I had already reviewed):
https://developer.apple.com/documentation/devicemanagement/setting-up-push-notifications-for-your-mdm-customers
https://developer.apple.com/help/account/certificates/mdm-vendor-csr-signing-certificate/
The issue is that these documents describe using the signing certificate, but not the process for obtaining it as a new, independent vendor.
So does anyone know of a portal or method of generating this “MDM Vendor Certificate”?
or maybe I'm going about this all wrong and there is a simpler way… the again, its apple, so I’m probably on the right path just beed a little direction please. (I am not sure where to get this MDM Vendor CSR Signing Certificate.)
Dear Apple Developer Support,
I am experiencing a critical issue with Developer ID certificates issued for Turkish (C=TR) developer accounts that prevents code signing on macOS.
Issue Summary
All Turkish Developer ID certificates issued on October 4, 2025, contain an Apple proprietary extension (OID 1.2.840.113635.100.6.1.13) marked as "critical" that both OpenSSL and codesign cannot handle.
Technical Details
Team ID: 4B529G53AG
Certificate Country: TR (Turkey)
Issue Date: October 4, 2025
macOS Version: 15.6.1 (24G90)
Problematic Extension OID: 1.2.840.113635.100.6.1.13 (marked as critical)
Evidence
I have verified this issue across THREE different Turkish Developer ID certificates:
Serial: 21F90A51423BA96F74F23629AD48C4B1
Serial: 461CBAF05C9EDE6E
Serial: 184B6C2222DB76A376C248EC1E5A9575
All three certificates contain the same critical extension.
Error Messages
OpenSSL: error 34 at 0 depth lookup: unhandled critical extension
Codesign: unable to build chain to self-signed root for signer
errSecInternalComponent
Comparison with Working Certificate
My previous Developer ID certificate from Singapore (before revocation) worked perfectly and did NOT contain this critical extension. This confirms the issue is specific to Turkish certificates.
Impact
Cannot sign applications for distribution, which blocks:
DMG signing for distribution
Notarization process
App distribution to users
Questions
What is the purpose of OID 1.2.840.113635.100.6.1.13?
Why is it marked as critical only for Turkish certificates?
Is this related to Turkish regulatory requirements?
Can you issue a certificate without this critical extension?
Is there a macOS update planned to support this extension?
Request
Please either:
Issue a Developer ID certificate without the critical extension OID 1.2.840.113635.100.6.1.13
Provide a workaround for signing with current Turkish certificates
Update the codesign tool to handle this extension
This appears to be a systematic issue affecting all Turkish developers as of October 2025.
Thank you for your urgent attention to this matter.
Best regards,
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Hello, when building and signing my application in a Github actions workflow, I am facing an issue on the latest version of xCode (16.4). This issue is resolved by downgrading to 16.3.
My CI/CD pipeline is running headless and installing provisioning profile to ~/Library/MobileDevice/Provisioning Profiles.
I submitted a mac app for Notarization.
For the first few tries the Notarization failed with an error "Team is not yet configured for Notarization" but few days after my account started to show "ENROLL" option again even though my membership was set to expire on 2026.
I am doubting my account has been suspended.
I have not received any emails from apple regarding the suspension.
I have contacted support but no help yet !
This was the second year, i was paying for the membership.
Could you please help me to -
Help me get the account unsuspended (if it is, as there is no notification or information regarding this)
If the account is suspended due to my app being submitted for Notarization then help me identify the reason so that i can fix them.
Mac App is Time Tracking application that runs in background and capture periodic screenshot backlsh.com (NOTE - I am doing this after taking user consent)
I have an app that runs as a status bar app, mostly. I have set the following in the info.plist file for the app:
<key>Application is agent (UIElement)</key>
<true/>
However, I get a compile error:
Provisioning profile Mac Team Provisioning Profile: yout.Drive doesn't include the Application is agent (UIElement) entitlement.
Checking the entitlements, I do not see this entitlement anywhere. Where and how do I set this?
This is .entitlements file:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.developer.endpoint-security.client</key>
<true/>
</dict>
</plist>
Code signing:
codesign --sign -vvv --timestamp --options=runtime --force --entitlements ./UES.entitlements -s "Developer ID Application: XXXX Ltd. (XXXXXX)" ./UES.app
When I run it on macOS 13.x, it works fine. If I run the system on macOS 11.x, it reports a "killed" error
(if codesign remove --entitlements ./UES.entitlements, Then the startup will not report an error, but the endpoint security rights cannot be used)
System log:
2025-04-21 13:58:27.039638+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:27.039762+0800 0xd5bbf Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:27.039815+0800 0xd5bbf Default 0x0 0 0 kernel: proc 29354: load code signature error 4 for file "UES"
2025-04-21 13:58:27.040720+0800 0xd5bc0 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29354, /Applications/UES.app/Contents/MacOS/UES
2025-04-21 13:58:27.045974+0800 0xd58be Error 0x0 66405 0 CoreServicesUIAgent: [com.apple.launchservices:uiagent] handle LS launch error: {\n Action = oapp;\n AppMimimumSystemVersion = "10.13";\n AppPath = "/Applications/UES.app";\n ErrorCode = "-10826";\n}
2025-04-21 13:58:39.121619+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:39.121832+0800 0xd5e0f Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:39.121861+0800 0xd5e0f Default 0x0 0 0 kernel: proc 29415: load code signature error 4 for file "UES"
2025-04-21 13:58:39.122571+0800 0xd5e10 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29415, /Applications/UES.app/Contents/MacOS/UES
2025-04-21 13:58:46.297915+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:46.298031+0800 0xd5f85 Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:46.298072+0800 0xd5f85 Default 0x0 0 0 kernel: proc 29485: load code signature error 4 for file "UES"
2025-04-21 13:58:46.300248+0800 0xd5f86 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29485, /Applications/UES.app/Contents/MacOS/UES
May I ask what the reason is?
Topic:
Code Signing
SubTopic:
Entitlements
I have a free developer account, and I have been creating applications. When I tried to open one of them, it said that this app has been flagged as malware. It is not malware, so I don't know why it has been flagged as this. Not just this app, but suddenly a whole bunch of my apps have been flagged as malware as well!
The app I have been developing is basically a windows Taskbar for my macbook air, and it has been working well until the latest update i made where it hides in full screen, suddenly it started taking up significant energy, so i reverted to an older version while i was fixing it. Then, when i try to open it another time, it starts to open, and it says "Malware Blocked and Moved to Bin" “Taskbar.app” was not opened because it contains malware. This action did not harm your Mac”. All versions of the taskbar now contain this message. I try opening some of my other apps, a shared storage client and a shared storage server (where i was testing with app groups), and they couldn't open either, the same malware message appeared. ProPermission couldn't open either (changes permissions on files for me so i don't have to use the terminal or finder). I can run these apps through the Xcode environment (attached process), but when I archieve it into an app bundle, the malware flag appears.
Please note that I am certain that these apps do not contain malware, apparently XProtect has incorrectly flagged my apps as malware. Because I do not have the paid developer account, I cannot notarize my apps.
I am using MacOS Tahoe 26.1 with Xcode 26.0, and I have tested it with a iMac Intel 2017 with MacOS Ventura.
This is my .entitlements file:
Code signing:
codesign --sign -vvv --timestamp --options=runtime --force --entitlements ./UES.entitlements -s "Developer ID Application: XXX. (XXXXXXX)" ./UES.app
I work fine in the macOS 13.x system, but the "killed" error occurs in macOS11.x. The system log is displayed as follows:
(If codesign remove the --entitlements ./UES.entitlements, it will operate normally)
2025-04-21 13:58:27.039638+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:27.039762+0800 0xd5bbf Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:27.039815+0800 0xd5bbf Default 0x0 0 0 kernel: proc 29354: load code signature error 4 for file "UES"
2025-04-21 13:58:27.040720+0800 0xd5bc0 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29354, /Applications/UES.app/Contents/MacOS/UES
2025-04-21 13:58:27.045974+0800 0xd58be Error 0x0 66405 0 CoreServicesUIAgent: [com.apple.launchservices:uiagent] handle LS launch error: {\n Action = oapp;\n AppMimimumSystemVersion = "10.13";\n AppPath = "/Applications/UES.app";\n ErrorCode = "-10826";\n}
2025-04-21 13:58:39.121619+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:39.121832+0800 0xd5e0f Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:39.121861+0800 0xd5e0f Default 0x0 0 0 kernel: proc 29415: load code signature error 4 for file "UES"
2025-04-21 13:58:39.122571+0800 0xd5e10 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29415, /Applications/UES.app/Contents/MacOS/UES
2025-04-21 13:58:46.297915+0800 0xd5941 Default 0x0 149 0 amfid: /Applications/UES.app/Contents/MacOS/UES signature not valid: -67050
2025-04-21 13:58:46.298031+0800 0xd5f85 Default 0x0 0 0 kernel: mac_vnode_check_signature: /Applications/UES.app/Contents/MacOS/UES: code signature validation failed fatally: When validating /Applications/UES.app/Contents/MacOS/UES:
2025-04-21 13:58:46.298072+0800 0xd5f85 Default 0x0 0 0 kernel: proc 29485: load code signature error 4 for file "UES"
2025-04-21 13:58:46.300248+0800 0xd5f86 Default 0x0 0 0 kernel: (AppleSystemPolicy) ASP: Security policy would not allow process: 29485, /Applications/UES.app/Contents/MacOS/UES
What causes the pattern to be narrow?
Hello Apple Developer Support Community,
I am encountering a persistent issue while trying to code sign my macOS application (PromptVault.app) using a valid Developer ID Application certificate. The signing process fails with the following warning and error for every native .so file inside the app bundle:
`Warning: unable to build chain to self-signed root for signer "(null)"
<file-path>: errSecInternalComponent`
What I have tried so far:
Verified that my Developer ID Application certificate and the associated private key exist correctly in the login keychain.
Confirmed that the intermediate certificate "Apple Worldwide Developer Relations - G6" is installed and valid in the System keychain.
Added Terminal to Full Disk Access in Security & Privacy to ensure signing tools have required permissions.
Executed security set-key-partition-list to explicitly allow code signing tools to access the private key.
Reinstalled both developer and Apple intermediate certificates.
Used codesign to individually sign .so files and then sign the entire bundle.
Ensured macOS and Xcode Command Line Tools are up to date.
Created a clean Python virtual environment and rebuilt all dependencies.
Tested code signing in multiple ways and with verbose logging.
Current status:
Despite all these efforts, the same warning and error persist during the signing process of every .so file. This prevents successful code signing and notarization, blocking distribution.
Request for assistance:
Could anyone confirm if my certificate and keychain setup sounds correct?
Are there known issues or extra steps necessary to properly build the trust chain for Developer ID certificates on macOS 15.6.1 (Sequoia)?
Any suggestions for resolving the errSecInternalComponent during signing native libraries?
Guidance on ensuring the entire certificates chain is trusted and usable by codesign tools?
I can provide debug logs, screenshots of my keychain and security settings, or any other diagnostic information if needed.
Thanks in advance for your help!
Hello,
I’m having trouble enabling Background Location updates on my iOS app.
Xcode: 26.0 beta
Team: Individual Developer Program (paid, activated recently)
Device: iPhone (physical device, registered and provisioned)
Problem
When building to device, I get the error:
Provisioning profile "iOS Team Provisioning Profile: com.mybundle.id" doesn't include the com.apple.developer.background-modes entitlement.
Automatic signing failed.
On the simulator the build succeeds, but on device the signing fails unless I remove the background-modes entitlement from .entitlements.
What I tried
Enabled Background Modes → Location updates in Signing & Capabilities (UI only).
Info.plist contains UIBackgroundModes = location and the required NSLocation…UsageDescription keys.
Cleaned Derived Data, removed cached provisioning profiles (~/Library/Developer/Xcode/UserData/Provisioning Profiles).
Changed Bundle Identifier to force regeneration of provisioning profiles.
Deleted and recreated provisioning profiles from Xcode.
Tried both with and without manual .entitlements edits.
Current status
Provisioning profile shows only App Groups, In-App Purchase, Push Notifications.
Entitlements section in the downloaded profile is missing com.apple.developer.background-modes.
As a result, background location cannot be enabled on device.
Question
Is this a known issue with Xcode 16/26 beta or with Individual Developer accounts?
How can I get com.apple.developer.background-modes included in my provisioning profile so that location tracking continues while the screen is locked?
Thank you.
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
Xcode
Provisioning Profiles
Core Location