Lists

Open Menu Close Menu

Terms and Conditions
Lists hosted on this site
Email the Postmaster
Tips for posting to public mailing lists

Re: Code-signing changes on OSX 10.11 GM?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Code-signing changes on OSX 10.11 GM?

Subject: Re: Code-signing changes on OSX 10.11 GM?
From: Marek Hrušovský <email@hidden>
Date: Tue, 22 Sep 2015 11:55:21 +0200

You probably have symlinks in your nested framework

Verify with:

codesign --verbose=4 --deep --strict xxx.app

On Tue, Sep 22, 2015 at 11:49 AM, Sak Wathanasin <email@hidden> wrote:

I haven't seen any discussion of this issue here, so I'll assume that I'm doing something wrong.
Does anyone know if the code-signing requirements for 10.11 have changed?

Our app is being rejected by Gatekeeper on OSX 10.11 GM (but accepted on 10.8 - 10.10). "spctl -a"
on 10.10 accepts it, but on 10.11, it says:

xxx.app: rejected
source=obsolete resource envelope
origin=Developer ID Application: blah...

However, "codesign --verbose=4 --deep --verify" doesn't object:

xxx.app: valid on disk
xxx.app: satisfies its Designated Requirement

"codesign -dv" says:

...etc...
TeamIdentifier=YYYYY
Sealed Resources version=2 rules=12 files=555
Nested=Frameworks/UIElements.framework

I tried spctl -a --raw and it says

xxx.app: rejected
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>assessment:authority</key>
<dict>
<key>assessment:authority:source</key>
<string>obsolete resource envelope</string>
<key>assessment:authority:weak</key>
<true/>
</dict>
<key>assessment:cserror</key>
<integer>-67003</integer>
<key>assessment:remote</key>
<true/>
<key>assessment:verdict</key>
<false/>
</dict>
</plist>

Any idea what cserror -67003 is?

Many thanks
--
Sak Wathanasin
Network Analysis Limited http://www.network-analysis.ltd.uk

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Xcode-users mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Xcode-users mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden

References:
	>Code-signing changes on OSX 10.11 GM? (From: Sak Wathanasin <email@hidden>)

Prev by Date: Code-signing changes on OSX 10.11 GM?
Next by Date: Re: Code-signing changes on OSX 10.11 GM?
Previous by thread: Code-signing changes on OSX 10.11 GM?
Next by thread: Re: Code-signing changes on OSX 10.11 GM?
Index(es):
- Date
- Thread