Home/ Questions/Q 6753899
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T13:13:00+00:00

I’ve just submitted an app to the Mac App Store that uses some external

  • 0

I’ve just submitted an app to the Mac App Store that uses some external dynamic libraries.

I got an email from Apple saying that:

Invalid Signature – the executable something.app/Contents/Frameworks/some.dylib is not signed, the signature is invalid, or it is not signed with an Apple submission certificate. Refer to the Code Signing and Application Sandboxing Guide for more information.

The problem is of course caused by the fact that I only signed “my” executable, not the libraries.

Is it common/good practice to also sign the libraries, even though they’re not written by me?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Think of digitally signing a file as:

    1. A means of verifying the integrity of that file, thus making it possible to detect whether it’s been modified;

    2. A means of verifying who published that file, which is not the same as writing the corresponding source code. You’re attesting that it was really you who’s shipped that file.

    Since dynamic libraries contain executable code, it’s good practice (and in some cases, such as the MAS, mandatory) to digitally sign them for the same reason you sign the main executable file: guaranteeing that your application is exactly what you (and only you) have shipped from your build machine, no changes whatsoever. A running program includes the main executable file and all loaded libraries. If you sign the main executable file only, leaving the dynamic libraries unsigned, it would be possible to alter the dynamic libraries (or even replace them), thus changing what your program does.

    • 0