Question

I’ve recently submitted an application to the Mac App Store and have received an email informing me that the build contains resources (two in total) that carry an invalid signature:

We have discovered one or more issues with your recent binary
submission for “X”. Your app has proceeded to review, but the
following issues should be corrected in your next submission:

Invalid Signature – the nested app bundle Y is not
signed, the signature is invalid, or it is not signed with an Apple
submission certificate. Refer to the Code Signing and Application
Sandboxing Guide for more information.

I’ve read the linked Code Signing and Application Sandboxing Guide but am unfortunately none the wiser as to how I’d go about correctly signing these resources. The first is an executable and the second is a framework. Neither of which I compile manually.

What’s the correct way of correctly signing these resources?

Answer 1

You most likely have embedded Frameworks which are not signed. If are using Xcode with sub projects that are Frameworks or have included frameworks which are copied into the application bundle, they must be code signed.

One simple way around this is to use static libraries instead of Frameworks.