Overview

Post

Replies

Boosts

Views

Activity

Organization enrollment stuck more than 4 weeks — no response, phone callbacks not connecting
Hi, Posting here after exhausting standard support channels for a stuck organization enrollment. Timeline: August 7, 2026 — Submitted Apple Developer Program enrollment for our organization. Since then — No update, no email, no change in status. The enrollment has been sitting silently for over 4 weeks with no indication of what (if anything) is wrong. Support attempts so far: Opened multiple support cases (Case numbers: 102954003819, 20000146177866, 20000136358412) via developer.apple.com/contact. No response to either. Requested a phone callback through the "Membership and Account" contact option many times, from different phone numbers. Each time no callback. No error message, rejection notice, or request for additional information has been received at any point — the case simply shows no progress. What I'm asking: Could someone from Apple Developer Relations or a forum moderator help look into this case, or advise on how to get a response? I'm happy to provide any additional verification or documentation needed — I just have no visibility into what's blocking the review, and standard channels haven't been able to help.
0
0
20
20h
SMAppService LaunchDaemon: is privilege drop followed by same-PID exec supported before Mach service check-in?
I’m designing a least-privilege system LaunchDaemon registered with SMAppService, and I’d like to clarify whether the following architecture is supported by public macOS contracts. The LaunchDaemon declares a MachServices entry. Its steady-state service must run as a dedicated non-root account and later creates an NSXPCListener for that Mach service. We currently launch the daemon directly using UserName, GroupName, and InitGroups=false. However, InitGroups=false does not appear to guarantee that the resulting process supplementary-group list is limited to the service’s intended group. In testing, the daemon received a supplementary group outside our accepted set. We therefore do not want to depend on incidental inherited launch-time group state. We are considering this alternative: launchd starts a small, fixed, code-signed bootstrap executable as root. The bootstrap reads the target UID/GID from an existing protected root-owned binding record. It establishes an exact credential state using public BSD APIs, conceptually: setgroups(...) setgid(...) setuid(...) It verifies the resulting non-root credentials. It creates no XPC listener or storage connection while privileged. Without forking, it permanently replaces itself using execve() (or possibly POSIX_SPAWN_SETEXEC) with another fixed, separately signed executable in the same bundle. That non-root executable independently validates its security state and then creates NSXPCListener(machServiceName:) for the Mach service declared by the original LaunchDaemon job. The bootstrap would not remain as a privileged parent or supervisor. My main questions are: Is a same-PID exec after permanent UID/GID/supplementary-group reduction supported for an SMAppService system LaunchDaemon before it checks in to its declared Mach service? Does the exec-replaced process retain the launchd/bootstrap context required for NSXPCListener(machServiceName:) to check in to that Mach service? If so, what execution context must be preserved across exec (for example bootstrap context, environment, file descriptors, or Mach rights)? Is there a documented way to preserve only the context required for the LaunchDaemon/Mach-service relationship without carrying unintended root-derived capabilities into the non-root executable? Would SMAppService.unregister() / normal launchd termination continue to treat the exec-replaced process as the same LaunchDaemon job? If this topology is not supported, is there an Apple-supported way to establish an exact supplementary-group set before a non-root SMAppService LaunchDaemon begins handling its Mach service? The goal is to avoid relying on undocumented launchd behavior, incidental supplementary groups, private APIs, or a long-lived privileged helper. I’m specifically looking for the supported contract here rather than whether this happens to work on a particular macOS release.
0
0
20
20h
How to obtain Apple Account ID
Could you please advise us on how to obtain the Apple Account ID in the following cases? The Apple Account ID currently signed in on an iOS device. The Managed Apple Account ID associated with the Apple Business Manager (ABM) or Apple School Manager (ASM) account that manages the Apps and Books token. We would appreciate it if you could let us know whether there is an API, MDM command, or other supported method to retrieve these IDs.
0
0
18
20h
Building a library playlist on macOS that mixes catalog songs and the user's own uploads in a fixed order – supported route, and how to know when an upload is registered?
Our sandboxed macOS app digitises audio cassettes and builds one playlist per cassette in the user's Apple Music library that follows the tape's order: catalog songs where a title was recognised, and the user's own recordings (AAC files the app exported from the tape) where it was not. The user has an Apple Music subscription and Sync Library on. On macOS every write on MusicLibrary is marked @available(macOS, unavailable) in the 26.5 SDK – add, add(_:to:), createPlaylist and edit (see thread 844114, which got no answer). So we build the playlist through Music.app's scripting interface: make new user playlist, duplicate <library track> to <playlist> for catalog songs, add <file> to <playlist> for own recordings. That works, with one exception that leads to our questions. What we observe Reproducible on macOS 26.6.2 / Music 26; a standalone AppleScript is at the end. A playlist built in one go from 14 subscription tracks keeps all 14. The same playlist with one local file added after the second track: all 15 entries are there right after the build and one second later. About 15 s later the playlist has 3 entries – the two catalog entries before the file, the file, and nothing that was added after it. No error anywhere. If the file has been in the library for several minutes before the playlist is built, everything stays. Adding it to the library and waiting 45 s is not enough. Meanwhile the track's cloud status stays unknown, and GET /v1/me/library/search?types=library-songs does not list it (checked for 10 minutes). Emptying the playlist and building it again ~30 s after the entries were removed keeps everything, every time. That is what we do today; it costs 30–40 s per import, and we have to tell the user that entries were removed and put back. Our reading: while the freshly added file is not yet registered in iCloud Music Library, the playlist as pushed to the server is cut at the first item the server cannot reference, and the next sync adopts the shorter list for cloud items while keeping the local-only item in place. Questions Is there a supported way for a macOS app to create a library playlist and add tracks to it? Specifically: is the Apple Music API (POST /v1/me/library/playlists with relationships.tracks, and POST /v1/me/library/playlists/{id}/tracks) the intended route from a macOS app holding a MusicKit user token, and can such a playlist reference the user's own uploaded songs by their library id (i.…)? After a local file has been added to the library (via Music.app's add, or any other supported way), how can an app learn that iCloud Music Library has registered it, and what its library song id is? A notification, a MusicKit property, an Apple Music API endpoint? We would wait on that signal instead of rebuilding. Is the removal described above expected behaviour? Catalog ids are re-resolved at import time via id, ISRC and search as recommended in thread 122110, so stale catalog ids are not the cause. Reproduction Needs Sync Library on, at least 14 subscription tracks in the library, and a local audio file the library does not know yet. Prints the counts after 1 s, 21 s and 41 s, then cleans up. on run argv set localFile to POSIX file (item 1 of argv) tell application "Music" set cloudTracks to (every track of library playlist 1 whose cloud status is subscription) set idsBefore to persistent ID of every track of library playlist 1 set pl to make new user playlist with properties {name:"Reconciliation repro"} repeat with i from 1 to 2 duplicate (item i of cloudTracks) to pl end repeat set fileTrack to add localFile to pl set fileID to persistent ID of fileTrack repeat with i from 3 to 14 duplicate (item i of cloudTracks) to pl end repeat set n0 to count of tracks of pl delay 1 set n1 to count of tracks of pl delay 20 set n2 to count of tracks of pl delay 20 set n3 to count of tracks of pl delete pl if fileID is not in idsBefore then delete (first track of library playlist 1 whose persistent ID is fileID) return "after build: " & n0 & ", after 1 s: " & n1 & ", after 21 s: " & n2 & ", after 41 s: " & n3 end tell end run Output here: after build: 15, after 1 s: 15, after 21 s: 3, after 41 s: 3.
0
0
203
20h
Macbook M5 Development Kernel Panic
Hi, I'm posting a boot crash here. Environment Hardware: Macbook M5 Pro OS Version: macOS 26.3.1 (25D2128) and matching version of KDK from official apple download page Kernel Version: Darwin Kernel Version 25.3.0 Reproducibility: Consistent Here is my panic log --- I truncated one field "SOCDNandContainer" as the original log is too long to post, hitting the size limit. I followed a blog post to boot the development kernel as the ReadMe file from KDK only contains instructions for Intel Macs. https://jaitechwriteups.blogspot.com/2025/10/boot-custom-macos-kernel-on-macos-apple.html I've tried a few 26.2 KDKs before 26.3.1 public launch, and they all showed same errors (26.1 and 26.0 KDKs don't have any development kernel for T8142 chip). Also, I own two fresh M5 Pro, and it is consistent across the machines. The highlight is panic(cpu 8 caller 0xfffffe0050e18010): [Exclaves] $JgOSLogServerComponent.RedactedLogServer.init(logServerNotific:OSLogServerComponent\/OSLogServerComponent_Swift.swift:815: Fatal error: invalid rawValue for TightbeamComponents.RedactedLogSer at PC ... Is this a genuine bug or am I following a wrong guide to boot the development kernel? I don't think the blog is wrong because I'm able to boot the "release" kernel included in the KDK on the same M5 Pro, and the "development" kernel on M4 Mac Mini, using the same routine. Just to be clear, I'm not compiling XNU myself, but am using the ones included in the kit.
1
1
567
20h
In-App Purchase key returns 401 (4010000) on Advanced Commerce API but 200/404 on App Store Server API
Environment: Sandbox Bundle ID: com.fosssocial.app Key ID: L7DZYHGM62 Issuer ID: cf1f7bc7-452f-4bb8-a925-31ca29175fac Summary Our In-App Purchase key is accepted by the App Store Server API but rejected by the Advanced Commerce API, using the exact same bearer token. This appears to be an authorization grant that was never applied to the key, rather than a signing or request-format problem on our side. Reproduction — one token, two API families GET /inApps/v1/subscriptions/1 -> 404, errorCode 4040010 (token ACCEPTED, resource simply not found) POST /advancedCommerce/v1/subscription/changeMetadata/1 -> 401, errorCode 4010000 (token REJECTED) Same JWT, same key, issued seconds apart. A 401 on one family and a 404 on the other isolates this to key authorization. On-device symptom A signed SubscriptionCreateRequest passed to StoreKit as advancedCommerceData fails with StoreKitError.unknown / "Unable to Complete Request". No payment sheet appears and no InvalidRequestError is returned, so there is no field-level error to act on. What we have already verified JWS header: alg ES256, kid, typ JWT Claims: iss, iat, aud "advanced-commerce-api", bid, nonce, request No exp claim (per Apple's documentation) The request claim uses standard padded base64, not base64url Key ID and .p8 file confirmed to be a matching pair Key regenerated after receiving the Advanced Commerce access-granted email; the 401 is unchanged AdvancedCommerceProduct(id:) resolves successfully on device, which confirms the PRODUCT has Advanced Commerce access Question Does the In-App Purchase key require a separate authorization for the Advanced Commerce API beyond the product-level access we were granted? If so, how is that applied to an existing key?
0
0
19
20h
Membership expired — no Renew button anywhere, callback form also broken (country change bug)
My Apple Developer Program membership expired on September 4 and all my apps have been removed from the App Store. I cannot renew through any path: The expiration banner says to renew via the Apple Developer app. I reinstalled it and signed in again — there is no Renew button, only expired membership details. On the developer website there is no billing/payment section at all — no option to add a payment method or renew. The phone callback form on my support case page is broken: tapping Call opens the confirmation page and immediately redirects back (desktop and iPhone Safari — same result). Background: I relocated to Armenia and changed the country on both my developer account and my personal Apple Account. I reported the missing payment option to Developer Support on August 17 — three weeks before expiration. Support replied that having a payment method on my Apple Account was all that's needed. It was already there and works for App Store purchases — yet no renewal charge was ever attempted, and the membership expired. Support case: 20000139749968, still unresolved. I am ready to pay right now. Could someone from Apple please check the renewal/billing state of my account or arrange a callback? It looks stuck after the country change.
0
0
27
20h
DSA compliance phone verification fails
Has anyone successfully completed DSA compliance phone number verification using the "receive a phone call" option? It seems that Apple first tries to send an SMS. You then have the option to resend another SMS, to receive a phone call, or to upload documents. When I choose to receive a phone call, it seems that the Apple system calls me but it hangs up without reading out a code. Has anyone got this to work?
6
0
1.9k
20h
Safari iOS 26.6: front camera getUserMedia track reports landscape while the drawn frame is portrait, MediaRecorder writes a sideways file with no rotation flag (workaround inside)
Device: iPhone 15, iOS 26.6, Safari. Also reproduced on Android Chrome, so this is not only WebKit, but the missing rotation flag part is. Setup: a web page asks for the front camera with getUserMedia, shows it in a video element, and records with MediaRecorder. Phone held upright. What happens: Requesting portrait dimensions (width 1080, height 1920) returns the sensor's wide preset, 1920 by 1080, unrotated. exact instead of ideal gives the same or an error. aspectRatio 9/16 gives the same. Requesting landscape numbers (width 1920, height 1080) lets Safari pick the preset and rotate the picture to match how the phone is held. Even then, the video track's getSettings() reports width 1920 and height 1080, while the frame Safari draws into the video element is portrait. The preview looks right. The track lies. MediaRecorder records the unrotated sensor buffer. On older iOS the file carried a displaymatrix rotation of minus 90 degrees and players honoured it. On 26.6 that flag is gone, so the file plays sideways. Thread 786803 has other people finding the same. Workaround that works in production: Ask for the camera in landscape numbers. Do not trust getSettings(). Draw one frame of the video element onto a 16 by 16 canvas scaled from the larger reported dimension and check which corner has paint. If the bottom left is painted and the top right is not, the picture is tall. If the drawn picture is portrait but the track says landscape, record a canvas stream of the drawn picture at its own size instead of the raw track. If they agree, record the raw track. Put the H.264 High profile first in your mime type candidates. isTypeSupported says yes to Baseline and High, and list order decides, so Baseline first gives soft video. Working code, MIT, with the dead ends left in as comments: https://github.com/lagudafuadtosin/web-teleprompter (src/lib/camera.ts) Full write-up: https://dev.to/lagudafuad/why-your-web-teleprompter-records-sideways-on-iphone-and-the-fix-549m Question for Apple: is the dropped displaymatrix on MediaRecorder output in 26.x intentional, and is there a supported way to read the capture rotation off the track?
Topic: Safari & Web SubTopic: General Tags:
1
0
488
20h
ios26 camera problem on home screen apps
since the release of iOS26 i get new reports of people making home screen apps of website pages that had camera accessibility to take pictures that mention the camera being 90degree sideways to what it should be. i have tested it myself and was able to reproduce the issue quite easily on iPhones 13|15|16 regular and pro versions. this affects all cameras when trying using them with navigator.mediaDevices.getUserMedia({...})...
3
0
894
20h
iOS 26.4 — How to return from main app to host app after a keyboard-extension dictation round-trip, without private APIs?
I'm building a custom keyboard extension that offers voice dictation. Because keyboard extensions are constrained (memory cap ~30–48 MB, restricted audio session access), I delegate recording to my container app: User in a host app (e.g., Safari) taps the mic in my keyboard extension. The keyboard calls extensionContext.open(URL("myapp://dictation")) to launch the container app. The container app records audio via AVAudioEngine + SFSpeechRecognizer, writes the final transcript to the App Group, and signals completion via a Darwin notification. 4. The user is expected to be returned to the original host app (Safari) automatically so they can keep typing. The problem (step 4): On iOS 26.4 I can no longer identify which app was the host. Every previously-known path returns nil for the keyboard extension's host: parent.value(forKey: "_hostBundleID") → returns the literal string parent.value(forKey: "_hostApplicationBundleIdentifier") → returns NSNull xpc_connection_copy_bundle_id on the underlying XPC connection (via PKService.defaultService.personalities[…]) → returns NULL NSXPCConnection.processBundleIdentifier on extensionContext._extensionHostProxy._connection → returns nil proc_pidpath(hostPID, …) → EPERM from the keyboard sandbox LSApplicationWorkspace.frontmostApplication → selector unavailable from the extension RBSProcessHandle.handleForIdentifier:error: → returns an RBSServiceErrorDomain error Without the host's bundle ID, the container app has no way to call LSApplicationWorkspace.openApplicationWithBundleID: (the technique that worked on iOS 25 and earlier). UIApplication.suspend() correctly sends the container to background, but iOS treats us as a "fresh launch" — it returns the user to the Home Screen instead of Safari, because the container app was launched by an extension, not directly by Safari. KeyboardKit's maintainer reached the same conclusion (issue #1014) and shipped 10.4 without the feature. My questions: Is there a public, App-Store-safe API in iOS 26+ for a custom keyboard extension to identify its host application, or for the container app (launched via the extension's openURL) to identify which app initially hosted the extension that opened it? UIOpenURLContext.options.sourceApplication reports the extension's own container, not the actual host. 2. Is there a public mechanism for "return to source app" when the container app was launched by an extension's openURL? Equivalent to the ← Source affordance iOS shows for normal inter-app openURL, but triggered programmatically by the launched app. 3. Some popular keyboards (e.g., 微信输入法 / WeChat Keyboard) still appear to round-trip through their container app on iOS 26.4 and return the user to the original host — including the iOS ← WeChat back affordance in the host's status bar afterward. What's the recommended approach to achieve this? If it requires a specific scene-activation flow, NSUserActivity pattern, or extension-context configuration, please point at the relevant docs. 4. If there is no public path today, is FB22247647 (or a related radar) the right place to track this? Should developers in this position migrate to in-extension audio capture (which has its own significant constraints in keyboard extensions)? I'd much rather not rely on private APIs. Concrete guidance — or even an acknowledgment of which direction Apple intends — would help thousands of custom-keyboard developers who currently have a degraded voice-input experience on iOS 26.4+. Tested on iPhone 12 Pro Max running iOS 26.4.2 (build 23E261), Xcode 26.x, Swift 5. Thanks!
5
0
1.4k
21h
Matter device shows “Uncertified Accessory” in Apple Home despite CSA certification and DCL listing (OEM/ODM, Portfolio Family CD)
Hello Apple Home/Matter team, our Matter product is CSA-certified, has a valid CD, and is listed in Compliance DCL. In testing with HomePod mini as border router, commissioning proceeds but Apple Home still shows “Uncertified Accessory.” We are an OEM/ODM manufacturer: product vendor_id/product_id belong to the brand owner, while dac_origin_vendor_id/dac_origin_product_id belong to us(manufacturer). The device also uses the brand owner’s product VID/PID at runtime. Our certification is Portfolio Family, so CD product_id is an array covering 6 SKUs. Is this model expected to pass Apple Home certification checks, and what are the most common causes of this warning? Emma
0
1
236
21h
IKEv2 Personal VPN: Child SA torn down after 120s idle (NEIKEv2ErrorDomain Code=15) with DisconnectOnIdle already NO
We ship a consumer VPN app on iOS, iPadOS and tvOS using a Personal VPN configuration: NEVPNManager with NEVPNProtocolIKEv2, EAP-MSCHAPv2, no MDM profile installed. After exactly 120 seconds with no traffic, iOS destroys the Child SA and disconnects the tunnel. I would like to know whether that timer is configurable, and if not, what the intended mitigation is. From a device sysdiagnose (iPhone, iOS 26.6, build 23G71): NEIPSecDBStatsUpdate: SA is idle for past 120 secs KernelSASession[1, IKEv2 Session Database] idle timeout SA Internal SAID = 2 SPI = C53320D1 Direction = Outbound ChildSA[1] state Connected -> Disconnected error Domain=NEIKEv2ErrorDomain Code=15 "IdleTimeout" <NEIKEv2Provider: Primary Tunnel>: stopping tunnel since Child disconnected nesessionmanager: plugin disconnected with reason "Tunnel was idle for too long" This happened 12 times across a 9.2 hour overnight capture on one idle device. Median time before the tunnel re-established was 14m35s. DISCONNECT-ON-IDLE IS NOT ENABLED The same sysdiagnose shows the plugin's own configuration as: disconnectOnIdle = NO disconnectOnIdleTimeout = 0 These are the stock defaults. There is no disconnectOnIdle property on the public NEVPNProtocol, so a Personal VPN app cannot set them either way. The installed SA parameters contain no idle field at all, only "Lifetime Seconds = 1800", which is honoured correctly: the same capture shows 20 clean rekey cycles. WHAT I HAVE RULED OUT iOS logs a distinct stop reason for each of the following, and none of them occurred across 24 teardowns: "On Demand Disconnect rule matched", "Tunnel was terminated by the server", "Server is not responding", "Network changed, tunnel no longer viable", "Device went to sleep", "Stop command received". The only reason recorded was "Tunnel was idle for too long". On the gateway (strongSwan), IKE rekey and reauth are disabled, uniqueids is never, and DPD is answered in roughly 200ms right up to the teardown. The gateway considers the tunnel healthy at the moment iOS tears it down. DPD does not reset the timer, which makes sense: DPD is an INFORMATIONAL exchange on the IKE SA, whereas the log shows the timer measuring the OUTBOUND Child SA (SAID 2). THE APP CANNOT SEE THIS HAPPEN NEVPNConnection.fetchLastDisconnectError() returns nil for this teardown, because the error is in NEIKEv2ErrorDomain rather than NEVPNConnectionErrorDomain. The app has no supported way to detect that the tunnel dropped for this reason, or to distinguish it from a user-initiated disconnect. It is only visible in a sysdiagnose. TRAFFIC IS NOT HELD DURING THE RECONNECT With Connect On Demand enabled (NEOnDemandRuleConnect, interfaceTypeMatch .any), traffic after the teardown does not wait for the tunnel. On device wake following one of these drops: 01:32:43 device wakes 01:32:43 [C331 ... :443] path:satisfied @0.001s, interface: en0[802.11], uses wifi 01:32:44 [C331 ... :443] flow:finish_connect @0.623s (over en0) 01:32:47 tunnel status changed to connected so flows complete over the physical interface for several seconds before the VPN re-establishes. On-demand triggered the reconnect but did not delay the traffic. For a VPN product this window is the part that concerns me most. QUESTIONS Is the 120 second Child SA idle timeout configurable for a Personal VPN using NEVPNProtocolIKEv2, from the app or from a configuration profile? If DisconnectOnIdle / DisconnectOnIdleTimer are meant to control it, why does the teardown occur when they are NO / 0? If it is not configurable, is application-generated keepalive traffic the intended workaround? If so, how is that expected to work while iOS has the app suspended, which is exactly when a tunnel goes idle? Would server originated traffic that elicits a client response be a supported approach? Is there any supported way for an app to be notified of this teardown, given that fetchLastDisconnectError() returns nil for it? Is the behaviour in "traffic is not held during the reconnect" expected for NEOnDemandRuleConnect, or should matching flows be delayed until the tunnel is up? Is includeAllNetworks the only supported way to close that window? Happy to supply the full sysdiagnose privately.
1
0
217
21h
Any summaries of "NetworkConnection"?
I heard that the Network framework can help using networking with Swift concurrency. I read up on "NWConnection," which uses a DispatchQueue. I was wondering how queues fit together with concurrency, then I heard about a related class, "NetworkConnection." I realized that the new class is in the same module, but introduced for macOS 26. I saw the WWDC25 video about it, but it assumed that I already knew about its result-builder connection setup. I don't; was it introduced in an earlier video? A lot of times, I find a web article soon after some WWDC that explains how to actually a new API. The problem is that the class' name is un-Google-able, being two actual words concatenated together that can reasonably be found together. Does anyone have a link of a post-WWDC25 article explaining NetworkConnection?
3
0
337
21h
Networking Resources
General: Forums subtopic: App & System Services > Networking TN3151 Choosing the right networking API Networking Overview document — Despite the fact that this is in the archive, this is still really useful. TLS for App Developers forums post Choosing a Network Debugging Tool documentation WWDC 2019 Session 712 Advances in Networking, Part 1 — This explains the concept of constrained networking, which is Apple’s preferred solution to questions like How do I check whether I’m on Wi-Fi? TN3135 Low-level networking on watchOS TN3179 Understanding local network privacy Adapt to changing network conditions tech talk TCP and UDP ports used by Apple software products support article Understanding Also-Ran Connections forums post Extra-ordinary Networking forums post Foundation networking: Forums tags: Foundation, CFNetwork URL Loading System documentation — NSURLSession, or URLSession in Swift, is the recommended API for HTTP[S] on Apple platforms. Moving to Fewer, Larger Transfers forums post Testing Background Session Code forums post Network framework: Forums tag: Network Network framework documentation — Network framework is the recommended API for TCP, UDP, and QUIC on Apple platforms. WWDC 2025 Session 250 Use structured concurrency with Network framework — This is a great introduction to the new Network framework API introduced in appleOS 2026. Building a custom peer-to-peer protocol sample code (aka TicTacToe) Implementing netcat with Network Framework sample code (aka nwcat) Configuring a Wi-Fi accessory to join a network sample code Moving from Multipeer Connectivity to Network Framework forums post NWEndpoint History and Advice forums post Wi-Fi (general): How to modernize your captive network developer news post Wi-Fi Fundamentals forums post Filing a Wi-Fi Bug Report forums post Working with a Wi-Fi Accessory forums post — This is part of the Extra-ordinary Networking series. Wi-Fi (iOS): TN3111 iOS Wi-Fi API overview technote Wi-Fi Aware framework documentation Building peer-to-peer apps sample code WirelessInsights framework documentation iOS Network Signal Strength forums post Network Extension Resources Wi-Fi on macOS: Forums tag: Core WLAN Core WLAN framework documentation Secure networking: Forums tags: Security Apple Platform Security support document Preventing Insecure Network Connections documentation — This is all about App Transport Security (ATS). WWDC 2017 Session 701 Your Apps and Evolving Network Security Standards [1] — This is generally interesting, but the section starting at 17:40 is, AFAIK, the best information from Apple about how certificate revocation works on modern systems. WWDC 2025 Session 314 Get ahead with quantum-secure cryptography Available trusted root certificates for Apple operating systems support article Requirements for trusted certificates in iOS 13 and macOS 10.15 support article About upcoming limits on trusted certificates support article Apple’s Certificate Transparency policy support article What’s new for enterprise in iOS 18 support article — This discusses new key usage requirements. Prepare your network environment for stricter security requirements support article — This is primarily of interest to folks developing management software, for example, an MDM server. Technote 2232 HTTPS Server Trust Evaluation Technote 2326 Creating Certificates for TLS Testing QA1948 HTTPS and Test Servers Miscellaneous: More network-related forums tags: 5G, QUIC, Bonjour On FTP forums post Using the Multicast Networking Additional Capability forums post Investigating Network Latency Problems forums post Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com" [1] This video is no longer available from Apple, but the URL should help you locate other sources of this info.
0
0
6.1k
21h
Developer ID notarization submissions disappear from notarytool history — Team 8786B65DT4
My Apple Developer Program team cannot complete Developer ID notarization. Team ID: 8786B65DT4 Both submissions initially uploaded successfully and returned “In Progress,” but later disappeared completely. notarytool info returns: “Submission does not exist or does not belong to your team.” And: xcrun notarytool history --keychain-profile BELLE_EPOQUE_NOTARY returns: “No submission history.” Affected submissions: 9d235d80-01d1-4db7-81ed-112fc8bc97d2 Submitted 2026-08-16T15:28:42.805Z bd49caa9-0f30-4f72-80e4-f1e72ee6f6c9 Submitted 2026-08-22T17:32:43.457Z The app is a universal Unity macOS app distributed outside the Mac App Store via Steam. It is signed with a valid Developer ID Application certificate, Hardened Runtime, and secure timestamp. ZIP integrity and all nested Mach-O signatures pass local verification. Can Apple DTS / the notary service team investigate why submissions for this team disappear rather than reaching Accepted or Invalid?
3
0
911
21h
AppleTV ContinuityCamera Scan QR Code issue
I found two issues with scan code to connect continuity cameras in tvOS QR code scanning connection timeout Scan the QR code to connect successfully, but the Camera has no data and the Capture Session does not report an exception. And these are not 100% reproduce.
Replies
0
Boosts
0
Views
197
Activity
20h
Organization enrollment stuck more than 4 weeks — no response, phone callbacks not connecting
Hi, Posting here after exhausting standard support channels for a stuck organization enrollment. Timeline: August 7, 2026 — Submitted Apple Developer Program enrollment for our organization. Since then — No update, no email, no change in status. The enrollment has been sitting silently for over 4 weeks with no indication of what (if anything) is wrong. Support attempts so far: Opened multiple support cases (Case numbers: 102954003819, 20000146177866, 20000136358412) via developer.apple.com/contact. No response to either. Requested a phone callback through the "Membership and Account" contact option many times, from different phone numbers. Each time no callback. No error message, rejection notice, or request for additional information has been received at any point — the case simply shows no progress. What I'm asking: Could someone from Apple Developer Relations or a forum moderator help look into this case, or advise on how to get a response? I'm happy to provide any additional verification or documentation needed — I just have no visibility into what's blocking the review, and standard channels haven't been able to help.
Replies
0
Boosts
0
Views
20
Activity
20h
SMAppService LaunchDaemon: is privilege drop followed by same-PID exec supported before Mach service check-in?
I’m designing a least-privilege system LaunchDaemon registered with SMAppService, and I’d like to clarify whether the following architecture is supported by public macOS contracts. The LaunchDaemon declares a MachServices entry. Its steady-state service must run as a dedicated non-root account and later creates an NSXPCListener for that Mach service. We currently launch the daemon directly using UserName, GroupName, and InitGroups=false. However, InitGroups=false does not appear to guarantee that the resulting process supplementary-group list is limited to the service’s intended group. In testing, the daemon received a supplementary group outside our accepted set. We therefore do not want to depend on incidental inherited launch-time group state. We are considering this alternative: launchd starts a small, fixed, code-signed bootstrap executable as root. The bootstrap reads the target UID/GID from an existing protected root-owned binding record. It establishes an exact credential state using public BSD APIs, conceptually: setgroups(...) setgid(...) setuid(...) It verifies the resulting non-root credentials. It creates no XPC listener or storage connection while privileged. Without forking, it permanently replaces itself using execve() (or possibly POSIX_SPAWN_SETEXEC) with another fixed, separately signed executable in the same bundle. That non-root executable independently validates its security state and then creates NSXPCListener(machServiceName:) for the Mach service declared by the original LaunchDaemon job. The bootstrap would not remain as a privileged parent or supervisor. My main questions are: Is a same-PID exec after permanent UID/GID/supplementary-group reduction supported for an SMAppService system LaunchDaemon before it checks in to its declared Mach service? Does the exec-replaced process retain the launchd/bootstrap context required for NSXPCListener(machServiceName:) to check in to that Mach service? If so, what execution context must be preserved across exec (for example bootstrap context, environment, file descriptors, or Mach rights)? Is there a documented way to preserve only the context required for the LaunchDaemon/Mach-service relationship without carrying unintended root-derived capabilities into the non-root executable? Would SMAppService.unregister() / normal launchd termination continue to treat the exec-replaced process as the same LaunchDaemon job? If this topology is not supported, is there an Apple-supported way to establish an exact supplementary-group set before a non-root SMAppService LaunchDaemon begins handling its Mach service? The goal is to avoid relying on undocumented launchd behavior, incidental supplementary groups, private APIs, or a long-lived privileged helper. I’m specifically looking for the supported contract here rather than whether this happens to work on a particular macOS release.
Replies
0
Boosts
0
Views
20
Activity
20h
How to obtain Apple Account ID
Could you please advise us on how to obtain the Apple Account ID in the following cases? The Apple Account ID currently signed in on an iOS device. The Managed Apple Account ID associated with the Apple Business Manager (ABM) or Apple School Manager (ASM) account that manages the Apps and Books token. We would appreciate it if you could let us know whether there is an API, MDM command, or other supported method to retrieve these IDs.
Replies
0
Boosts
0
Views
18
Activity
20h
Building a library playlist on macOS that mixes catalog songs and the user's own uploads in a fixed order – supported route, and how to know when an upload is registered?
Our sandboxed macOS app digitises audio cassettes and builds one playlist per cassette in the user's Apple Music library that follows the tape's order: catalog songs where a title was recognised, and the user's own recordings (AAC files the app exported from the tape) where it was not. The user has an Apple Music subscription and Sync Library on. On macOS every write on MusicLibrary is marked @available(macOS, unavailable) in the 26.5 SDK – add, add(_:to:), createPlaylist and edit (see thread 844114, which got no answer). So we build the playlist through Music.app's scripting interface: make new user playlist, duplicate <library track> to <playlist> for catalog songs, add <file> to <playlist> for own recordings. That works, with one exception that leads to our questions. What we observe Reproducible on macOS 26.6.2 / Music 26; a standalone AppleScript is at the end. A playlist built in one go from 14 subscription tracks keeps all 14. The same playlist with one local file added after the second track: all 15 entries are there right after the build and one second later. About 15 s later the playlist has 3 entries – the two catalog entries before the file, the file, and nothing that was added after it. No error anywhere. If the file has been in the library for several minutes before the playlist is built, everything stays. Adding it to the library and waiting 45 s is not enough. Meanwhile the track's cloud status stays unknown, and GET /v1/me/library/search?types=library-songs does not list it (checked for 10 minutes). Emptying the playlist and building it again ~30 s after the entries were removed keeps everything, every time. That is what we do today; it costs 30–40 s per import, and we have to tell the user that entries were removed and put back. Our reading: while the freshly added file is not yet registered in iCloud Music Library, the playlist as pushed to the server is cut at the first item the server cannot reference, and the next sync adopts the shorter list for cloud items while keeping the local-only item in place. Questions Is there a supported way for a macOS app to create a library playlist and add tracks to it? Specifically: is the Apple Music API (POST /v1/me/library/playlists with relationships.tracks, and POST /v1/me/library/playlists/{id}/tracks) the intended route from a macOS app holding a MusicKit user token, and can such a playlist reference the user's own uploaded songs by their library id (i.…)? After a local file has been added to the library (via Music.app's add, or any other supported way), how can an app learn that iCloud Music Library has registered it, and what its library song id is? A notification, a MusicKit property, an Apple Music API endpoint? We would wait on that signal instead of rebuilding. Is the removal described above expected behaviour? Catalog ids are re-resolved at import time via id, ISRC and search as recommended in thread 122110, so stale catalog ids are not the cause. Reproduction Needs Sync Library on, at least 14 subscription tracks in the library, and a local audio file the library does not know yet. Prints the counts after 1 s, 21 s and 41 s, then cleans up. on run argv set localFile to POSIX file (item 1 of argv) tell application "Music" set cloudTracks to (every track of library playlist 1 whose cloud status is subscription) set idsBefore to persistent ID of every track of library playlist 1 set pl to make new user playlist with properties {name:"Reconciliation repro"} repeat with i from 1 to 2 duplicate (item i of cloudTracks) to pl end repeat set fileTrack to add localFile to pl set fileID to persistent ID of fileTrack repeat with i from 3 to 14 duplicate (item i of cloudTracks) to pl end repeat set n0 to count of tracks of pl delay 1 set n1 to count of tracks of pl delay 20 set n2 to count of tracks of pl delay 20 set n3 to count of tracks of pl delete pl if fileID is not in idsBefore then delete (first track of library playlist 1 whose persistent ID is fileID) return "after build: " & n0 & ", after 1 s: " & n1 & ", after 21 s: " & n2 & ", after 41 s: " & n3 end tell end run Output here: after build: 15, after 1 s: 15, after 21 s: 3, after 41 s: 3.
Replies
0
Boosts
0
Views
203
Activity
20h
Macbook M5 Development Kernel Panic
Hi, I'm posting a boot crash here. Environment Hardware: Macbook M5 Pro OS Version: macOS 26.3.1 (25D2128) and matching version of KDK from official apple download page Kernel Version: Darwin Kernel Version 25.3.0 Reproducibility: Consistent Here is my panic log --- I truncated one field "SOCDNandContainer" as the original log is too long to post, hitting the size limit. I followed a blog post to boot the development kernel as the ReadMe file from KDK only contains instructions for Intel Macs. https://jaitechwriteups.blogspot.com/2025/10/boot-custom-macos-kernel-on-macos-apple.html I've tried a few 26.2 KDKs before 26.3.1 public launch, and they all showed same errors (26.1 and 26.0 KDKs don't have any development kernel for T8142 chip). Also, I own two fresh M5 Pro, and it is consistent across the machines. The highlight is panic(cpu 8 caller 0xfffffe0050e18010): [Exclaves] $JgOSLogServerComponent.RedactedLogServer.init(logServerNotific:OSLogServerComponent\/OSLogServerComponent_Swift.swift:815: Fatal error: invalid rawValue for TightbeamComponents.RedactedLogSer at PC ... Is this a genuine bug or am I following a wrong guide to boot the development kernel? I don't think the blog is wrong because I'm able to boot the "release" kernel included in the KDK on the same M5 Pro, and the "development" kernel on M4 Mac Mini, using the same routine. Just to be clear, I'm not compiling XNU myself, but am using the ones included in the kit.
Replies
1
Boosts
1
Views
567
Activity
20h
In-App Purchase key returns 401 (4010000) on Advanced Commerce API but 200/404 on App Store Server API
Environment: Sandbox Bundle ID: com.fosssocial.app Key ID: L7DZYHGM62 Issuer ID: cf1f7bc7-452f-4bb8-a925-31ca29175fac Summary Our In-App Purchase key is accepted by the App Store Server API but rejected by the Advanced Commerce API, using the exact same bearer token. This appears to be an authorization grant that was never applied to the key, rather than a signing or request-format problem on our side. Reproduction — one token, two API families GET /inApps/v1/subscriptions/1 -> 404, errorCode 4040010 (token ACCEPTED, resource simply not found) POST /advancedCommerce/v1/subscription/changeMetadata/1 -> 401, errorCode 4010000 (token REJECTED) Same JWT, same key, issued seconds apart. A 401 on one family and a 404 on the other isolates this to key authorization. On-device symptom A signed SubscriptionCreateRequest passed to StoreKit as advancedCommerceData fails with StoreKitError.unknown / "Unable to Complete Request". No payment sheet appears and no InvalidRequestError is returned, so there is no field-level error to act on. What we have already verified JWS header: alg ES256, kid, typ JWT Claims: iss, iat, aud "advanced-commerce-api", bid, nonce, request No exp claim (per Apple's documentation) The request claim uses standard padded base64, not base64url Key ID and .p8 file confirmed to be a matching pair Key regenerated after receiving the Advanced Commerce access-granted email; the 401 is unchanged AdvancedCommerceProduct(id:) resolves successfully on device, which confirms the PRODUCT has Advanced Commerce access Question Does the In-App Purchase key require a separate authorization for the Advanced Commerce API beyond the product-level access we were granted? If so, how is that applied to an existing key?
Replies
0
Boosts
0
Views
19
Activity
20h
Membership expired — no Renew button anywhere, callback form also broken (country change bug)
My Apple Developer Program membership expired on September 4 and all my apps have been removed from the App Store. I cannot renew through any path: The expiration banner says to renew via the Apple Developer app. I reinstalled it and signed in again — there is no Renew button, only expired membership details. On the developer website there is no billing/payment section at all — no option to add a payment method or renew. The phone callback form on my support case page is broken: tapping Call opens the confirmation page and immediately redirects back (desktop and iPhone Safari — same result). Background: I relocated to Armenia and changed the country on both my developer account and my personal Apple Account. I reported the missing payment option to Developer Support on August 17 — three weeks before expiration. Support replied that having a payment method on my Apple Account was all that's needed. It was already there and works for App Store purchases — yet no renewal charge was ever attempted, and the membership expired. Support case: 20000139749968, still unresolved. I am ready to pay right now. Could someone from Apple please check the renewal/billing state of my account or arrange a callback? It looks stuck after the country change.
Replies
0
Boosts
0
Views
27
Activity
20h
DSA compliance phone verification fails
Has anyone successfully completed DSA compliance phone number verification using the "receive a phone call" option? It seems that Apple first tries to send an SMS. You then have the option to resend another SMS, to receive a phone call, or to upload documents. When I choose to receive a phone call, it seems that the Apple system calls me but it hangs up without reading out a code. Has anyone got this to work?
Replies
6
Boosts
0
Views
1.9k
Activity
20h
Safari iOS 26.6: front camera getUserMedia track reports landscape while the drawn frame is portrait, MediaRecorder writes a sideways file with no rotation flag (workaround inside)
Device: iPhone 15, iOS 26.6, Safari. Also reproduced on Android Chrome, so this is not only WebKit, but the missing rotation flag part is. Setup: a web page asks for the front camera with getUserMedia, shows it in a video element, and records with MediaRecorder. Phone held upright. What happens: Requesting portrait dimensions (width 1080, height 1920) returns the sensor's wide preset, 1920 by 1080, unrotated. exact instead of ideal gives the same or an error. aspectRatio 9/16 gives the same. Requesting landscape numbers (width 1920, height 1080) lets Safari pick the preset and rotate the picture to match how the phone is held. Even then, the video track's getSettings() reports width 1920 and height 1080, while the frame Safari draws into the video element is portrait. The preview looks right. The track lies. MediaRecorder records the unrotated sensor buffer. On older iOS the file carried a displaymatrix rotation of minus 90 degrees and players honoured it. On 26.6 that flag is gone, so the file plays sideways. Thread 786803 has other people finding the same. Workaround that works in production: Ask for the camera in landscape numbers. Do not trust getSettings(). Draw one frame of the video element onto a 16 by 16 canvas scaled from the larger reported dimension and check which corner has paint. If the bottom left is painted and the top right is not, the picture is tall. If the drawn picture is portrait but the track says landscape, record a canvas stream of the drawn picture at its own size instead of the raw track. If they agree, record the raw track. Put the H.264 High profile first in your mime type candidates. isTypeSupported says yes to Baseline and High, and list order decides, so Baseline first gives soft video. Working code, MIT, with the dead ends left in as comments: https://github.com/lagudafuadtosin/web-teleprompter (src/lib/camera.ts) Full write-up: https://dev.to/lagudafuad/why-your-web-teleprompter-records-sideways-on-iphone-and-the-fix-549m Question for Apple: is the dropped displaymatrix on MediaRecorder output in 26.x intentional, and is there a supported way to read the capture rotation off the track?
Topic: Safari & Web SubTopic: General Tags:
Replies
1
Boosts
0
Views
488
Activity
20h
ios26 camera problem on home screen apps
since the release of iOS26 i get new reports of people making home screen apps of website pages that had camera accessibility to take pictures that mention the camera being 90degree sideways to what it should be. i have tested it myself and was able to reproduce the issue quite easily on iPhones 13|15|16 regular and pro versions. this affects all cameras when trying using them with navigator.mediaDevices.getUserMedia({...})...
Replies
3
Boosts
0
Views
894
Activity
20h
iOS 26.4 — How to return from main app to host app after a keyboard-extension dictation round-trip, without private APIs?
I'm building a custom keyboard extension that offers voice dictation. Because keyboard extensions are constrained (memory cap ~30–48 MB, restricted audio session access), I delegate recording to my container app: User in a host app (e.g., Safari) taps the mic in my keyboard extension. The keyboard calls extensionContext.open(URL("myapp://dictation")) to launch the container app. The container app records audio via AVAudioEngine + SFSpeechRecognizer, writes the final transcript to the App Group, and signals completion via a Darwin notification. 4. The user is expected to be returned to the original host app (Safari) automatically so they can keep typing. The problem (step 4): On iOS 26.4 I can no longer identify which app was the host. Every previously-known path returns nil for the keyboard extension's host: parent.value(forKey: "_hostBundleID") → returns the literal string parent.value(forKey: "_hostApplicationBundleIdentifier") → returns NSNull xpc_connection_copy_bundle_id on the underlying XPC connection (via PKService.defaultService.personalities[…]) → returns NULL NSXPCConnection.processBundleIdentifier on extensionContext._extensionHostProxy._connection → returns nil proc_pidpath(hostPID, …) → EPERM from the keyboard sandbox LSApplicationWorkspace.frontmostApplication → selector unavailable from the extension RBSProcessHandle.handleForIdentifier:error: → returns an RBSServiceErrorDomain error Without the host's bundle ID, the container app has no way to call LSApplicationWorkspace.openApplicationWithBundleID: (the technique that worked on iOS 25 and earlier). UIApplication.suspend() correctly sends the container to background, but iOS treats us as a "fresh launch" — it returns the user to the Home Screen instead of Safari, because the container app was launched by an extension, not directly by Safari. KeyboardKit's maintainer reached the same conclusion (issue #1014) and shipped 10.4 without the feature. My questions: Is there a public, App-Store-safe API in iOS 26+ for a custom keyboard extension to identify its host application, or for the container app (launched via the extension's openURL) to identify which app initially hosted the extension that opened it? UIOpenURLContext.options.sourceApplication reports the extension's own container, not the actual host. 2. Is there a public mechanism for "return to source app" when the container app was launched by an extension's openURL? Equivalent to the ← Source affordance iOS shows for normal inter-app openURL, but triggered programmatically by the launched app. 3. Some popular keyboards (e.g., 微信输入法 / WeChat Keyboard) still appear to round-trip through their container app on iOS 26.4 and return the user to the original host — including the iOS ← WeChat back affordance in the host's status bar afterward. What's the recommended approach to achieve this? If it requires a specific scene-activation flow, NSUserActivity pattern, or extension-context configuration, please point at the relevant docs. 4. If there is no public path today, is FB22247647 (or a related radar) the right place to track this? Should developers in this position migrate to in-extension audio capture (which has its own significant constraints in keyboard extensions)? I'd much rather not rely on private APIs. Concrete guidance — or even an acknowledgment of which direction Apple intends — would help thousands of custom-keyboard developers who currently have a degraded voice-input experience on iOS 26.4+. Tested on iPhone 12 Pro Max running iOS 26.4.2 (build 23E261), Xcode 26.x, Swift 5. Thanks!
Replies
5
Boosts
0
Views
1.4k
Activity
21h
Matter device shows “Uncertified Accessory” in Apple Home despite CSA certification and DCL listing (OEM/ODM, Portfolio Family CD)
Hello Apple Home/Matter team, our Matter product is CSA-certified, has a valid CD, and is listed in Compliance DCL. In testing with HomePod mini as border router, commissioning proceeds but Apple Home still shows “Uncertified Accessory.” We are an OEM/ODM manufacturer: product vendor_id/product_id belong to the brand owner, while dac_origin_vendor_id/dac_origin_product_id belong to us(manufacturer). The device also uses the brand owner’s product VID/PID at runtime. Our certification is Portfolio Family, so CD product_id is an array covering 6 SKUs. Is this model expected to pass Apple Home certification checks, and what are the most common causes of this warning? Emma
Replies
0
Boosts
1
Views
236
Activity
21h
IKEv2 Personal VPN: Child SA torn down after 120s idle (NEIKEv2ErrorDomain Code=15) with DisconnectOnIdle already NO
We ship a consumer VPN app on iOS, iPadOS and tvOS using a Personal VPN configuration: NEVPNManager with NEVPNProtocolIKEv2, EAP-MSCHAPv2, no MDM profile installed. After exactly 120 seconds with no traffic, iOS destroys the Child SA and disconnects the tunnel. I would like to know whether that timer is configurable, and if not, what the intended mitigation is. From a device sysdiagnose (iPhone, iOS 26.6, build 23G71): NEIPSecDBStatsUpdate: SA is idle for past 120 secs KernelSASession[1, IKEv2 Session Database] idle timeout SA Internal SAID = 2 SPI = C53320D1 Direction = Outbound ChildSA[1] state Connected -> Disconnected error Domain=NEIKEv2ErrorDomain Code=15 "IdleTimeout" <NEIKEv2Provider: Primary Tunnel>: stopping tunnel since Child disconnected nesessionmanager: plugin disconnected with reason "Tunnel was idle for too long" This happened 12 times across a 9.2 hour overnight capture on one idle device. Median time before the tunnel re-established was 14m35s. DISCONNECT-ON-IDLE IS NOT ENABLED The same sysdiagnose shows the plugin's own configuration as: disconnectOnIdle = NO disconnectOnIdleTimeout = 0 These are the stock defaults. There is no disconnectOnIdle property on the public NEVPNProtocol, so a Personal VPN app cannot set them either way. The installed SA parameters contain no idle field at all, only "Lifetime Seconds = 1800", which is honoured correctly: the same capture shows 20 clean rekey cycles. WHAT I HAVE RULED OUT iOS logs a distinct stop reason for each of the following, and none of them occurred across 24 teardowns: "On Demand Disconnect rule matched", "Tunnel was terminated by the server", "Server is not responding", "Network changed, tunnel no longer viable", "Device went to sleep", "Stop command received". The only reason recorded was "Tunnel was idle for too long". On the gateway (strongSwan), IKE rekey and reauth are disabled, uniqueids is never, and DPD is answered in roughly 200ms right up to the teardown. The gateway considers the tunnel healthy at the moment iOS tears it down. DPD does not reset the timer, which makes sense: DPD is an INFORMATIONAL exchange on the IKE SA, whereas the log shows the timer measuring the OUTBOUND Child SA (SAID 2). THE APP CANNOT SEE THIS HAPPEN NEVPNConnection.fetchLastDisconnectError() returns nil for this teardown, because the error is in NEIKEv2ErrorDomain rather than NEVPNConnectionErrorDomain. The app has no supported way to detect that the tunnel dropped for this reason, or to distinguish it from a user-initiated disconnect. It is only visible in a sysdiagnose. TRAFFIC IS NOT HELD DURING THE RECONNECT With Connect On Demand enabled (NEOnDemandRuleConnect, interfaceTypeMatch .any), traffic after the teardown does not wait for the tunnel. On device wake following one of these drops: 01:32:43 device wakes 01:32:43 [C331 ... :443] path:satisfied @0.001s, interface: en0[802.11], uses wifi 01:32:44 [C331 ... :443] flow:finish_connect @0.623s (over en0) 01:32:47 tunnel status changed to connected so flows complete over the physical interface for several seconds before the VPN re-establishes. On-demand triggered the reconnect but did not delay the traffic. For a VPN product this window is the part that concerns me most. QUESTIONS Is the 120 second Child SA idle timeout configurable for a Personal VPN using NEVPNProtocolIKEv2, from the app or from a configuration profile? If DisconnectOnIdle / DisconnectOnIdleTimer are meant to control it, why does the teardown occur when they are NO / 0? If it is not configurable, is application-generated keepalive traffic the intended workaround? If so, how is that expected to work while iOS has the app suspended, which is exactly when a tunnel goes idle? Would server originated traffic that elicits a client response be a supported approach? Is there any supported way for an app to be notified of this teardown, given that fetchLastDisconnectError() returns nil for it? Is the behaviour in "traffic is not held during the reconnect" expected for NEOnDemandRuleConnect, or should matching flows be delayed until the tunnel is up? Is includeAllNetworks the only supported way to close that window? Happy to supply the full sysdiagnose privately.
Replies
1
Boosts
0
Views
217
Activity
21h
Any summaries of "NetworkConnection"?
I heard that the Network framework can help using networking with Swift concurrency. I read up on "NWConnection," which uses a DispatchQueue. I was wondering how queues fit together with concurrency, then I heard about a related class, "NetworkConnection." I realized that the new class is in the same module, but introduced for macOS 26. I saw the WWDC25 video about it, but it assumed that I already knew about its result-builder connection setup. I don't; was it introduced in an earlier video? A lot of times, I find a web article soon after some WWDC that explains how to actually a new API. The problem is that the class' name is un-Google-able, being two actual words concatenated together that can reasonably be found together. Does anyone have a link of a post-WWDC25 article explaining NetworkConnection?
Replies
3
Boosts
0
Views
337
Activity
21h
Networking Resources
General: Forums subtopic: App & System Services > Networking TN3151 Choosing the right networking API Networking Overview document — Despite the fact that this is in the archive, this is still really useful. TLS for App Developers forums post Choosing a Network Debugging Tool documentation WWDC 2019 Session 712 Advances in Networking, Part 1 — This explains the concept of constrained networking, which is Apple’s preferred solution to questions like How do I check whether I’m on Wi-Fi? TN3135 Low-level networking on watchOS TN3179 Understanding local network privacy Adapt to changing network conditions tech talk TCP and UDP ports used by Apple software products support article Understanding Also-Ran Connections forums post Extra-ordinary Networking forums post Foundation networking: Forums tags: Foundation, CFNetwork URL Loading System documentation — NSURLSession, or URLSession in Swift, is the recommended API for HTTP[S] on Apple platforms. Moving to Fewer, Larger Transfers forums post Testing Background Session Code forums post Network framework: Forums tag: Network Network framework documentation — Network framework is the recommended API for TCP, UDP, and QUIC on Apple platforms. WWDC 2025 Session 250 Use structured concurrency with Network framework — This is a great introduction to the new Network framework API introduced in appleOS 2026. Building a custom peer-to-peer protocol sample code (aka TicTacToe) Implementing netcat with Network Framework sample code (aka nwcat) Configuring a Wi-Fi accessory to join a network sample code Moving from Multipeer Connectivity to Network Framework forums post NWEndpoint History and Advice forums post Wi-Fi (general): How to modernize your captive network developer news post Wi-Fi Fundamentals forums post Filing a Wi-Fi Bug Report forums post Working with a Wi-Fi Accessory forums post — This is part of the Extra-ordinary Networking series. Wi-Fi (iOS): TN3111 iOS Wi-Fi API overview technote Wi-Fi Aware framework documentation Building peer-to-peer apps sample code WirelessInsights framework documentation iOS Network Signal Strength forums post Network Extension Resources Wi-Fi on macOS: Forums tag: Core WLAN Core WLAN framework documentation Secure networking: Forums tags: Security Apple Platform Security support document Preventing Insecure Network Connections documentation — This is all about App Transport Security (ATS). WWDC 2017 Session 701 Your Apps and Evolving Network Security Standards [1] — This is generally interesting, but the section starting at 17:40 is, AFAIK, the best information from Apple about how certificate revocation works on modern systems. WWDC 2025 Session 314 Get ahead with quantum-secure cryptography Available trusted root certificates for Apple operating systems support article Requirements for trusted certificates in iOS 13 and macOS 10.15 support article About upcoming limits on trusted certificates support article Apple’s Certificate Transparency policy support article What’s new for enterprise in iOS 18 support article — This discusses new key usage requirements. Prepare your network environment for stricter security requirements support article — This is primarily of interest to folks developing management software, for example, an MDM server. Technote 2232 HTTPS Server Trust Evaluation Technote 2326 Creating Certificates for TLS Testing QA1948 HTTPS and Test Servers Miscellaneous: More network-related forums tags: 5G, QUIC, Bonjour On FTP forums post Using the Multicast Networking Additional Capability forums post Investigating Network Latency Problems forums post Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com" [1] This video is no longer available from Apple, but the URL should help you locate other sources of this info.
Replies
0
Boosts
0
Views
6.1k
Activity
21h
Developer ID notarization submissions disappear from notarytool history — Team 8786B65DT4
My Apple Developer Program team cannot complete Developer ID notarization. Team ID: 8786B65DT4 Both submissions initially uploaded successfully and returned “In Progress,” but later disappeared completely. notarytool info returns: “Submission does not exist or does not belong to your team.” And: xcrun notarytool history --keychain-profile BELLE_EPOQUE_NOTARY returns: “No submission history.” Affected submissions: 9d235d80-01d1-4db7-81ed-112fc8bc97d2 Submitted 2026-08-16T15:28:42.805Z bd49caa9-0f30-4f72-80e4-f1e72ee6f6c9 Submitted 2026-08-22T17:32:43.457Z The app is a universal Unity macOS app distributed outside the Mac App Store via Steam. It is signed with a valid Developer ID Application certificate, Hardened Runtime, and secure timestamp. ZIP integrity and all nested Mach-O signatures pass local verification. Can Apple DTS / the notary service team investigate why submissions for this team disappear rather than reaching Accepted or Invalid?
Replies
3
Boosts
0
Views
911
Activity
21h