You have to absolutely LOVE hidden command-line options. This generate-entitlement-der option doesn't even appear in any publicly available codesign source I've seen. UPDATE: I was annoyed about this until I found the option full-metal-jacket ... Pray, tell, what on earth does it do?