Post

Replies

Boosts

Views

Activity

Reply to codesign/produtsign 3rd paty TSAs
Yes, I mean trusted by Apple. What I have seen with experimentation is that when I sign with some TSA other than that of Apple's then Authority=(unavailable) is shown in signature, that’s the reason I'm not sure it will work. Basically, I'm exploring the option of signing artifacts with other TSA in case Apple's TSA is down. I doubt that Apple, or any reasonable company or organization, would trust anyone other than themselves. I have seen people try to justify a custom timestamp based on the fear that Apple's server goes down. But Apple is one of the biggest companies in the world, would you be able to find some other service that is more reliable? And what is the risk of a failure on Apple's part? And what is the cost of failure on Apple's part? By this I mean, how likely is Apple's server to go down and how long would it stay down? Also, can there be any unforeseen issues after signing? This is exactly what I am worried about, the unforeseen issues. Basically if there is slight possibility of any of the above issues then it becomes no-go for me but then it makes me wonder why is there an option to specify TSA in codesign command.  There is always a possibility of failure. In fact, there is always an absolute guarantee of failure. It is only a question of when. Are you going to find some other service that has a lower possibility of failure than Apple? And what additional risks or costs are you willing to spend for that (false) guarantee? As I understand it, the reason for this option is to allow signed software in an environment that does not have internet access. Such facilities typically have other, often physical, security mechanisms in place. In theory, you might be able to use a local timeserver in such an environment. But in any environment that has internet access, I can't think of any rational reason not to use Apple's servers. Think of it this way. If you do something funky and it breaks, that's on you. You bear sole responsibility for any and all damages. No one will remember or notice if your software was functional during some Apple outage. If there were a widespread Apple outage, some other cascading failure would likely prevent your software from working anyway. But if you accept the Apple defaults and it breaks, that's on Apple. No one will blame your company or software. A few haters might say that you shouldn't have trusted Apple, but haters should be ignored. You will never be able to satisfy them no matter what you do.
Topic: Code Signing SubTopic: General Tags:
Feb ’21
Reply to HEIC images aren't lossless
Perhaps HEIC is lossless after all. What is happening is that when an HEIC destination writes the image to disk, it resizes the image by one pixel. It actually crops one pixel on the bottom and left. You would only know it if you had added a noticeable, 1 pixel border, which I had done to debug. Obviously, a one-pixel resize is going to remove any losslessness. One thing you can do is manually shrink the image by one pixel width, and two pixels high, shifting the image up by one pixel. Then it won't crop any of the image. Of course, now you've done two one-pixel resizes, but at the least the geometry will now be correct. Apparently someone at Apple already knew that because Preview seems to do that double-resize too. But at least HEIC is still useable for reading and for low-resolution previews.
Topic: Media Technologies SubTopic: General Tags:
Feb ’21
Reply to Does MBP M1 suitable for Java development with docker/Kubernetes
I understand, eventually most of the software providers are going to release ARM based version, but how long I have to wait? Those are all 3rd party products. You will have to ask the developers. Is Rosetta 2 good enough to handle most of the software written for x86 architecture to run in M1 ? Yes. However, there are some additional security requirements for the new Apple Silicon chips. In the past, those open-source projects have treated those as merely "suggestions". And by "past", I mean "for years". In some cases, they now have only a few months to learn a lot of basic Mac development techniques.
Topic: App & System Services SubTopic: Core OS Tags:
Feb ’21
Reply to Static XCFramework won't link to its dependencies in a project
That's the way it works. Dynamic libraries can't "depend" on static libraries. They have to be self-contained. You can link the static libraries with with dynamic libraries and then omit the static ones from the rest of the project, because they will already be available in the dynamic library. But if you have cross, or multiple, dependencies, then you may need to run everything as dynamic libraries.
Feb ’21
Reply to the app runs in the background
Hey, were you able to figure out why this is happening? We are facing a similar issue here. Would be helpful if you could share how you dealt with the problem You should probably open a DTS ticket for help with this problem from Apple. This question is a year old and these forums are one of the quietest places on the internet.
Topic: UI Frameworks SubTopic: AppKit Tags:
Feb ’21
Reply to Big Sur not opening Applications even after 2 Reinstalls
This is the developer forum. All answers will require you to use programming instructions of some kind. That's the whole point. You should probably post your question in Apple's Consumer support forums instead: https://discussions.apple.com/welcome Those consumer support forums are much, much larger. Instead of waiting days (or forever) for an answer, you can expect an answer in a few minutes. You just have to make sure to pick the appropriate forum and provide a good description of the problem. Sometimes, the big forums are so busy that questions don't get answered in a few minutes and they fall off onto page 2, where no one will ever look for them. After 24 hours, an Apple Community Specialist will offer you a couple of Apple Support articles that might or might not help.
Topic: App & System Services SubTopic: Hardware Tags:
Mar ’21
Reply to codesign/produtsign 3rd paty TSAs
Can I use any timestamp server with codesign command? Apparently If yes, can you please share list of trusted TSAs? You mean other than Apple? Trusted by whom? The codesign command does support a timestamp server parameter. If you trust the server, then you can supply a parameter. I have no idea if it works or not. Also, will notarization succeed if I use non-apple timestamp server? Utterly no clue. Given what I've seen regarding Notarization problems, this seems like a high-risk approach. Notarization is drop-dead, fall-of-a-log, Oh My God This is Easy! Yet some people insist on trying new and unusual ways to build code and attempt to notarize it. Each new failure is more comical and bizarre than the last. If you sincerely think it would be a good idea to use a custom timestamp server and to attempt to notarize software with it, why don't you just try it and see if it works? What's the worst that could happen? Your download displays a big "cannot check for malware" warning? Some minor operating system update causes your app to stop working? Your app stops working on its own on some random date in the future and no one know why? Your customer band together and file a class-action lawsuit? How do I specify a timestamp server in productsign command? I see no timestamp server option in the productsign command.
Topic: Code Signing SubTopic: General Tags:
Mar ’21