Post

Replies

Boosts

Views

Activity

Reply to Cannot upload to App Store Connect due to "ITMS-90288: Invalid Code Signing Entitlements" and ITMS-90885
Okay - I've resolved it. Quinn's article was giving the right answers - though some details weren't clear to me initially: I don't need provisioning profiles for my embedded programs, just as Xcode says. However, I do need to temporarily add some Capability to every sub project as well - I had initially only done this for the main project. Adding the Capability (and then removing it again) to each sub project did add CODE_SIGN_ENTITLEMENTS = "PRJNAME TARGETNAME.entitlements"; to the project file, which was key to getting rid of the error – and the error message was quite misleading in this way, indeed!
9h
Reply to Cannot upload to App Store Connect due to "ITMS-90288: Invalid Code Signing Entitlements" and ITMS-90885
I wondered if the problem is that my certificate was using the exact bundle ID, not a wildcard. That would explain why it complains about 25856V4B4X.org.tempel.findanyfile.helper when the cert only was made for 25856V4B4X.org.tempel.findanyfile (despite the fact that this worked before, and still does with Xcode 13, with this setup). I made a new identifier for "25856V4B4X.org.tempel.findanyfile.*" and then created a new cert ("Apple Development") from that, imported it into the keychain, and also deleted the older cert with the same name from the keychain. Still, I'm getting the very same errors on upload. I don't understand what's wrong.
11h
Reply to ITMS-90885 “${executable}” in bundle “${bundle}” is missing a provisioning profile
I am struggling with this now, too. I read through (most of) the posts, mainly by Quinn, and cannot find what I'm still doing wrong. Upload with Xcode 13.4.1 still works, but with Xcode 16.3 or later I get both these errors and the warning of this topic: ITMS-90288: Invalid Code Signing Entitlements - The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. According to the provisioning profile, the bundle contains a key value that is not allowed: '25856V4B4X.org.tempel.findanyfile.helper' for the key 'com.apple.application-identifier' in 'Find Any File.app/Contents/Library/LaunchServices/org.tempel.findanyfile.helper' ITMS-90885: 'Cannot be used with TestFlight because the executable “${executable}” in bundle “${bundle}” is missing a provisioning profile but has an application identifier in its signature. Nested executables are expected to have provisioning profiles with application identifiers matching the identifier in the signature in order to be eligible for TestFlight.' I must admit that I only have an entitlement file for the main app, not for the embedded apps and frameworks. Until now, it appeared that they got automatically adopted. So, I don't understand what the entitlement for the embedded apps needs to contain. The main apps's entitlement file is now: codesign -d --ent - …/"Find Any File.app" Executable=…/FAFv2 MAS Release 31.10.26, 13.38.xcarchive/Products/Applications/Find Any File.app/Contents/MacOS/Find Any File [Dict] [Key] com.apple.application-identifier [Value] [String] 25856V4B4X.org.tempel.findanyfile [Key] com.apple.developer.team-identifier [Value] [String] 25856V4B4X [Key] com.apple.security.automation.apple-events [Value] [Bool] true [Key] com.apple.security.cs.allow-jit [Value] [Bool] true [Key] com.apple.security.personal-information.addressbook [Value] [Bool] true [Key] com.apple.security.personal-information.calendars [Value] [Bool] true(I just added the application-identifier and team-identifier to the entitlement file in hopes that would solve this but it made no difference.) I also checked with the other cmd on the app in the xcarchive, getting this: tempi@TTsMini24 ~ % security cms -D -i …/Find\ Any\ File.app/Contents/embedded.provisionprofile <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>AppIDName</key> <string>Find Any File</string> <key>ApplicationIdentifierPrefix</key> <array> <string>25856V4B4X</string> </array> <key>CreationDate</key> <date>2026-10-31T12:30:46Z</date> <key>Platform</key> <array> <string>OSX</string> </array> <key>IsXcodeManaged</key> <true/> <key>DeveloperCertificates</key> <array>…</array> <key>DER-Encoded-Profile</key> <data>…</data> <key>Entitlements</key> <dict> <key>com.apple.application-identifier</key> <string>25856V4B4X.org.tempel.findanyfile</string> <key>keychain-access-groups</key> <array> <string>25856V4B4X.*</string> </array> <key>com.apple.developer.team-identifier</key> <string>25856V4B4X</string> </dict> <key>ExpirationDate</key> <date>2027-10-31T12:30:46Z</date> <key>Name</key> <string>Mac Team Provisioning Profile: org.tempel.findanyfile</string> <key>ProvisionedDevices</key> <array> … </array> <key>TeamIdentifier</key> <array> <string>25856V4B4X</string> </array> <key>TeamName</key> <string>Thomas Tempelmann</string> <key>TimeToLive</key> <integer>365</integer> <key>UUID</key> <string>…</string> <key>Version</key> <integer>1</integer> </dict> </plist>Any help would be appreciated. Actually, I just realize that I may be confusing entitlements and profile - the latter is the one I claim from Apple's website, right? I haven't visited that for years (though I already struggled understanding it back in the early years when this all started). Gonna see if I can make sense of it on the Apple dev website now. Update - no, that can't be it. When i create a new profile, I need to choose an identifier that describes the entitlements for my app, right? So I checked my current identifier for my app, and that lists lots of options like "5G Network Slicing" and "Access Wi-Fi Information", but none of them look anything like the entitlements that I am using. So, my plain identifier that has none of these options checked should be fine, shouldn't it? Which also means that the current profile I have used for years should be fine as well. What am I missing here? These error msgs from the MAS upload are not helpful at all. They tell me things that seem right to me, and then there's that text with the unfilled ${executable} and ${bundle}, which isn't helping either. This could be so much better. And there's no way to reliably get help from DTS directly any more either - that option has apparently been dropped for having to ask here in the forum, where I can only hope that someone will take a look at this. If it weren't for Quinn, we'd all be doomed already, probably. Til then, I may just have to keep building and submitting with Xcode 13, and admitting to my MAS customers that I'm unable to make my app look modern while the indie build release works with the modern look as that's not locked out by Apple.
2d
Reply to macOS 27 - my faceless bg-only app now appears in the Dock - how to get rid of that?
It's a plain bg-only app that I use it as a Login Item, i.e. I use the old APIs to add it to the Login Items. Worked well since 2011 :) Changing the NSApplication activationPolicy had no effect, BTW. Anything launched thru LaunchServices, no matter its policy, appears to be appearing in the Dock now, even if it's a Login Item. Apple didn't appear to make an effort to filter out such apps from the new "let's warn the user about these bg apps" mode. I found a few complains on reddit where people had several of these unwanted Dock icons (while still wanting the bg app to keep working). BTW - what would be the correct place for a Login Item app? The LaunchItems surely isn't it, because that has unwanted side effects if it's not a SMAppService. MacOS folder? I've now asked Claudia and she updated my code to use the SMAppServices API in macOS 13 and later, while keeping the old method pre-13. Works! Just released a new beta that should do it: https://findanyfile.app/beta.html
Sep ’26
Reply to [27.0beta] Wrong app shown as running in Background in Dock
I have the same issue with my app Find Any File, see https://developer.apple.com/forums/thread/847300. That's really bad, because that bg-only helped is doing nothing by check for a hotkey press. Users don't want or need a constant reminder that this bg helper is running (constantly, that's the entire purpose of it!), occupying a precious dock icon for no gain. I'd have hoped that Apple provides a method to hide this helper, but that doesn't seem to be the case, or is there one?
Sep ’26
Reply to In need of a sample receipt file that uses the SHA-256 hash
Ahh, finally found the right answer here: https://github.com/iterate-ch/cyberduck/issues/16031 Basically, the default behavior of hiding the actual Mac's MAC address is the cause for the problem ("Privaty Wi-Fi Address"): If the Mac rotates or replaces the primary network interface's MAC address, and my code still uses the old code that would fetch the MAC from the higher level APIs, it would get the wrong MAC, and then fail the receipt check. To fix this, the MAC has to be fetched from IOKit registry, e.g. as shown in https://developer.apple.com/documentation/appstorereceipts/validating-receipts-on-the-device or https://lapcatsoftware.com/articles/2023/11/4.html
Jan ’26
Reply to In need of a sample receipt file that uses the SHA-256 hash
This is getting worse - a person who gets this error sent me the receipt file, and it turns out that the receipt file is fine, meaning that the validation shouldn't even fail, and thus the app not exit with 173. And since my app doesn't use any in-app purchases either, I'm now clueless what's actually causing this. In other words: What exactly causes this message to appear?
Jan ’26
Reply to In need of a sample receipt file that uses the SHA-256 hash
I can't seem to edit the message now that I know a bit more. So, here's a reply instead. Turns out that the basic receipt validation does not use SHA-256. The message rather seems to come up when my app quits with exit code 173 due to the receipt being invalid (as in when the app was copied from a different Mac, and now the GUID doesn't match). Whereas older macOS versions would then re-fetch a new receipt (and optionally ask the user to authenticate again), this doesn't apparently happen any more (WhyTF not? Why not keep the old method and only use the new method when the app makes it known to support the new method?!) Forcing a re-fetch of the receipt by simply deleting and re-installing the app from the MAS doesn't appear to work either as the receipt appears to be cached somewhere (again WTF - why isn't macOS being cautious here and falls back to downloading it when the app keeps returning 173???) It appears the app now has to explicitly request a new receipt. With SKReceiptRefreshRequest, which is already deprecated, but no alternative is offered (I don't do in-app purchases and also don't use Xcode/Swift but something different that doesn't offer access to these classes). Searching for the error message turned up other reports where people ran into this problem with old programs that cannot be launched any more just because of this receipt caching that apparently doesn't fix itself. I can't understand why macOS is handling this so badly. Is that just ignorance or thoughtlessness on behalf of the responsible dev team at Apple or is there some good reason why macOS can't give older apps and their long-time users a break here? Or me, who has to spend hours to keep the app working just to keep up with such changes (another one is that suddenly in Tahoe right-clicks into the menu bar item don't register any more if the mouse is at the top edge of the menu bat - which totally violates basic UI concepts established over 40 years ago). This year isn't going well so far for me.
Jan ’26
Reply to My Xcode-submitted app isn't appearing in the builds listing on the Connect site, suddenly
The issue was a symlink in my app: The Info.plist points to a file for the app icon. That file is a relative symlink to an existing icon file. This used to work for many years, and the Finder has no problem with it, either. Just Apple's recent verification process stumbles over it, without sending an error msg about it to me.
Apr ’25
Reply to How to detect an auto-mounting directory and wait for it to get mounted?
Specifically comparing searchfs vs getatrrlistbulk, if you end up having read the entire catalog structure off disk, then that cost can mask any performance difference. I just did a new comparison: I compared how searchfs compares vs. recursive dir scan on HFS+ vs. APFS. On SSDs, of course. Always searching for a non-existing file name (so that no extra attributes need to be collected). A search on a HFS+ vol with 8.8M items (6.6M files, 2.2M dirs) on a fast Intel system: searchfs: 40s find: 270s And on a HFS+ vol with 2.6M items (2M files, 600k dirs), Mac Mini 2018: searchfs: 11s find: 70s We can see that the search locally in the FS makes a huge different here. About factor 6 each time. Probably due to the many kernel-user space transitions. Now a search on APFS, with 1.75M items (1.5M files and 250k dirs), on an M4 Mini: searchfs: 13s find: 35s And APFS with 490k items (360k files, 130k dirs), on an Intel Mini 2018: searchfs: 9s find: 40s So, there's still a difference, but smaller. Which may suggest that there's still room for improvement on the searchfs part, or not. But it seems that on APFS everything (both searchfs and readdir etc) is significantly slower compared to HFS+, which is probably due to the dual-tree nature of APFS that requires more reads from the medium. With this in mind, the difference of searchfs performance of HFS+ vs. APFS becomes smaller, and so my bug report (radar 35052030, FB5367373) isn't really an issue. I've justed close it. I suggest we put this to rest. There's nothing to be done about this anyway. I'd rather have someone focus on how to make the Finder be faster when browsing the /Applications folder, e.g. by avoiding needless repeat calls into the FS, because that affects everyone, and to a point where one can get impatient (just try to mount another Mac's startup volume over SMB and browse that Mac's Apps folder over the network and it's time to make a coffee).
Topic: App & System Services SubTopic: Core OS Tags:
Mar ’25
Reply to How to detect an auto-mounting directory and wait for it to get mounted?
[quote='830819022, DTS Engineer, /thread/776198?answerId=830819022#830819022'] However, the real benefit here isn't local filesystem, it's remote file system case where the core cost isn't the direct syscall cost, but the cost of transferring all of those individual file records.[/quote] Right - but that huge advantage was lost when Apple decided to drop AFP support and didn't add such a feature to SMB. (And this is part of my current pain having to find alternative search methods (https://findanyfile.app/fs/) for various servers, such as Spotlight, SSH login with "find" execution on the server, using Everything's http server on Windows, and so on. It was all so easy when we had AFP). Is there even any supported network file system left that supports searchfs? Does NFS (I believe I never checked because it's so diffucult to use)?
Topic: App & System Services SubTopic: Core OS Tags:
Mar ’25
Reply to How to detect an auto-mounting directory and wait for it to get mounted?
Wow, Kevin. That's excellent support, thank you so much for making the effort! I had no idea that using concurrency in file system calls would have any such effect. You proved me wrong. In a real implementation, I think you'd probably want a fixed set of threads calling "getattrlistbulk", another set of threads processing the data each call produced, and then system the pushed directory back to the syscall thread. Already doing all the processing past the initial gathering of the directory contents in a separate thread, but that's clearly far from what's possible. I actually tracked this bug down and I have a question about your testing. Were you always testing on "freshly" mounted volumes (meaning, umount volume-> mount volume-> searchfs)? Or did you also test on volumes under normal use and repeatedly running searchfs? The use case of my app is to mainly run searches on the entire startup volume. So that's what I focused on with my tests. I try to be aware of caching effects (I believe some OS versions can use a of the available memory for caching information, but never learned about the details - all info on this I found was fairly vague). What I did, for instance, was to run searchfs on a running High Sierra system using HFS+, then cloned the system and let it convert to APFS, booted from that and ran the same tests. Repeatedly, of course. Later ran the tests on upgraded macOS systems, showing no significant improvement. The thing that confuses me most about searchfs performance on APFS is that when I search for something that's not findable (e.g. a unique name) both with searchfs and with a conventional method that eventually goes thru getatrrlistbulk, it didn't make much of a difference - even though the number of syscalls should be immensely different (and thereby contributing a lot to the overall time): searchfs should be a single syscalls, whereas the other method will be in the 100000s, right? That is why it could be so fast on HFS+, because all the searching happened right in the VFS, in a tight loop. Am I misunderstanding how it's working on APFS? I always assumed it was because of the dual-tree nature of APFS, where one cannot simply look at the one tree containing the dir records, looking for matching names, but must also look up the corresponding entries in the other tree in order to figure out which volume the dir entries belong to, and this would be the bottleneck (though one could argue that simply first blindly looking for matches in the dir rec tree and only then verifying the other tree if a match is found may be faster than the other way around that I suspect it's happening now). You understand what I mean? searchfs may be optimized to either first sort out the right dir recs by making sure they belong to the target volume before checking the dir properties, or vice versa, and maybe the other way around would be usually faster (assuming one seeks to find a small set of hits). Of course, that would require more work on this code for very few gain (hardly anyone is using this anyway, I believe). FYI, "find" is opensource and seems to be a relatively straightforward implementation built on fts. Yes, I know, and still my fts code in DirScanner was slower. So I assumed it had to do with the use of NSURLs. However, I must now admit that I was wrong in that. While find is still twice as fast compared to the search performance in FindAnyFile, it is now on-par with my most recent DirScanner version: After Jim Luther told me about the key to using fileSystemRepresentation instead of converting paths to NSStrings in my code, DirScanner became significantly faster. Yet, I failed to contemplate that fact when I wrote above that fts would still be 2x faster, or was too lazy (or confident) to double check. Now, with your findings on running parallel dir reads, I have a big task ahead of me rewriting that code. I'm excited. Thank you again for all your input.
Topic: App & System Services SubTopic: Core OS Tags:
Mar ’25
Reply to Cannot upload to App Store Connect due to "ITMS-90288: Invalid Code Signing Entitlements" and ITMS-90885
Okay - I've resolved it. Quinn's article was giving the right answers - though some details weren't clear to me initially: I don't need provisioning profiles for my embedded programs, just as Xcode says. However, I do need to temporarily add some Capability to every sub project as well - I had initially only done this for the main project. Adding the Capability (and then removing it again) to each sub project did add CODE_SIGN_ENTITLEMENTS = "PRJNAME TARGETNAME.entitlements"; to the project file, which was key to getting rid of the error – and the error message was quite misleading in this way, indeed!
Replies
Boosts
Views
Activity
9h
Reply to Cannot upload to App Store Connect due to "ITMS-90288: Invalid Code Signing Entitlements" and ITMS-90885
I wondered if the problem is that my certificate was using the exact bundle ID, not a wildcard. That would explain why it complains about 25856V4B4X.org.tempel.findanyfile.helper when the cert only was made for 25856V4B4X.org.tempel.findanyfile (despite the fact that this worked before, and still does with Xcode 13, with this setup). I made a new identifier for "25856V4B4X.org.tempel.findanyfile.*" and then created a new cert ("Apple Development") from that, imported it into the keychain, and also deleted the older cert with the same name from the keychain. Still, I'm getting the very same errors on upload. I don't understand what's wrong.
Replies
Boosts
Views
Activity
11h
Reply to ITMS-90885 “${executable}” in bundle “${bundle}” is missing a provisioning profile
I am struggling with this now, too. I read through (most of) the posts, mainly by Quinn, and cannot find what I'm still doing wrong. Upload with Xcode 13.4.1 still works, but with Xcode 16.3 or later I get both these errors and the warning of this topic: ITMS-90288: Invalid Code Signing Entitlements - The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. According to the provisioning profile, the bundle contains a key value that is not allowed: '25856V4B4X.org.tempel.findanyfile.helper' for the key 'com.apple.application-identifier' in 'Find Any File.app/Contents/Library/LaunchServices/org.tempel.findanyfile.helper' ITMS-90885: 'Cannot be used with TestFlight because the executable “${executable}” in bundle “${bundle}” is missing a provisioning profile but has an application identifier in its signature. Nested executables are expected to have provisioning profiles with application identifiers matching the identifier in the signature in order to be eligible for TestFlight.' I must admit that I only have an entitlement file for the main app, not for the embedded apps and frameworks. Until now, it appeared that they got automatically adopted. So, I don't understand what the entitlement for the embedded apps needs to contain. The main apps's entitlement file is now: codesign -d --ent - …/"Find Any File.app" Executable=…/FAFv2 MAS Release 31.10.26, 13.38.xcarchive/Products/Applications/Find Any File.app/Contents/MacOS/Find Any File [Dict] [Key] com.apple.application-identifier [Value] [String] 25856V4B4X.org.tempel.findanyfile [Key] com.apple.developer.team-identifier [Value] [String] 25856V4B4X [Key] com.apple.security.automation.apple-events [Value] [Bool] true [Key] com.apple.security.cs.allow-jit [Value] [Bool] true [Key] com.apple.security.personal-information.addressbook [Value] [Bool] true [Key] com.apple.security.personal-information.calendars [Value] [Bool] true(I just added the application-identifier and team-identifier to the entitlement file in hopes that would solve this but it made no difference.) I also checked with the other cmd on the app in the xcarchive, getting this: tempi@TTsMini24 ~ % security cms -D -i …/Find\ Any\ File.app/Contents/embedded.provisionprofile <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>AppIDName</key> <string>Find Any File</string> <key>ApplicationIdentifierPrefix</key> <array> <string>25856V4B4X</string> </array> <key>CreationDate</key> <date>2026-10-31T12:30:46Z</date> <key>Platform</key> <array> <string>OSX</string> </array> <key>IsXcodeManaged</key> <true/> <key>DeveloperCertificates</key> <array>…</array> <key>DER-Encoded-Profile</key> <data>…</data> <key>Entitlements</key> <dict> <key>com.apple.application-identifier</key> <string>25856V4B4X.org.tempel.findanyfile</string> <key>keychain-access-groups</key> <array> <string>25856V4B4X.*</string> </array> <key>com.apple.developer.team-identifier</key> <string>25856V4B4X</string> </dict> <key>ExpirationDate</key> <date>2027-10-31T12:30:46Z</date> <key>Name</key> <string>Mac Team Provisioning Profile: org.tempel.findanyfile</string> <key>ProvisionedDevices</key> <array> … </array> <key>TeamIdentifier</key> <array> <string>25856V4B4X</string> </array> <key>TeamName</key> <string>Thomas Tempelmann</string> <key>TimeToLive</key> <integer>365</integer> <key>UUID</key> <string>…</string> <key>Version</key> <integer>1</integer> </dict> </plist>Any help would be appreciated. Actually, I just realize that I may be confusing entitlements and profile - the latter is the one I claim from Apple's website, right? I haven't visited that for years (though I already struggled understanding it back in the early years when this all started). Gonna see if I can make sense of it on the Apple dev website now. Update - no, that can't be it. When i create a new profile, I need to choose an identifier that describes the entitlements for my app, right? So I checked my current identifier for my app, and that lists lots of options like "5G Network Slicing" and "Access Wi-Fi Information", but none of them look anything like the entitlements that I am using. So, my plain identifier that has none of these options checked should be fine, shouldn't it? Which also means that the current profile I have used for years should be fine as well. What am I missing here? These error msgs from the MAS upload are not helpful at all. They tell me things that seem right to me, and then there's that text with the unfilled ${executable} and ${bundle}, which isn't helping either. This could be so much better. And there's no way to reliably get help from DTS directly any more either - that option has apparently been dropped for having to ask here in the forum, where I can only hope that someone will take a look at this. If it weren't for Quinn, we'd all be doomed already, probably. Til then, I may just have to keep building and submitting with Xcode 13, and admitting to my MAS customers that I'm unable to make my app look modern while the indie build release works with the modern look as that's not locked out by Apple.
Replies
Boosts
Views
Activity
2d
Reply to macOS 27 - my faceless bg-only app now appears in the Dock - how to get rid of that?
It's a plain bg-only app that I use it as a Login Item, i.e. I use the old APIs to add it to the Login Items. Worked well since 2011 :) Changing the NSApplication activationPolicy had no effect, BTW. Anything launched thru LaunchServices, no matter its policy, appears to be appearing in the Dock now, even if it's a Login Item. Apple didn't appear to make an effort to filter out such apps from the new "let's warn the user about these bg apps" mode. I found a few complains on reddit where people had several of these unwanted Dock icons (while still wanting the bg app to keep working). BTW - what would be the correct place for a Login Item app? The LaunchItems surely isn't it, because that has unwanted side effects if it's not a SMAppService. MacOS folder? I've now asked Claudia and she updated my code to use the SMAppServices API in macOS 13 and later, while keeping the old method pre-13. Works! Just released a new beta that should do it: https://findanyfile.app/beta.html
Replies
Boosts
Views
Activity
Sep ’26
Reply to [27.0beta] Wrong app shown as running in Background in Dock
I have the same issue with my app Find Any File, see https://developer.apple.com/forums/thread/847300. That's really bad, because that bg-only helped is doing nothing by check for a hotkey press. Users don't want or need a constant reminder that this bg helper is running (constantly, that's the entire purpose of it!), occupying a precious dock icon for no gain. I'd have hoped that Apple provides a method to hide this helper, but that doesn't seem to be the case, or is there one?
Replies
Boosts
Views
Activity
Sep ’26
Reply to In need of a sample receipt file that uses the SHA-256 hash
Ahh, finally found the right answer here: https://github.com/iterate-ch/cyberduck/issues/16031 Basically, the default behavior of hiding the actual Mac's MAC address is the cause for the problem ("Privaty Wi-Fi Address"): If the Mac rotates or replaces the primary network interface's MAC address, and my code still uses the old code that would fetch the MAC from the higher level APIs, it would get the wrong MAC, and then fail the receipt check. To fix this, the MAC has to be fetched from IOKit registry, e.g. as shown in https://developer.apple.com/documentation/appstorereceipts/validating-receipts-on-the-device or https://lapcatsoftware.com/articles/2023/11/4.html
Replies
Boosts
Views
Activity
Jan ’26
Reply to In need of a sample receipt file that uses the SHA-256 hash
This is getting worse - a person who gets this error sent me the receipt file, and it turns out that the receipt file is fine, meaning that the validation shouldn't even fail, and thus the app not exit with 173. And since my app doesn't use any in-app purchases either, I'm now clueless what's actually causing this. In other words: What exactly causes this message to appear?
Replies
Boosts
Views
Activity
Jan ’26
Reply to In need of a sample receipt file that uses the SHA-256 hash
I can't seem to edit the message now that I know a bit more. So, here's a reply instead. Turns out that the basic receipt validation does not use SHA-256. The message rather seems to come up when my app quits with exit code 173 due to the receipt being invalid (as in when the app was copied from a different Mac, and now the GUID doesn't match). Whereas older macOS versions would then re-fetch a new receipt (and optionally ask the user to authenticate again), this doesn't apparently happen any more (WhyTF not? Why not keep the old method and only use the new method when the app makes it known to support the new method?!) Forcing a re-fetch of the receipt by simply deleting and re-installing the app from the MAS doesn't appear to work either as the receipt appears to be cached somewhere (again WTF - why isn't macOS being cautious here and falls back to downloading it when the app keeps returning 173???) It appears the app now has to explicitly request a new receipt. With SKReceiptRefreshRequest, which is already deprecated, but no alternative is offered (I don't do in-app purchases and also don't use Xcode/Swift but something different that doesn't offer access to these classes). Searching for the error message turned up other reports where people ran into this problem with old programs that cannot be launched any more just because of this receipt caching that apparently doesn't fix itself. I can't understand why macOS is handling this so badly. Is that just ignorance or thoughtlessness on behalf of the responsible dev team at Apple or is there some good reason why macOS can't give older apps and their long-time users a break here? Or me, who has to spend hours to keep the app working just to keep up with such changes (another one is that suddenly in Tahoe right-clicks into the menu bar item don't register any more if the mouse is at the top edge of the menu bat - which totally violates basic UI concepts established over 40 years ago). This year isn't going well so far for me.
Replies
Boosts
Views
Activity
Jan ’26
Reply to My Xcode-submitted app isn't appearing in the builds listing on the Connect site, suddenly
The issue was a symlink in my app: The Info.plist points to a file for the app icon. That file is a relative symlink to an existing icon file. This used to work for many years, and the Finder has no problem with it, either. Just Apple's recent verification process stumbles over it, without sending an error msg about it to me.
Replies
Boosts
Views
Activity
Apr ’25
Reply to How to detect an auto-mounting directory and wait for it to get mounted?
Specifically comparing searchfs vs getatrrlistbulk, if you end up having read the entire catalog structure off disk, then that cost can mask any performance difference. I just did a new comparison: I compared how searchfs compares vs. recursive dir scan on HFS+ vs. APFS. On SSDs, of course. Always searching for a non-existing file name (so that no extra attributes need to be collected). A search on a HFS+ vol with 8.8M items (6.6M files, 2.2M dirs) on a fast Intel system: searchfs: 40s find: 270s And on a HFS+ vol with 2.6M items (2M files, 600k dirs), Mac Mini 2018: searchfs: 11s find: 70s We can see that the search locally in the FS makes a huge different here. About factor 6 each time. Probably due to the many kernel-user space transitions. Now a search on APFS, with 1.75M items (1.5M files and 250k dirs), on an M4 Mini: searchfs: 13s find: 35s And APFS with 490k items (360k files, 130k dirs), on an Intel Mini 2018: searchfs: 9s find: 40s So, there's still a difference, but smaller. Which may suggest that there's still room for improvement on the searchfs part, or not. But it seems that on APFS everything (both searchfs and readdir etc) is significantly slower compared to HFS+, which is probably due to the dual-tree nature of APFS that requires more reads from the medium. With this in mind, the difference of searchfs performance of HFS+ vs. APFS becomes smaller, and so my bug report (radar 35052030, FB5367373) isn't really an issue. I've justed close it. I suggest we put this to rest. There's nothing to be done about this anyway. I'd rather have someone focus on how to make the Finder be faster when browsing the /Applications folder, e.g. by avoiding needless repeat calls into the FS, because that affects everyone, and to a point where one can get impatient (just try to mount another Mac's startup volume over SMB and browse that Mac's Apps folder over the network and it's time to make a coffee).
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Mar ’25
Reply to How to detect an auto-mounting directory and wait for it to get mounted?
[quote='830819022, DTS Engineer, /thread/776198?answerId=830819022#830819022'] However, the real benefit here isn't local filesystem, it's remote file system case where the core cost isn't the direct syscall cost, but the cost of transferring all of those individual file records.[/quote] Right - but that huge advantage was lost when Apple decided to drop AFP support and didn't add such a feature to SMB. (And this is part of my current pain having to find alternative search methods (https://findanyfile.app/fs/) for various servers, such as Spotlight, SSH login with "find" execution on the server, using Everything's http server on Windows, and so on. It was all so easy when we had AFP). Is there even any supported network file system left that supports searchfs? Does NFS (I believe I never checked because it's so diffucult to use)?
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Mar ’25
Reply to How to detect an auto-mounting directory and wait for it to get mounted?
Wow, Kevin. That's excellent support, thank you so much for making the effort! I had no idea that using concurrency in file system calls would have any such effect. You proved me wrong. In a real implementation, I think you'd probably want a fixed set of threads calling "getattrlistbulk", another set of threads processing the data each call produced, and then system the pushed directory back to the syscall thread. Already doing all the processing past the initial gathering of the directory contents in a separate thread, but that's clearly far from what's possible. I actually tracked this bug down and I have a question about your testing. Were you always testing on "freshly" mounted volumes (meaning, umount volume-> mount volume-> searchfs)? Or did you also test on volumes under normal use and repeatedly running searchfs? The use case of my app is to mainly run searches on the entire startup volume. So that's what I focused on with my tests. I try to be aware of caching effects (I believe some OS versions can use a of the available memory for caching information, but never learned about the details - all info on this I found was fairly vague). What I did, for instance, was to run searchfs on a running High Sierra system using HFS+, then cloned the system and let it convert to APFS, booted from that and ran the same tests. Repeatedly, of course. Later ran the tests on upgraded macOS systems, showing no significant improvement. The thing that confuses me most about searchfs performance on APFS is that when I search for something that's not findable (e.g. a unique name) both with searchfs and with a conventional method that eventually goes thru getatrrlistbulk, it didn't make much of a difference - even though the number of syscalls should be immensely different (and thereby contributing a lot to the overall time): searchfs should be a single syscalls, whereas the other method will be in the 100000s, right? That is why it could be so fast on HFS+, because all the searching happened right in the VFS, in a tight loop. Am I misunderstanding how it's working on APFS? I always assumed it was because of the dual-tree nature of APFS, where one cannot simply look at the one tree containing the dir records, looking for matching names, but must also look up the corresponding entries in the other tree in order to figure out which volume the dir entries belong to, and this would be the bottleneck (though one could argue that simply first blindly looking for matches in the dir rec tree and only then verifying the other tree if a match is found may be faster than the other way around that I suspect it's happening now). You understand what I mean? searchfs may be optimized to either first sort out the right dir recs by making sure they belong to the target volume before checking the dir properties, or vice versa, and maybe the other way around would be usually faster (assuming one seeks to find a small set of hits). Of course, that would require more work on this code for very few gain (hardly anyone is using this anyway, I believe). FYI, "find" is opensource and seems to be a relatively straightforward implementation built on fts. Yes, I know, and still my fts code in DirScanner was slower. So I assumed it had to do with the use of NSURLs. However, I must now admit that I was wrong in that. While find is still twice as fast compared to the search performance in FindAnyFile, it is now on-par with my most recent DirScanner version: After Jim Luther told me about the key to using fileSystemRepresentation instead of converting paths to NSStrings in my code, DirScanner became significantly faster. Yet, I failed to contemplate that fact when I wrote above that fts would still be 2x faster, or was too lazy (or confident) to double check. Now, with your findings on running parallel dir reads, I have a big task ahead of me rewriting that code. I'm excited. Thank you again for all your input.
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Mar ’25