Hello everyone,
I’m running into a code signing validation failure when delivering a .NET MAUI Mac Catalyst app to App Store Connect via Transporter. I’d appreciate any help in figuring out what is misconfigured.
Environment:
.NET 9 MAUI (net9.0-maccatalyst)
Build host: Mac
Delivery tool: Transporter (App Store Connect)
Issue:
The packaging process itself appears to succeed and produces a .pkg file, but Transporter fails during validation with the following error:
text
The product archive package's signature is invalid. Ensure that it is signed with your "3rd Party Mac Developer Installer" certificate. (90237)
Publish command:
I’m publishing and signing from the command line, following Microsoft’s documentation for publishing .NET MAUI Mac Catalyst apps to the Mac App Store.
bash
dotnet publish -f net9.0-maccatalyst -c Release
-p:EnableCodeSigning=true
-p:EnablePackageSigning=true
-p:CodesignKey="Apple Distribution: Ping Zhang (*********D)"
-p:CodesignProvision="AideApp_MacCatalyst"
-p:CodesignEntitlements="Platforms/MacCatalyst/Entitlements.plist"
-p:PackageSigningKey="3rd Party Mac Developer Installer: Ping Zhang (Y2K7Q6HU4D)"
-p:CreatePackage=true
What I’ve checked so far:
The 3rd Party Mac Developer Installer certificate is present in my keychain.
The certificate has not expired.
The certificate matches the correct team and App ID.
The generated .pkg is what I’m uploading through Transporter.
Questions:
Is there anything wrong with the PackageSigningKey or CodesignKey parameters in the command above?
Does .NET MAUI actually apply the 3rd Party Mac Developer Installer signature to the .pkg when EnablePackageSigning=true and CreatePackage=true are used?
Should the CodesignKey be an Apple Distribution certificate, or should it also be a 3rd Party Mac Developer Application certificate for Mac App Store distribution?
Are there any additional steps required to ensure the .pkg is signed correctly before uploading with Transporter?
How can I verify whether the .pkg was signed with the correct installer certificate? For example, would pkgutil --check-signature be sufficient?
Any guidance would be greatly appreciated. Thank you!
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
0
0
87