My command line tool with a JIT entitlement is failing to run on Sequoia.
2025-05-26 14:17:09.758 E taskgated-helper[91764:3ab7036] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing DecisionRuleTool because no eligible provisioning profiles found
2025-05-26 14:17:09.758 Df amfid[576:3ab6d6b] /Users/jim/DecisionRuleTool not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found" UserInfo={NSURL=file:///Users/jim/DecisionRuleTool, NSLocalizedDescription=No matching profile found}
2025-05-26 14:17:09.759 Df kernel[0:3ab7031] (AppleMobileFileIntegrity) AMFI: When validating /Users/jim/DecisionRuleTool:
2025-05-26 14:17:09.759 Df kernel[0:3ab7031] mac_vnode_check_signature: /Users/jim/DecisionRuleTool: code signature validation failed fatally: When validating /Users/jim/DecisionRuleTool:
2025-05-26 14:17:09.759 Df kernel[0:3ab7031] proc 91763: load code signature error 4 for file "DecisionRuleTool"
2025-05-26 14:17:09.759 Df kernel[0:3ab7032] (AppleSystemPolicy) ASP: Security policy would not allow process: 91763, /Users/jim/DecisionRuleTool
Codesign isn't giving me any clues as to why. It validates.
Asking it what the entitlements are on the binary:
% codesign --display --entitlements - /Users/joconnor/MACEP-9852-2/tools/detection/DecisionRuleTool
Executable=/Users/jim/DecisionRuleTool
[Dict]
[Key] com.apple.application-identifier
[Value]
[String] XXXXXXXXX.com.mycompany.drt
[Key] com.apple.developer.team-identifier
[Value]
[String] XXXXXXXXX
[Key] com.apple.security.cs.allow-jit
[Value]
[Bool] true
https://developer.apple.com/documentation/Xcode/signing-a-daemon-with-a-restricted-entitlement
This makes it look like this may be hopeless, that I can't create a command line took with proper entitlements.
