Post

Replies

Boosts

Views

Activity

macOS 15 and 26 VMs capped to 1.75 GB RAM regardless of actual RAM size
Hi, we're running into an issue on our virtual machines (running in UTM, but based on internet posts in other places it happens elsewhere as well) where they are limited to 1.75 GB RAM. On macOS 15, this issue seemed to appear in 15.8 and was fixed in 15.8.2. However, for the latest macOS 26 release (26.7.1), the issue is still there. The issue specifically seems to be related to the firmware version: 20457.1.29. My LLM figured out that you can swap out the firmware like this: This relies on an undocumented file layout, so back up first. With the VM stopped, copy bytes 0x4000–0x6000 (firmware slot descriptors) and 0x20000–0x420000 (two firmware slots) from the auxiliary storage file of an unaffected VM. The donor must have the same machine identifier (ECID) and either 18000.x firmware (such as a clone made before the update) or 20457.41.2. Keep the rest of the target file, which holds NVRAM and boot policy state. Replacing the whole file fails to boot when the two disks have different LocalPolicy nonces. An update that ships affected firmware overwrites the splice, so it has to be reapplied after such updates. I mostly wanted to share that workaround, but any input from others suffering from the same issue, or that have any additional information about this issue, would be appreciated. I am not so comfortable with running our macOS 26 regression tests on a VM with manually injected firmware that may or may not be fully compatible with the OS version. The other internet posts about what seems like the same issue: https://github.com/utmapp/UTM/issues/7897 https://github.com/cirruslabs/macos-image-templates/issues/385 I reported it to Apple as FB25121799
1
0
70
2w
Using restricted entitlements in a macOS 26 VM
We have a Mac app that uses some restricted macOS entitlements, thus to test it we embed a development provisioning profile, that needs to contain the correct provisioning UDID. Typically, for test VMs, we extract the provisioning and UDID and add it to the developer portal and then re-generate the provisioning profiles. However when we try to do this in our newly created VM (Apple Silicon), our executable won't run, and macOS logs that the provisioning profile doesn't allow the device: 2025-06-12 12:37:52.168 E taskgated-helper[27489:e97da] [com.apple.ManagedClient:ProvisioningProfiles] embedded provisioning profile not valid: file:///Applications/foo.app/Contents/embedded.provisionprofile error: Error Domain=CPProfileManager Code=-212 "Provisioning profile does not allow this device." UserInfo={NSLocalizedDescription=Provisioning profile does not allow this device.} 2025-06-12 12:37:52.169 E taskgated-helper[27489:e97da] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing com.company.foo because no eligible provisioning profiles found 2025-06-12 12:37:52.169 Df amfid[112:e99b0] [com.apple.xpc:connection] [0xb34c74a00] invalidated because the current process cancelled the connection by calling xpc_connection_cancel() 2025-06-12 12:37:52.169 Df taskgated-helper[27489:e97da] [com.apple.xpc:connection] [0x839144000] invalidated because the client process (pid 112) either cancelled the connection or exited 2025-06-12 12:37:52.169 E amfid[112:e91ac] [com.apple.MobileFileIntegrity.framework:default] Failure validating against provisioning profiles: <private> 2025-06-12 12:37:52.169 E amfid[112:e91ac] [com.apple.MobileFileIntegrity.framework:default] Restricted entitlements not validated, bailing out. Error: Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found" UserInfo={NSURL=<private>, NSLocalizedDescription=No matching profile found} 2025-06-12 12:37:52.169 Df amfid[112:e91ac] /Applications/foo.app/Contents/MacOS/foo not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found" UserInfo={NSURL=file:///Applications/foo.app/, NSLocalizedDescription=No matching profile found} The UDID for this VM does look weird, in System Profiler: But I can verify that this UDID string is present in the provisioning profile embedded in the app bundle: $ security cms -D -i /Applications/foo.app/Contents/embedded.provisionprofile | grep -i 7cd9234e9aa4fa8ba528ee417f857b2c993a20a3 <string>7CD9234E9AA4FA8BA528EE417F857B2C993A20A3</string> I also tried deleting the manually added device from the Developer portal and installing Xcode on the VM and letting Xcode register the device, but I end up in the same situation there. Even after letting Xcode itself register the device, it says that "this device not registered to your account" and then when I click "Register device" it changes into " already exists". Has anyone else managed to get Mac development provisioning profiles to work in a VM?
3
0
632
Jun ’25
macOS 15 and 26 VMs capped to 1.75 GB RAM regardless of actual RAM size
Hi, we're running into an issue on our virtual machines (running in UTM, but based on internet posts in other places it happens elsewhere as well) where they are limited to 1.75 GB RAM. On macOS 15, this issue seemed to appear in 15.8 and was fixed in 15.8.2. However, for the latest macOS 26 release (26.7.1), the issue is still there. The issue specifically seems to be related to the firmware version: 20457.1.29. My LLM figured out that you can swap out the firmware like this: This relies on an undocumented file layout, so back up first. With the VM stopped, copy bytes 0x4000–0x6000 (firmware slot descriptors) and 0x20000–0x420000 (two firmware slots) from the auxiliary storage file of an unaffected VM. The donor must have the same machine identifier (ECID) and either 18000.x firmware (such as a clone made before the update) or 20457.41.2. Keep the rest of the target file, which holds NVRAM and boot policy state. Replacing the whole file fails to boot when the two disks have different LocalPolicy nonces. An update that ships affected firmware overwrites the splice, so it has to be reapplied after such updates. I mostly wanted to share that workaround, but any input from others suffering from the same issue, or that have any additional information about this issue, would be appreciated. I am not so comfortable with running our macOS 26 regression tests on a VM with manually injected firmware that may or may not be fully compatible with the OS version. The other internet posts about what seems like the same issue: https://github.com/utmapp/UTM/issues/7897 https://github.com/cirruslabs/macos-image-templates/issues/385 I reported it to Apple as FB25121799
Replies
1
Boosts
0
Views
70
Activity
2w
Using restricted entitlements in a macOS 26 VM
We have a Mac app that uses some restricted macOS entitlements, thus to test it we embed a development provisioning profile, that needs to contain the correct provisioning UDID. Typically, for test VMs, we extract the provisioning and UDID and add it to the developer portal and then re-generate the provisioning profiles. However when we try to do this in our newly created VM (Apple Silicon), our executable won't run, and macOS logs that the provisioning profile doesn't allow the device: 2025-06-12 12:37:52.168 E taskgated-helper[27489:e97da] [com.apple.ManagedClient:ProvisioningProfiles] embedded provisioning profile not valid: file:///Applications/foo.app/Contents/embedded.provisionprofile error: Error Domain=CPProfileManager Code=-212 "Provisioning profile does not allow this device." UserInfo={NSLocalizedDescription=Provisioning profile does not allow this device.} 2025-06-12 12:37:52.169 E taskgated-helper[27489:e97da] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing com.company.foo because no eligible provisioning profiles found 2025-06-12 12:37:52.169 Df amfid[112:e99b0] [com.apple.xpc:connection] [0xb34c74a00] invalidated because the current process cancelled the connection by calling xpc_connection_cancel() 2025-06-12 12:37:52.169 Df taskgated-helper[27489:e97da] [com.apple.xpc:connection] [0x839144000] invalidated because the client process (pid 112) either cancelled the connection or exited 2025-06-12 12:37:52.169 E amfid[112:e91ac] [com.apple.MobileFileIntegrity.framework:default] Failure validating against provisioning profiles: <private> 2025-06-12 12:37:52.169 E amfid[112:e91ac] [com.apple.MobileFileIntegrity.framework:default] Restricted entitlements not validated, bailing out. Error: Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found" UserInfo={NSURL=<private>, NSLocalizedDescription=No matching profile found} 2025-06-12 12:37:52.169 Df amfid[112:e91ac] /Applications/foo.app/Contents/MacOS/foo not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found" UserInfo={NSURL=file:///Applications/foo.app/, NSLocalizedDescription=No matching profile found} The UDID for this VM does look weird, in System Profiler: But I can verify that this UDID string is present in the provisioning profile embedded in the app bundle: $ security cms -D -i /Applications/foo.app/Contents/embedded.provisionprofile | grep -i 7cd9234e9aa4fa8ba528ee417f857b2c993a20a3 <string>7CD9234E9AA4FA8BA528EE417F857B2C993A20A3</string> I also tried deleting the manually added device from the Developer portal and installing Xcode on the VM and letting Xcode register the device, but I end up in the same situation there. Even after letting Xcode itself register the device, it says that "this device not registered to your account" and then when I click "Register device" it changes into " already exists". Has anyone else managed to get Mac development provisioning profiles to work in a VM?
Replies
3
Boosts
0
Views
632
Activity
Jun ’25