@eskimo thanks for the reply
codesign --display --entitlements does show a com.apple.application-identifier is present, it is the same for both apps - the bundleID prefixed by our teamID.
security cms -D on the embedded.provisionprofile shows the same result for both apps, including the same com.apple.application-identifier value in the Entitlements section.
The working and non-working app both refer to the same certificate, with the same serial number, hash and expiration date.
The profile for both the working and non-working app expires Sep 23, 2040 at 9:36:53 AM PDT
The
The plists differ a little, because the two apps were built on different Macs with different toolchains.
BuildMachineOSBuild good 22A400, bad 22G90
DTPlatformBuild, good 14A309, bad <empty string>
DTPlatformVersion, good 12.3, bad 13.3
DTSDKBuild good 21E226, bad 22E245
DTSDKName good macosx12.3, bad macosx13.3
DTXcode good 1400 bad 1430
DTXcodeBuild good 14A309, bad 14E222b
I ran spctl --assess -vvv on the bad app, which said accepted
I edited this post, previously I said spctl claimed the bundle format was unrecognized. That was my error - I passed it a path to the app which has spaces in its name with un-escaped spaces. Instead of it telling you that the path doesn't exist, spctl says it is broken.
I don't know whether to believe that, because the system log tells me something else. Also, the bundles are almost identical. The "good" app has an additional profile, "embedded.mobileprovision". Which one does the OS use, and why is there an embedded.mobileprovision file in a macOS app?
I'll have another look at those links you cited, thanks