Quinn, thanks, I figured it out. I was sent down the wrong rabbit hole, but I have everything working now. Thank you.

I'm trying to connect to a vintage USB storage device. Everything works except this one call which prevents telling the device to sign the data to the drive. Without it, the entire project is useless because asking people to turn on FDA is not responsible and I won't ask them to do it. So while I understand that the entitlement is intended for virtualization apps that ship on the Mac App Store, elevating privileges in the app doesn't solve the problem or else I'd simply do that and move on. I don't NEED the app to be on the Mac App Store, but I need a way for IOUSBHostInterface(ioService:options:queue:interestHandler:) to succeed without FDA. So this is a Catch-22. In fact, here's a chart of everything attempted: App itself - user (501) - refused — "needs root or com.apple.vm.device-access" Terminal - root - works LaunchDaemon - (SMAppService) root - fails Daemon + launchctl asuser - root - fails Daemon + audit-session join - root - fails Daemon + disclaim - root - fails Admin prompt (do shell script) - root - fails Self-signed entitlement — SIGKILL by AMFI

I just wanted to mention that after looking at StoreKit 2 more closely, it did exactly what I needed. I moved from SK to SK2 in about two hours...maybe less. Thanks for the heads up on that.

Thanks, I'll take a look at StoreKit 2 more closely.

Thanks for your reply. In doing more reading, I see that you were posting in a thread about TPInAppReceipt which I just found and will try later today. There are two reasons why I wanted to avoid using OpenSSL: It's like using a hammer to push in a thumbtack. I didn't know if using OpenSSL would open up a can of worms for encryption compliance. I'm just trying to validate receipts with as little headache as possible. My app has been finished for two weeks but I'm stuck with trying to properly fix this IAP issue.

Same thing happened to me. The hint in the error log was about app signing. I had just renamed my app and one of the residuals was that the Xcode set the app to be signed locally instead of "Developer". The app signing was set to "Developer" before the app rename, so I don't know why Xcode set that to a different value. Setting it back to "Developer" fixed the problem for me.