InstallerSection plugins no longer load on macOS 27 beta 5+ — Installer symlinks the bundle's Contents/, which breaks AMFI validation

Question

Created 2w

Replies 2

Boosts 1

Participants 2

We maintain a macOS product whose installer uses custom InstallerSection plugin bundles to show configuration panes during install. Starting with macOS 27 beta 6, all of our plugins stopped loading in Installer.app — the panes never appear and the install fails because our preinstall step depends on data the panes collect. The exact same .pkg works on macOS 26.6, and per thread 842811 the same bundles were fine on 27 betas 1–4(I have tested it from beta 6 onwards).

While investigating we found what looks like the underlying cause, and it's reproducible by hand.

THE FINDING

During a failing install, look inside the extracted plugin bundle while the Installer window is still open:

ls -la /private/tmp/com.apple.installer*/<Plugin>.bundle/Contents/

That layout fails code-signature validation. You can reproduce the failure manually, no Installer involved:

codesign -vvv "/private/tmp/com.apple.installer"*/<Plugin>.bundle → <Plugin>.bundle: Too many levels of symbolic links

WHAT THE SYSTEM LOGS SHOW

amfid rejects the plugin executable:

/private/tmp/com.apple.installerXXXXXX/<Plugin>.bundle/Contents/MacOS/<Plugin> not valid: Error Domain=AppleMobileFileIntegrityError Code=-420 "The signature on the file is invalid"

with repeated "UNIX error exception: 62" (errno 62 = ELOOP, too many levels of symbolic links) in backtraces through BundleDiskRep::component → SecStaticCode::component → validateNonResourceComponents → staticValidateCore, and "Code failed basic validity check (error: 100062)".

For a Developer ID–signed plugin the kernel then treats it as fatal:

AMFI: When validating /private/tmp/com.apple.installerXXXXXX/<Plugin>.bundle/Contents/MacOS/<Plugin>: The code contains a Team ID, but validating its signature failed. mac_vnode_check_signature: ... code signature validation failed fatally check_signature[pid: N]: error = 1

The plugin is never dlopen'd and the pane never appears.

QUESTIONS

Is there a way to get Installer to deploy the bundle with real files — or any other workaround?

Note : I have Filed via Feedback Assistant as FB24601496; this overlaps FB24415432 / thread https://developer.apple.com/forums/thread/842811, which we've cross-referenced

I have experienced this issue on latest Beta 8 build also -27.0 Beta (26A5425a)

Answered by DTS Engineer in 903670022

ELOOP, too many levels of symbolic links

Hmmmm, it’s hard to imagine that being anything other than a bug. Thanks for filing FB24601496 about it.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 1

DTS Engineer OP

Apple

2w

Recommended

ELOOP, too many levels of symbolic links

Hmmmm, it’s hard to imagine that being anything other than a bug. Thanks for filing FB24601496 about it.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 2

anonymoussingh OP

4h

Additional findings on this issue

We've dug into this a bit further and have two new data points:

Onset: This behavior started appearing from macOS 26.7 onward — earlier versions were unaffected.
Repro depends on how the pkg is launched: Running the .pkg inside the mounted DMG (installing directly from the mounted volume) does not show our installer plugin panes. But if the same .pkg is copied out of the DMG to a regular folder — Desktop, Downloads, etc. — the Installer runs it with all plugin panes rendering normally.

Tested and confirmed on both macOS 26.7 and macOS 27.