"Command CodeSign failed with a nonzero exit code" in MacOS Sequoia

MacOSX and iOS
1

I was able to build a Projucer from the official GitHub repository using Xcode, but whenever I created new project or opened up an example project Xcode showed an error.

“Command CodeSign failed with a nonzero exit code”
That’s it. No log, no additional information, just one line of announcement.

This is weird! I did everything from Google Search, but it simply didn’t work out for me. Is there any solution? By the way, DemoRunner runs and displays the output really well. I think there’s some collision.

Please help!

2

Did you put the source files into an iCloud folder? That will break the build.

3

No, it was just Application folder or Download folder.

4

If you open Xcode’s build log pane there is often a lot more information about why the build failed.

5

I find xcode get’s itself in a mess sometimes. When I hit this error 2 things to try:

  1. Make sure connected to internet as codesigning with a timestamp needs this
  2. Delete all build folders and rebuild from scratch
6

Yes! You can also try Signing Certificate:Sign to Run Locally if not connected to the internet (the setting gets overwritten by the Projucer though).

7

I already did all of those, including checking the log and Sign to Run Locally. Of course, I was connected to Gbps network, so no network problem. I also did cmd + shift + k to clear build folders. Nothing’s different.

8

don’t use the clean build folders inside xcode - physically delete the MacOSX folder yourself and resave in projucer.

9

I found it necessary to use entitlements - e.g. with theEntitlementsFile.entitlements:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Enable App Sandbox -->
    <key>com.apple.security.app-sandbox</key>
    <true/>
    
    <!-- Microphone access for audio recording -->
    <key>com.apple.security.device.audio-input</key>
    <true/>
    
    <!-- Access to audio output devices -->
    <key>com.apple.security.device.audio-output</key>
    <true/>

    <!-- Network access, both client and server -->
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>

    <!-- File access (read and write) in user-selected locations -->
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
    
    <!-- File access (read and write) in the Downloads directory -->
    <key>com.apple.security.files.downloads.read-write</key>
    <true/>

    <!-- Access to temporary directories -->
    <key>com.apple.security.files.bookmarks.app-scope</key>
    <true/>

    <!-- Required for debugging ... -->
	<key>com.apple.security.get-task-allow</key>
	<true/>

    <!-- Access to printing devices (if needed) -->
    <key>com.apple.security.print</key>
    <true/>

    <!-- Allow the app to use specific APIs that might not be generally permitted -->
    <key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
    <array>
        <string>com.apple.audio.coreaudiod</string>
    </array>

    <!-- If the app needs to communicate with another app through Apple Events -->
    <key>com.apple.security.automation.apple-events</key>
    <true/>

</dict>
</plist>

… and in my case, also some CMake specifically for Apple (but you should wire up the equivalent in XCode):


if (APPLE)
	set(CMAKE_OSX_ARCHITECTURES "x86_64;arm64" CACHE INTERNAL "")

	# Get the hostname
	execute_process(
			COMMAND hostname -s
			OUTPUT_VARIABLE HOSTNAME
			OUTPUT_STRIP_TRAILING_WHITESPACE
	)

	# Check the hostname and set the environment variable accordingly
	if(HOSTNAME STREQUAL "developerMachine")
		set(CODESIGN_IDENTITY "Apple Development: John Doe \\(XXXXXXXXXX\\)")
	elseif(HOSTNAME STREQUAL "buildMachine")
		set(CODESIGN_IDENTITY "Developer ID Application: Generic Corporation \\(XXXXXXXXXX\\)")
	endif()

	message(STATUS "CODESIGN_IDENTITY = $ENV{CODESIGN_IDENTITY}")

	# Specify the entitlements file (optional)
	set(ENTITLEMENTS_FILE "${CMAKE_CURRENT_SOURCE_DIR}/theEntitlementsFile.entitlements")

	# Add a post-build step to code sign the application
	add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
		COMMAND codesign --force --timestamp --options=runtime --entitlements ${ENTITLEMENTS_FILE} --sign "${CODESIGN_IDENTITY}" "$<TARGET_BUNDLE_DIR:${PROJECT_NAME}>"
		COMMENT "Code signing the application bundle"
	)
endif()
10

I’ll try it both. Which filepath should I store the file?

11

Assuming your project is named “someProject” and lives in a directory named “someProject/”, put the entitlements file in “someProject/someProject.entitlements” - this is merely a convention to ensure you are aware of the entitlements for your project at some later date.

And then in XCode configure the Target to use that .entitlements file (there are standard methods for doing this in XCode).

Alternatively, if you are using CMake, add the commands above to do the codesign’ing with the .entitlements file as you’ve placed it.

But I’ve just realized that you’re probably trying to run Projucer.app, which should build properly and execute properly “out of the box”, so perhaps there is something else going on besides an incorrect entitlements file.

To be honest, I don’t use Projucer because I prefer the power and flexibility of CMake (and its better for CI/CD) so maybe this is a bug in the develop branch of JUCE, somehow?

Another thing you can do is to try and disable SIP on MacOS, but this is full of potential hassle:

This is another reason I use CMake, since it means I can easily push my projects into a Virtual Machine for building, and leave my development machine with SIP disabled, when I need it - alas, it is a continuous struggle against Apples’ anti-patterns, designed to make it harder to do development without the involvement of their toolchains …

EDIT: Also, your codesign issue may be, because you don’t have an Apple Developer certificate on your system? Have you built another project with XCode already - signed in and received the developer certificates, and so on? This may be the missing initial prior step that is causing codesign to fail …