fanfan-de/anybox/signing-entitlements

Signing & Entitlements

Quick Start

Use this skill when the failure smells like codesigning rather than compilation: launch refusal, missing entitlement, invalid signature, sandbox mismatch, hardened runtime confusion, or trust-policy rejection.

Workflow

1. Inspect the bundle or binary.

• Locate the .app or executable.
• Identify the main binary inside Contents/MacOS/.

1. Read signing details.

• Use codesign -dvvv --entitlements :- <path>.
• Use spctl -a -vv <path> when Gatekeeper behavior matters.
• Use plutil -p for entitlements or Info.plist inspection.

1. Classify the failure.

• Unsigned or ad hoc signed
• Wrong identity
• Entitlement mismatch
• Hardened runtime issue
• App Sandbox issue
• Nested code signing issue
• Distribution/notarization prerequisite issue

1. Explain the minimum fix path.

• Say exactly what is wrong.
• Show the shortest set of validation or repair commands.
• Distinguish local development problems from distribution problems.

Useful Commands

• codesign -dvvv --entitlements :- <app-or-binary>
• spctl -a -vv <app-or-binary>
• security find-identity -p codesigning -v
• plutil -p <path-to-entitlements-or-plist>

Guardrails

• Never invent missing entitlements.
• Do not conflate notarization with local debug signing.
• If the real issue is a build setting or provisioning profile, say so directly.

Output Expectations

Provide:

• what artifact was inspected
• what signing state it is in
• the exact failure class
• the minimum fix or validation sequence