Building a macOS commandline utility with a provisioning profile

user_3854841 0
Viewed 659

My goal is to build a macOS commandline binary with a Provisioning Profile (said profile is required, due to the use of Apple's new Endpoint Security Framework).

✅ I've created and installed the Provisioning Profile - and have no problem building and running macOS application version (Xcode auto populates the "Provisioning Profile", under "Signing and Capabilities", when the "Bundle Identifier" matches the one in the installed Provisioning Profile):

enter image description here

However, when attempting to build a commandline version, this option does not appear as Xcode believes "None [is] Required":

enter image description here

I've attempted to specify the Provisioning Profile anyways, via the project's "Build Settings" for the target:

enter image description here

❌ But building fails with: processMonitor does not support provisioning profiles. processMonitor does not support provisioning profiles, but provisioning profile Process Monitor has been manually specified. Set the provisioning profile value to "Automatic" in the build settings editor.

Note, the project's Provisioning Profile (under "Build Settings") is set to "Automatic" enter image description here

❌ I've also had no luck via xcodebuild, which generates the same error:

$ xcodebuild -project "processMonitor.xcodeproj" -scheme processMonitor -configuration Release PROVISIONING_PROFILE_SPECIFIER="Process Monitor" DEVELOPEMENT_TEAM="<team id>"
Build settings from command line:
    DEVELOPEMENT_TEAM = <team id>
    PROVISIONING_PROFILE_SPECIFIER = Process Monitor

note: Using new build system
note: Planning build
note: Constructing build description
error: processMonitor does not support provisioning profiles. processMonitor does not support provisioning profiles, ...

So, the question is: is it possible to build a stand-alone macOS commandline binary that requires a Provisioning Profile? ...and if so, how?

xcode macos objective-c
1 Answers

FWIW, a stand-alone macOS command line binary can be code-signed and entitled using a provisioning profile if it is packaged in a traditional 'App Bundle' (.app) folder structure but not as a free standing single binary file.

There's an Endpoint Security example of this procedure posted in the Apple Developer forum: https://developer.apple.com/forums/thread/129596

The TLDR is to build a full-fledged '.app' project with Xcode including the proper entitlements, provisioning profile, code-signing configuration and then swap out the logic for the application's main executable (e.g. DaemonInAppsClothing.app/Contents/MacOS/DaemonInAppsClothing) with the desired command line binary logic yielding a folder structure as follows (From Apple Developer Forum post above):

% find DaemonInAppsClothing.app
DaemonInAppsClothing.app
DaemonInAppsClothing.app/Contents
DaemonInAppsClothing.app/Contents/_CodeSignature
DaemonInAppsClothing.app/Contents/_CodeSignature/CodeResources
DaemonInAppsClothing.app/Contents/MacOS
DaemonInAppsClothing.app/Contents/MacOS/DaemonInAppsClothing
DaemonInAppsClothing.app/Contents/embedded.provisionprofile
DaemonInAppsClothing.app/Contents/Info.plist
DaemonInAppsClothing.app/Contents/PkgInfo
user_23339330
Related