Codesign fatal error - 2020.3.1f1 lib_burst_generated.bundle

Greetings,

We have a project that utilizes the burst compilation. The problem is when we codesign --deep, we get the following failures:

Code (CSharp):

1. /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate: fatal error: file not in an order that can be processed (code signature data out of place): /Users/User/Desktop/Product.app/Contents/PlugIns/lib_burst_generated.bundle

All of our other bundles are signed correctly. If we disable the Burst compilation, it codesigns correctly.

Please advise.

 

Wonderful. Thanks!

 

@Tautvydas-Zilys we have our own code signing plugins that handles iOS, tvOS and macOS. We are not generating an xcode project for macOS thus it appears the Unity "codesign" step is causing this problem. We are signing the app post-build via a codesign command. This works on 2019LTS builds however with 2020 we are now running into various signature issues. We recently had a build rejected after a success testflight upload of PKG with the following:

Code (CSharp):

1. ITMS-90238: Invalid Signature - The executable at path Product.app/Contents/Resources/Data/ARM64/GameAssembly.dylib has following signing error(s): valid on disk /Volumes/data01/app_data/app-processing/mz_6603017525895083292dir/mz_1186243791311285809dir/Product.pkg/Payload/Product.app/

Code (CSharp):

1. ITMS-90238: Invalid Signature - The executable at path Product.app/Contents/Resources/Data/x64/GameAssembly.dylib has following signing error(s): code object is not signed at all In architecture: x86_64

As you can see, we're getting rejected even though our codesign --verify succeeds. Again, this is only happening in 2020 and not 2019 LTS. Also see the following:

Code (CSharp):

1. /Users/User/Desktop/Product.app/Contents/Frameworks/GameAssembly.dylib: valid on disk
2. /Users/User/Desktop/Product.app/Contents/Frameworks/GameAssembly.dylib: satisfies its Designated Requirement

Would building an xcode project for macOS be the appropriate workaround? We have a hard scheduled milestone that we must meet within a week.

 

@Tautvydas-Zilys We cannot archive via xcode project either with macOS due to the following error:

Code (CSharp):

1. chown: /Users/User/Library/Developer/Xcode/DerivedData/Product/Build/Intermediates.noindex/ArchiveIntermediates/GameAssembly/InstallationBuildProductsLocation/usr/local/lib/GameAssembly.dylib: No such file or directory
2. Command /usr/sbin/chown failed with exit code 1

Any ideas on why the path seems incorrect or missing?

 

An update: Switch Xcode to use the new build system (whereas Unity generates projects with Legacy) solves the archive problem.

 

@Tautvydas-Zilys Another frustrating update:

When building via the Xcode gui with the new Xcode build system, it resolves the archive issue; however, it now causes a CLI issues when specifying the new build system. As you can see from the following output:

Result when specifying a provision profile that does include the correct entitlements (this only happens with new build system).

Code (CSharp):

1.     /Applications/Xcode.app/Contents/Developer/usr/bin/xcodebuild -project /Users/User/Desktop/Product/Product.xcodeproj -scheme Product-sdk macosx -configuration AppStoreDistribution CODE_SIGN_STYLE=Manual "CODE_SIGN_IDENTITY=Apple Distribution: COMPANY (...)" "PROVISIONING_PROFILE_SPECIFIER_APP=COMPANY macOS Distribution" DEVELOPMENT_TEAM=TeamID -UseModernBuildSystem=YES OTHER_CODE_SIGN_FLAGS=--keychain=/Users/Shared/git/Product/Product/Assets/Editor/Keychains/Product.keychain -archivePath /Users/User/Desktop/Product.xcarchive archive
2.  
3. User defaults from command line:
4.     IDEArchivePathOverride = /Users/User/Desktop/Product.xcarchive
5.     UseModernBuildSystem = YES
6.  
7. Build settings from command line:
8.     CODE_SIGN_IDENTITY = Apple Distribution: COMPANY (...)
9.     CODE_SIGN_STYLE = Manual
10.     DEVELOPMENT_TEAM = TeamID
11.     OTHER_CODE_SIGN_FLAGS = --keychain=/Users/Shared/git/Product/Product/Assets/Editor/Keychains/Product.keychain
12.     PROVISIONING_PROFILE_SPECIFIER_APP = Company macOS Distribution
13.     SDKROOT = macosx11.1
14.  
15. note: Using new build system
16. note: Building targets in parallel
17. note: Using codesigning identity override: Apple Distribution: Company (...)
18. note: Planning build
19. note: Constructing build description
20. error: "Product" requires a provisioning profile with the iCloud feature. Select a provisioning profile in the Signing & Capabilities editor. (in target 'Product' from project 'Product')

Result when using PROVISION_PROFILE_SPECIFIER instead of *_APP

Code (CSharp):

1. note: Using new build system
2. note: Building targets in parallel
3. note: Using codesigning identity override: Apple Distribution: Company (...)
4. note: Planning build
5. note: Constructing build description
6. error: Bundle identifier is missing. GameAssembly doesn't have a bundle identifier. Add a value for PRODUCT_BUNDLE_IDENTIFIER in the build settings editor. (in target 'GameAssembly' from project 'Product')

Result when specifying the Bundle Identifier as requested

Code (CSharp):

1. note: Using new build system
2. note: Building targets in parallel
3. note: Using codesigning identity override: Apple Distribution: Company (...)
4. note: Planning build
5. note: Constructing build description
6. error: GameAssembly does not support provisioning profiles. GameAssembly does not support provisioning profiles, but provisioning profile Company macOS Distribution has been manually specified. Set the provisioning profile value to "Automatic" in the build settings editor. (in target 'GameAssembly' from project 'Product')

I'm currently testing archive with automatic signing, but this is not ideal as I need to specify the certificates and profiles on a per project basis. Any thoughts or experience with this?

 

Alternatively, if you find all this Xcode project configuration bothersome, you can just build it in the default configuration and then just treat the resulting .app as if it was created by Unity without using Xcode project option and sign it manually via cmd line.
​

Yes. For now we're going to try to archive with automatic signing (which will create a Apple Development signed version) and then for the export pass along the correct signing identifiers and installer identifiers via the exportPlist so it generates the correct PKG.

I'll report back here as we make progress.

 

Is there a fix for this? We are getting this error in Unity 2030.3.2f1, Unity 2030.3.3f1 and 2021.1.2f1
It's preventing us from uploading a Mac build to the Mac App Store.

our error is the same

Code (CSharp):

1. /Sping.app/Contents/Plugins/lib_burst_generated.bundle: replacing existing signature
2. /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate: fatal error: file not in an order that can be processed (code signature data out of place): /Users/soap.build4/Desktop/SPING/SPING_BUILDS/macOS/Sping_macOS_1.1.0(42)_dist/Sping.app/Contents/PlugIns/lib_burst_generated.bundle
3. ./Sping.app/Contents/Plugins/lib_burst_generated.bundle: the codesign_allocate helper tool cannot be found or used
4.  

When we attempt to manually resign our app ( we sign the libraries first ) and this error is generated from that signign step

codesign --force --verify --verbose --sign "$codesignID" --preserve-metadata=identifier,entitlements,flags "./$appName.app/Contents/Plugins/lib_burst_generated.bundle"

I have also added to this issue https://issuetracker.unity3d.com/is...5.1414965151.1618183992-1222068212.1603853418

As I do not think it's resolved in the versions stated from our tests

 

Is there a ETA on those releases?
I can see from running

Code (CSharp):

1.  
2. lipo -info /Users/mark.fennell/Desktop/_builds/Sping/Sping/Contents/Plugins/lib_burst_generated.bundle
3.  
4. Non-fat file: /Users/mark.fennell/Desktop/_builds/Sping/Sping/Contents/Plugins/lib_burst_generated.bundle is architecture: x86_64
5.  

That its not building the arm64 version