我想我可能已经弄清楚了这一点。我一直在 OS X Mavericks 上运行 Xcode 4.6.3,我的印象是任何特定于构建的工具都捆绑在 Xcode 应用程序中。
但是,它似乎codesign
在/usr/bin
. 无论它是由 Xcode 安装程序之一放置,还是附带香草系统安装,我都不确定。但是通过阅读man
页面codesign
,我发现了这个漂亮的选项:
--deep When signing a bundle, specifies that nested code content such as helpers, frameworks, and plug-ins, should be recursively signed
in turn. Beware that all signing options you specify will apply, in turn, to such nested content.
When verifying a bundle, specifies that any nested code content will be recursively verified as to its full content. By default,
verification of nested content is limited to a shallow investigation that may not detect changes to the nested code.
When displaying a signature, specifies that a list of directly nested code should be written to the display output. This lists only
code directly nested within the subject; anything nested indirectly will require recursive application of the codesign command.
然后我从两周前(~2013 年 6 月)发现了这篇文章( https://alpha.app.net/isaiah/post/6774960 ),其中提到(尽管是二手的):
@isaiah 我问了实验室里的一个人。他说,codesign 现在要求在对整个应用程序包进行代码签名之前单独对嵌入式框架进行签名。
手动重新运行codesign
Xcode 正常运行的命令,同时将--deep
标志添加到末尾,正确签署应用程序。
我还不确定这个手动签名有什么后果,或者我是否可以调整 Xcode 构建以--deep
自动添加标志,但这似乎是根本问题。(codesign
不再自动对您的应用程序包进行深度签名。)