The latest update of my app was rejected by Mac App Store with the message:
ERROR ITMS-9000: "Invalid Signature - the nested app bundle Pitch at path [com.mycompany.myproduct.pkg/Payload/.app/Contents/MacOS/Pitch.vst] is not signed. Refer to the Code Signing and Application Sandboxing Guide at ...
I did perform a V2 codesign of the nested bundle and the check approves it:
$> codesign -dv "Pitch.vst"
Executable=/Pitch.vst/Contents/MacOS/Pitch
Identifier=com.mycompany.pitch
Format=bundle with Mach-O thin (i386)
CodeDirectory v=20200 size=903 flags=0x0(none) hashes=38+3 location=embedded
Signature size=4351
Signed Time=Nov 24, 2014, 10:29:39 AM
Info.plist entries=18
TeamIdentifier=G6XWPH5YAP
Sealed Resources version=2 rules=12 files=0
Internal requirements count=1 size=200
I get the same positive result when calling:
$> codesign -dv --deep "<My product name>.app"
Also the verify command is positive:
$> codesign --verify --deep --verbose=2 "<My product name>.app"
--prepared:<My product name>.app/Contents/MacOS/Pitch.vst
--validated:<My product name>.app/Contents/MacOS/Pitch.vst
<My product name>.app: valid on disk
<My product name>.app: satisfies its Designated Requirement
Only check that actually does fail:
$> spctl -a -t exec -vv "Pitch.vst"
Pitch.vst: rejected
origin=3rd Party Mac Developer Application: <My company> (G6XWPH5YAP)
The nested bundle is a VST. I am on Yosemite OS X 10.10.1 and using Xcode 6.1 (Application Loader 3.0).
I have tried everything I could Google and think of my self and am out of ideas. Why is it rejected by Mac App Store (and by spctl)?