Failed to sign apphost error code 1

[DanH-ER]

When building a .NET 8 app on Mac I'm getting an error "Failed to sign apphost error code one:: singlefilehost is already signed". I ONLY get this issue when building the x64 version of the app. If I use the exact same build and publish profile but change it to output ARM then it completes successfully.

I've tried completely uninstalling, using the MS supplied scripts, and reinstalling the latest release but I get the same error.

The fact that this only happens when building the x64 version is why I believe this is a bug in the .NET Core SDK and not my settings. But if you guys know of a way to fix this issue I would love to hear it.

[marcpopMSFT]

@agocke @elinor-fung I believe we call a host api to sign the apphost on Mac. Something wrong in our logic or in the api?

[agocke]

Hmm, I don't think we changed anything here recently.

@DanH-ER could you grab a binlog for the error? It would help us see exactly where things are going wrong.

[DanH-ER]

Hmm, I don't think we changed anything here recently.

@DanH-ER could you grab a binlog for the error? It would help us see exactly where things are going wrong.

I can, but looking at that page it appears this log is only generated when the code is built. This error occurs during the publish phase. Will adding that flag to the build help you diagnose a publish error?

I ran an experiment and found something interesting. I uninstalled the SDK and installed the oldest 8.0.0 official release available for download. I rebuilt the project and ran the publish and it actually worked. I then repeated these steps for each subsequent release version. All the way up to 8.0.4 it worked, then when I hit 8.0.5 it failed. So it seems this bug was introduced somewhere between those two versions.

[DanH-ER]

Just noticed that the binary produced by 8.0.4 is not signed with my proper certificate. Whereas the ARM one that works in 8.0.6 is signed by the right certificate. So it seems some work was definitely done here and something just isn't quite right.

[agocke]

dotnet publish -bl should also grab a bin log for the publish.

Just to confirm -- have you cleaned your output directory completely in-between passes? And have you cleaned your ~/.nuget/.packages path?

[DanH-ER]

dotnet publish -bl should also grab a bin log for the publish.

Just to confirm -- have you cleaned your output directory completely in-between passes? And have you cleaned your ~/.nuget/.packages path?

I do a clean before every build. I did try cleaning and restoring all the nuget packages and that did not help. The only thing that helped was reverting to the older version (8.0.4) and it seems like maybe that worked because it doesn't actually sign the output files.

[agocke]

I tried to repro this locally and couldn't. If I use 8.0.4 or 8.0.6 (corresponding to the 8.0.200 or 8.0.302 SDKs), I get these results:

$ dotnet publish -r osx-x64 -p:PublishSingleFile=true
$ codesign -dv --verbose ./bin/Release/net8.0/osx-x64/publish/test-sign
Executable=/Users/andy/tmp/test-sign/bin/Release/net8.0/osx-x64/publish/test-sign
Identifier=test-sign-55554944c8a3948f647b397e8539276e34b9fae4
Format=Mach-O thin (x86_64)
CodeDirectory v=20400 size=521515 flags=0x2(adhoc) hashes=16291+2 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=0 size=12

which looks right to me. I'll need a binlog at minimum, and possibly a repro for more details.

[DanH-ER]

I tried to repro this locally and couldn't. If I use 8.0.4 or 8.0.6 (corresponding to the 8.0.200 or 8.0.302 SDKs), I get these results:

$ dotnet publish -r osx-x64 -p:PublishSingleFile=true
$ codesign -dv --verbose ./bin/Release/net8.0/osx-x64/publish/test-sign
Executable=/Users/andy/tmp/test-sign/bin/Release/net8.0/osx-x64/publish/test-sign
Identifier=test-sign-55554944c8a3948f647b397e8539276e34b9fae4
Format=Mach-O thin (x86_64)
CodeDirectory v=20400 size=521515 flags=0x2(adhoc) hashes=16291+2 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=0 size=12

which looks right to me. I'll need a binlog at minimum, and possibly a repro for more details.

Unfortunately the repo is private and owned by my company so I cannot share that.

This is the complete error incase the line numbers help at all..

/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.targets(709,5): error NETSDK1177: Failed to sign apphost with error code 1: /Users/dan.haddix/repos/File Transfer Agents/dist/intermediates/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/obj/net8.0/osx-x64/singlefilehost: is already signed [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.targets(709,5): error NETSDK1177: ; Exit code: 1 [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]

Weirdly if I set the flag /p:_EnableMacOSCodeSign=false I get a different error, but its still trying to sign something...

/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: The "GenerateBundle" task failed unexpectedly. [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: System.InvalidOperationException: Failed to codesign '/Users/dan.haddix/repos/File Transfer Agents/dist/mac/AgentService/ExtremeReach.FTA.AgentDaemon': /Users/dan.haddix/repos/File Transfer Agents/dist/mac/AgentService/ExtremeReach.FTA.AgentDaemon: is already signed [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: at Microsoft.NET.HostModel.Bundle.Bundler.GenerateBundle(IReadOnlyList`1 fileSpecs) [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: at Microsoft.NET.Build.Tasks.GenerateBundle.ExecuteCore() [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: at Microsoft.NET.Build.Tasks.TaskBase.Execute() [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: at Microsoft.Build.BackEnd.TaskExecutionHost.Microsoft.Build.BackEnd.ITaskExecutionHost.Execute() [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]
/usr/local/share/dotnet/sdk/8.0.302/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(1038,5): error MSB4018: at Microsoft.Build.BackEnd.TaskBuilder.ExecuteInstantiatedTask(ITaskExecutionHost taskExecutionHost, TaskLoggingContext taskLoggingContext, TaskHost taskHost, ItemBucket bucket, TaskExecutionMode howToExecuteTask) [/Users/dan.haddix/repos/File Transfer Agents/agents/AgentDaemon/ExtremeReach.FTA.AgentDaemon/ExtremeReach.FTA.AgentDaemon.csproj]

[agocke]

This binlog shows a successful build. I need a failing one.

[agocke]

Feel free to send it to angocke (note extra 'n') @ msft if you don't want to post it publicly.

[DanH-ER]

This binlog shows a successful build. I need a failing one.

The build doesn't fail, the publish does. Does the publish option have the same flag?

[agocke]

Yup.