Add Device into Microsoft Apple Developer Program

[ruixi1994]

Tool information
Hi there, I am opening this issue to seek help for code sign issue with macOS 10.15 and ask whether it is possible to have virtual-environment registered into Microsoft Developer Program.

Context: we are facing issue now to migrate our tests automation to macOS Catalina because of the forced notarization. Since our tests relied on keychain access, forced notarization means we have to sign our test app with keychain sharing enabled to be able to run tests. And a developer provisioning profile which matches the device we ran our build on will be required to sign the app. We had the developer provisioning profile which matches all the Microsoft developer's device but since the virtual image there we are using from Azure pipeline is not registered as a part of the apple developer program, we are not able to sign our test app and run tests on it. This new requirement of code sign happened only with macOS 10.15, so we are good with using previous version of virtual image. But this issue is blocking us from moving forward to newer version of macos.

So I want to ask the possibility of adding the images into the developer's device list. We can do it by sign in with a Microsoft apple developer account in Xcode, Really appreciate your help!

Area for Triage: Apple

Question, Bug, or Feature?: Question

Virtual environments affected

• [X ] macOS 10.15
• Ubuntu 16.04 LTS
• Ubuntu 18.04 LTS
• Windows Server 2016 R2
• Windows Server 2019

Can this tool be installed during the build? NO

Tool installation time in runtime

Are you willing to submit a PR?

[maxim-lobanov]

Hello @ruixi1994 , thank you for raising this question.
Unfortunately, we are not super familiar with process of Apple notarization signing but at the first look, it is not possible with VMs.
As I understand the process correctly, we need to include UUID of our build machines to the provisioning profile. All of our builds run on one of our Virtual Machines chosen during runtime. Since the UUID of Virtual Machines changes (the number of VMs can be scaled in runtime and their number and UUID can be changed), it's not possible to support this kind or signing.

I wonder if it is possible to use notarization sign without provisioning profile somehow for testing purpose?

The possible option is using self-hosted Mac agent for builds. In this case, you will have the machine with static UUID that you can add to your provisioning profile and use for tests. But self-hosted machine will require difficult configuration and maintenance + cost. You can find some details here.

[ruixi1994]

Hello @ruixi1994 , thank you for raising this question.
Unfortunately, we are not super familiar with process of Apple notarization signing but at the first look, it is not possible with VMs.
As I understand the process correctly, we need to include UUID of our build machines to the provisioning profile. All of our builds run on one of our Virtual Machines chosen during runtime. Since the UUID of Virtual Machines changes (the number of VMs can be scaled in runtime and their number and UUID can be changed), it's not possible to support this kind or signing.
I wonder if it is possible to use notarization sign without provisioning profile somehow for testing purpose?
The possible option is using self-hosted Mac agent for builds. In this case, you will have the machine with static UUID that you can add to your provisioning profile and use for tests. But self-hosted machine will require difficult configuration and maintenance + cost. You can find some details here.

Thank you so much for your reply! Yes we do need to add the UUID. And unfortunately apple don't allow us sign without the profile on Catalina. For self-hosted, we have tried self-hosted, but it actually slowed down our CI build not very efficient. I can try to explore other ways if we cannot enroll VMs. Thanks again for your help!

In addition, I have one question about the changed UUID. are the UUID of VMs changing from a pool (like each time it will assign a specific image from the pool)? Or it is purely regenerated? And if there is a pool how large is it? I am wondering is that possible to add the pool into device list if it exist. Thanks!

[maxim-lobanov]

@ruixi1994 , thank you for pushing me for additional investigation.
After additional investigation, I have realized that I was wrong in my previous post and relied on legacy documentation that is wrong for now.

Currently, all available VMs, for all pools, have the same Hardware UUID(4203018E-580F-C1B5-9525-B745CECA79EB) and it comes from the fact how virtualization works.
You can get this UUID by running simple command on macOS pool: system_profiler SPHardwareDataType.

I am trying to clarify with our infra engineers how often it is changed and if we can rely on it.
However, I have found the message that proves that UUID was the same two months ago.

Could you please try to add this UUID to your provisioning profile and try to use notarization signing on macOS 10.15 VM?

[ruixi1994]

@ruixi1994 , thank you for pushing me for additional investigation.
After additional investigation, I have realized that I was wrong in my previous post and relied on legacy documentation that is wrong for now.

Currently, all available VMs, for all pools, have the same Hardware UUID(4203018E-580F-C1B5-9525-B745CECA79EB) and it comes from the fact how virtualization works.
You can get this UUID by running simple command on macOS pool: system_profiler SPHardwareDataType.

I am trying to clarify with our infra engineers how often it is changed and if we can rely on it.
However, I have found the message that proves that UUID was the same two months ago.

Could you please try to add this UUID to your provisioning profile and try to use notarization signing on macOS 10.15 VM?

Thanks you so much for the updates! Let me try this and verify. Really appreciate your help!

[ruixi1994]

@maxim-lobanov I registered the UUID with Microsoft Corporation Apple Developer program and verified that the developer cert works on the virtual image now! Thanks so much! Please let me know if you got the answer of how often it will change. Really appreciate your help.

[maxim-lobanov]

@ruixi1994,
I have confirmed that UUID was not changed for the last 2 years. It is how our infra works right now. And we don't have plans to change it for now.
But unfortunately, we can't promise and guarantee that it won't be changed in future in case of some internal infra changes.

In my opinion, you can rely on the current UUID for now, because as I mentioned previously, we don't have plan to change it in near future.

[ruixi1994]

@maxim-lobanov,
Thanks again helping me with that! And glad to hear that this is not planned to be change in near future. My team and I decided to rely on it now as a temp solution. We also had added a function in task to detect the UUID change. I think this will be good for us so far! Thanks!

[maxim-lobanov]

I am glad that could help you!
Closing the issue for now but feel free to reopen if any