fix-codesign-error

Diagnoses macOS code signing and entitlement failures and explains the minimal repair path.

4.0k|410|Updated Feb 1, 2026
One-click install
npx skills add https://github.com/robinebers/openusage --skill fix-codesign-error
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: fix-codesign-error
Source: https://github.com/robinebers/openusage/tree/main/.agents/skills/fix-codesign-error
Command: npx skills add https://github.com/robinebers/openusage --skill fix-codesign-error

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

macOS developers frequently hit cryptic code signing, entitlement, hardened runtime, or notarization errors when building and distributing apps. This Skill inspects the failing app bundle or binary and explains the exact failure class plus the minimum steps needed to fix it, replacing guesswork with verifiable diagnostics.

Core Features & Use Cases

  • Failure Inspection: Examines the app bundle, executable, signing info, and entitlements using verifiable commands like codesign -d, spctl, and plutil.
  • Failure Classification: Distinguishes identity, provisioning, hardened runtime, sandboxing, and trust policy problems, and separates local development signing issues from distribution or notarization failures.
  • Minimal Repair Plan: Outputs the smallest repair sequence or validation command instead of broad, risky changes.
  • Use Case: Your notarized macOS app fails Gatekeeper checks after re-signing. Invoke the skill with the app path to identify whether the hardened runtime or an entitlement mismatch is the cause and get the exact fix commands.

Quick Start

Ask the assistant to run /fix-codesign-error on your app bundle, for example by saying: inspect MyApp.app with the fix-codesign-error skill and tell me why the signature is invalid.

Frequently Asked Questions about fix-codesign-error

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I diagnose a macOS code signing error?

Inspect the app bundle with codesign -d to view signing info and entitlements, then check trust with spctl. This skill automates that inspection, classifies the failure as identity, provisioning, hardened runtime, sandboxing, or trust policy, and explains the minimal fix.

How to check entitlements of a signed macOS app?

Run codesign -d --entitlements on the app bundle or binary to read the actual embedded entitlements. The skill follows this approach and never invents entitlements, reading them only from the binary or source files.

What is the difference between local signing and notarization failures?

Local development signing failures involve identity or provisioning problems on your machine, while notarization failures occur during Apple distribution validation. The skill explicitly distinguishes these two classes so the repair path matches the actual failure stage.

Why does my macOS app fail Gatekeeper after re-signing?

Common causes include a missing hardened runtime flag, mismatched entitlements, or a broken signature seal. Verifying with codesign -d and spctl identifies which class applies, and the skill then provides the minimal repair sequence.

Can this skill automatically repair my app's signature?

No. Its default mode is inspect, which diagnoses and explains the failure, and the optional repair-plan mode only outlines the minimal repair sequence. It provides verifiable commands rather than modifying your app directly.