title: Getting OSSystemExtensionErrorCodeSignatureInvalid After Codeless DEXT is Activated
body: <p>I built a codeless DEXT to replace a working codeless KEXT - <a href="https://stackoverflow.com/q/63212902/275657">Migrating a codeless KEXT to a codeless DEXT</a>. I referenced a few sites and GitHub repositories to put it together and had help from other SO users.</p>
  <p>I am running with SIP turned off, developer mode is on (systemextensionsctl developer on). I am following the advice outlined here <a href="https://github.com/knightsc/USBApp/issues/1" rel="nofollow noreferrer">https://github.com/knightsc/USBApp/issues/1</a> for signing the app and dext.</p>
  <p>When I run the app it is embedded in and request activation for the extension, that function <em><strong>seems</strong></em> to succeed. However, I then get a call to -</p>
  <pre><code>request:didFailWithError:
  </code></pre>
  <p>on my OSSystemExtensionRequestDelegate-derived request object when a work-queue thread starts up. The error is OSSystemExtensionErrorCodeSignatureInvalid. I assume that thread is related to the dispatch_queue_t I used to construct the OSSystemExtensionRequest.</p>
  <p>From searching around and Apple source, I understand OSSystemExtensionErrorCodeSignatureInvalid is related to entitlements and signing. When I run systemextensionsctl list I get -</p>
  <pre><code>1 extension(s)
  --- com.apple.system_extension.driver_extension
  enabled active  teamID  bundleID (version)  name    [state]
  *   *   &lt;REDACTED&gt;  Home.MyUsbDrver (1.0/1) Home.MyUsbDrver [activated enabled]
  </code></pre>
  <p>When I run codesign -d -vvv --entitlements :- , I get -</p>
  <pre><code>Executable=/Users/.../TestDequeueApp.app/Contents/MacOS/TestDequeueApp
  Identifier=Home.TestDequeueApp
  Format=app bundle with Mach-O thin (x86_64)
  CodeDirectory v=20500 size=1055 flags=0x10000(runtime) hashes=24+5 location=embedded
  Hash type=sha256 size=32
  CandidateCDHash sha256=HASH
  CandidateCDHashFull sha256=LONG HASH
  Hash choices=sha256
  CMSDigest=DIGEST
  CMSDigestType=2
  CDHash=HASH
  Signature size=4745
  Authority=Apple Development: MY Apple ID STUFF
  Authority=Apple Worldwide Developer Relations Certification Authority
  Authority=Apple Root CA
  Signed Time=Aug 6, 2020 at 10:51:41 AM
  Info.plist entries=23
  TeamIdentifier=TEAM ID
  Runtime Version=10.15.6
  Sealed Resources version=2 rules=13 files=7
  Internal requirements count=1 size=188
  &lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;!DOCTYPE plist PUBLIC &quot;-//Apple//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&gt;
  &lt;plist version=&quot;1.0&quot;&gt;
  &lt;dict&gt;
      &lt;key&gt;com.apple.security.app-sandbox&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.security.files.user-selected.read-only&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.developer.system-extension.install&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.developer.system-extension.uninstall&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  &lt;/plist&gt;
  </code></pre>
  <p>Not sure I see anything wrong there and the code signing script seems to run correctly. Here is my DEXT entitlement file with com.apple.developer.driverkit.transport.usb set for a legacy device (the same device listed in IOKitPersonalities section of my DEXT info.plist) -</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;!DOCTYPE plist PUBLIC &quot;-//Apple//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&gt;
  &lt;plist version=&quot;1.0&quot;&gt;
  &lt;dict&gt;
      &lt;key&gt;com.apple.developer.driverkit&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.developer.driverkit.transport.usb&lt;/key&gt;
      &lt;array&gt;
          &lt;dict&gt;
              &lt;key&gt;idVendor&lt;/key&gt;
              &lt;integer&gt;5843&lt;/integer&gt;
              &lt;key&gt;idProduct&lt;/key&gt;
              &lt;integer&gt;33&lt;/integer&gt;
          &lt;/dict&gt;
      &lt;/array&gt;
      &lt;key&gt;com.apple.security.app-sandbox&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  &lt;/plist&gt;
  </code></pre>
  <p>So it seems that the extension is active and enabled, but something fails during validation.</p>
  <p>Any help or input on this problem would be appreciated.</p>
  <p>Update:</p>
  <p>Just for grins, I ran my production app that does not install the system extension to see if it would cause my hardware to match. Since the driver was installed, it did. However, when I tried to access the device I got a crash. That still seems like progress.</p>