[Bug] App Store rejection: msalruntime.dylib causes ITMS-90171 Invalid bundle structure

[idenardi]

Library version used

4.74.1

.NET version

MAUI - .NET 9, MAUI 9.0.90

Scenario

PublicClient - mobile app

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

When submitting an iOS app using MSAL to the App Store with the latest MSAL NuGet package version, the submission is rejected with the following error:

ITMS-90171: Invalid bundle structure - The “samplename.app/msalruntime.dylib” binary file is not permitted. 
Your app cannot contain standalone executables or libraries, other than a valid CFBundleExecutable of supported bundles.

ITMS-90209: Invalid Segment Alignment - The app binary at 'samplename.app/msalruntime.dylib' does not have proper segment alignment. Try rebuilding the app with the latest Xcode version.

This issue was not happening on version 4.73.0 of Microsoft.Identity.Client. After upgrading to a newer version, the problem started occurring.

Relevant code snippets

Expected behavior

The MSAL integration should not include msalruntime.dylib in the app bundle, so that the app can be accepted by the App Store.

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

4.73.0

Solution and workarounds

No response

[wgriep]

I am having the same issue when trying 4.77.1 package. Any suggestions?

[idenardi]

It seems that in the PR Update native interop to 0.19.2 the Microsoft.Identity.Client.NativeInterop package was updated (MSAL Release 4.73.1).

After checking the Microsoft.Identity.Client.NativeInterop .nupkg, I noticed that the previous version (0.18.1) did not include the osx-x64 and osx-arm64 runtime, but in version 0.19.2 the runtime is present with the msalruntime.dylib.

Since iOS apps cannot contain .dylib files, I will try to conditionally exclude the runtime assets on iOS builds using ExcludeAssets="runtime". I’ll test this approach to confirm whether the app passes App Store validation.

[wgriep]

It seems that in the PR Update native interop to 0.19.2 the Microsoft.Identity.Client.NativeInterop package was updated (MSAL Release 4.73.1).

After checking the Microsoft.Identity.Client.NativeInterop .nupkg, I noticed that the previous version (0.18.1) did not include the osx-x64 and osx-arm64 runtime, but in version 0.19.2 the runtime is present with the msalruntime.dylib.

Since iOS apps cannot contain .dylib files, I will try to conditionally exclude the runtime assets on iOS builds using ExcludeAssets="runtime". I’ll test this approach to confirm whether the app passes App Store validation.

If there is anything we could test to validate your proposed solution, please let me know. Thanks in advance for trying to get this resolved.

[idenardi]

I found a way to work around this issue.
In my case, the Microsoft.Identity.Client.NativeInterop package (which contains the msalruntime.dylib) was being included indirectly through the Microsoft.Identity.Client.Broker package - which is only required for the Windows app.

To fix it, I isolated the PackageReference so it's only included when targeting Windows, and adjusted the related code with #if WINDOWS. With this change, the .dylib file is no longer part of the iOS build, resolving the problem.

<ItemGroup Condition="$(TargetFramework.Contains('-windows'))">
    <PackageReference Include="Microsoft.Identity.Client.Broker" Version="4.77.1" />
    <PackageReference Include="Microsoft.Identity.Client.Desktop.WinUI3" Version="4.77.1" />
</ItemGroup>

Hope this helps resolve it for you as well!

[wgriep]

@idenardi, we had Desktop isolated but not Broker. Greatly appreciate the help in solving the issue.

[idenardi]

Closing this issue since it's now resolved.