Bug 39269 - App signed incorrectly when distributing
Summary: App signed incorrectly when distributing
Status: RESOLVED ANSWERED
Alias: None
Product: Xamarin.Mac
Classification: Desktop
Component: Other ()
Version: 2.4.0 (C6)
Hardware: PC Mac OS
: Highest blocker
Target Milestone: 2.8.0 (C7)
Assignee: Jeffrey Stedfast
URL:
Depends on:
Blocks:
 
Reported: 2016-03-01 21:39 UTC by Frank A. Krueger
Modified: 2016-03-03 22:28 UTC (History)
4 users (show)

Tags:
Is this bug a regression?: ---
Last known good build:

Notice (2018-05-24): bugzilla.xamarin.com is now in read-only mode.

Please join us on Visual Studio Developer Community and in the Xamarin and Mono organizations on GitHub to continue tracking issues. Bugzilla will remain available for reference in read-only mode. We will continue to work on open Bugzilla bugs, copy them to the new locations as needed for follow-up, and add the new items under Related Links.

Our sincere thanks to everyone who has contributed on this bug tracker over the years. Thanks also for your understanding as we make these adjustments and improvements for the future.


Please create a new report on Developer Community or GitHub with your current version information, steps to reproduce, and relevant error messages or log files if you are hitting an issue that looks similar to this resolved bug and you do not yet see a matching new report.

Related Links:
Status:
RESOLVED ANSWERED

Description Frank A. Krueger 2016-03-01 21:39:56 UTC
It would seem that the signer no longer expands the $(TeamIdentifierPrefix) macro. This is a breaking change since I've been shipping this app forever. :-)

Here is the build log: http://pastebin.com/k57Z9YMN


1 package(s) were not uploaded because they had problems:
	/var/folders/db/4q6xfd4n68bg30j28vpc_c800000gn/T/A760EA2D-B332-4CDE-B67A-F127F2EB99D4/454347770.itmsp - Error Messages:
		ERROR ITMS-90287: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'com.apple.developer.ubiquity-container-identifiers' in 'com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app/Contents/MacOS/iCircuit'."
		ERROR ITMS-90287: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'com.apple.developer.ubiquity-kvstore-identifier' in 'com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app/Contents/MacOS/iCircuit'."
		ERROR ITMS-90211: "Invalid Code Signing Entitlements. The signature for your app bundle contains entitlement values that are not supported. For the 'com.apple.developer.ubiquity-container-identifiers' entitlement, the values in the array must start with the prefix provided by Apple in the provisioning profile, followed by characters that are uppercase or lowercase Roman letters [A-Z, a-z], the digits 0 through 9, dot ['.'], or hyphen ['-'], and not contain any wildcard characters. Specifically, value '$(TeamIdentifierPrefix)com.kruegersystems.circuit' for the key 'com.apple.developer.ubiquity-container-identifiers' in 'com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app/Contents/MacOS/iCircuit' is not supported."
		ERROR ITMS-90211: "Invalid Code Signing Entitlements. The signature for your app bundle contains entitlement values that are not supported. For the com.apple.developer.ubiquity-kvstore-identifier entitlement, the value must start with the prefix provided by Apple in the provisioning profile, followed by characters that are uppercase or lowercase Roman letters [A-Z, a-z], the digits 0 through 9, dot ['.'], or hyphen ['-'], and not contain any wildcard characters. Specifically, value '$(TeamIdentifierPrefix)com.kruegersystems.circuitmac' for the key 'com.apple.developer.ubiquity-kvstore-identifier' in 'com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app/Contents/MacOS/iCircuit' is not supported."



=== Xamarin Studio ===

Version 5.10.2 (build 56)
Installation UUID: e51e2705-c52a-4ae8-aa07-c481d6ab8a7a
Runtime:
	Mono 4.2.2 (explicit/996df3c)
	GTK+ 2.24.23 (Raleigh theme)

	Package version: 402020030

=== Xamarin.Profiler ===

Version: 0.22.0.0
Location: /Applications/Xamarin Profiler.app/Contents/MacOS/Xamarin Profiler

=== Xamarin.Android ===

Version: 6.0.1.10 (Enterprise Edition)
Android SDK: /Users/fak/Library/Developer/Xamarin/android-sdk-mac_x86
	Supported Android versions:
		2.3   (API level 10)
		4.0.3 (API level 15)
		4.4   (API level 19)
		5.0   (API level 21)
		6.0   (API level 23)

SDK Tools Version: 24.4.1
SDK Platform Tools Version: 23.1
SDK Build Tools Version: 23.0.2

Java SDK: /usr
java version "1.7.0_51"
Java(TM) SE Runtime Environment (build 1.7.0_51-b13)
Java HotSpot(TM) 64-Bit Server VM (build 24.51-b03, mixed mode)

=== Xamarin Android Player ===

Version: 0.6.5
Location: /Applications/Xamarin Android Player.app

=== Apple Developer Tools ===

Xcode 7.2.1 (9548.1)
Build 7C1002

=== Xamarin.iOS ===

Version: 9.4.1.25 (Enterprise Edition)
Hash: 962a050
Branch: master
Build date: 2016-01-29 16:59:11-0500

=== Xamarin.Mac ===

Version: 2.4.1.6 (Enterprise Edition)

=== Xamarin Inspector ===

Version: 0.3.2.3
Hash: 1b526e6
Branch: master
Build date: Tue Nov 17 20:54:30 UTC 2015

=== Build Information ===

Release ID: 510020056
Git revision: bb74ff467c62ded42b7b7ac7fdd2edc60f8647b0
Build date: 2016-01-26 16:24:41-05
Xamarin addins: 8b797d7ba24d5abab226c2cf9fda77f666263f1b
Build lane: monodevelop-lion-cycle6-c6sr1

=== Operating System ===

Mac OS X 10.11.3
Darwin lepton.local 15.3.0 Darwin Kernel Version 15.3.0
    Thu Dec 10 18:40:58 PST 2015
    root:xnu-3248.30.4~1/RELEASE_X86_64 x86_64
Comment 1 Chris Hamons 2016-03-01 22:10:06 UTC
Hey Frank. Sorry for the trouble.

Taking a look at the code with a coworker, it appears the be caused by not having a provisioning profile detected. At least in a past revision, that appears to have been a compile error.

Do you know if in the past you also did not have provisioning profile, or did that change?
Comment 2 Frank A. Krueger 2016-03-03 21:52:50 UTC
Indeed it did not have a profile, but why didn't it expand anyway? Is the team ID only contained in the profile?

I would have expected to expand to the empty string or produce a build error. These things are hard to debug since app store signed apps can't run. So a little help from the tool would be appreciated.

I did add a profile, eventually, but I also hard coded the entitlements to get it submitted.
Comment 3 Jeffrey Stedfast 2016-03-03 21:55:26 UTC
I agree that we should have some sort of error or warning during the build or something that makes this more obvious.
Comment 4 Jeffrey Stedfast 2016-03-03 22:28:27 UTC
I've just updated the msbuild logic to log warnings if it finds $(TeamIdentifierPrefix) and/or $(AppIdentifierPrefix) in the Entitlements.plist when no provisioning profile is specified.