Unable to Download App
I was asked to fix an issue with an existing app called SmartPak wherein users on iOS 10.1+ would see a warning message about the app slowing down their phone if they were using a 64 bit device. The fix itself was pretty straightforward – the architecture settings did not support 64 bit builds and a Digimarc library needed to be updated.
As I prepared to distribute the app for internal QA, I ran into a more difficult problem. I was unable to download the Adhoc Crashlytics build to any of my test devices.
In order to try to figure out what was occurring, I decided to look at the console log. The app was setup to build on Xcode 7.3.1 and due to time constraints I proceeded with that version rather than update the project to be compatible with Xcode 8. In order to view the console log, plugin the device that failed to install the app and choose Window->Devices. Click on the arrow in the lower left corner of the main pane to reveal the log.
Next download the log to a file using the arrow to the right of the trash can in the lower right corner.
Failed to verify code signature
Searching on the app name in the console log showed me the following:
Dec 14 14:28:40 Scott-iPhone-SE installd <Error>: 0x16e247000 +[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:]: 142: Failed to verify code signature of /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.5O8A7f/ extracted/Payload/SmartPak-TheHub.app : 0xe8008016 (The executable was signed with invalid entitlements.)
Looking just above this in the log I also noted:
Dec 14 14:28:40 Scott-iPhone-SE installd <Notice>: MIS: entitlement 'aps-environment' has value not permitted by provisioning profile 'Hub App Adhoc Profile 12_14_16C'
Examining provisioning profile
I found a nice technical note from Apple that was relevant to my debug – Technical Note TN2318 – Troubleshooting Failed Signature Verification
The article provided detail on how to examine your provisioning profile.
On my Mac my provisioning profiles are located at /Users/<username>/Library/MobileDevice/Provisioning Profiles
Finding the right one wasn’t obvious, but since I was intent on cleaning out old profiles anyway, I removed them all and downloaded the profile of interest again.
Per the technical note, the profile can be examined with the command:
security cms -D -i <profile>
Ex: security cms -D -i 82c0145c-460e-4a26-9ca1-d8176d77d842.mobileprovision
Searching the output for aps-environment showed:
The technical note also discusses examining the embedded profile (in the archive).
One can find the xcarchive by bringing up Window->Organizer, right clicking on the icon next to the archive of interest, and selecting Show in Finder.
Next within Finder select Show Package Contents on the archive.
In the directory Products/Applications/<app name>.app execute the security command again:
Ex: Products/Applications/SmartPak-TheHub.app> security cms -D -i embedded.mobileprovision
I found the value for aps-environment to be production here as well.
Finally I checked the app entitlements per the technical note.
Ex: Products/Applications> codesign -d –entitlements :- SmartPak-TheHub.app/
Here we see the mismatch which was causing the install error.
As a side note, we could also see the problem if we tried to export the archive.
Solution: The Entitlement file
After some searching, I found that the problem was in the file SmartPak-TheHub.entitlements
Here aps-environment was set to development when it should have been production.
One reference I found related to this was Xcode 8 “the aps-environment entitlement is missing from the app’s signature” on submit
I’m not sure why the entitlements file wasn’t being updated properly by Xcode – something I’ll need to revisit at a later date (the problem may not even be present in Xcode 8).