Crashlytics download issue and provisioning profile debug

Unable to Download App

I was asked to fix an issue with an existing  app called SmartPak wherein users on iOS 10.1+ would see a warning message about the app slowing down their phone if they were using a 64 bit device.   The fix itself was pretty straightforward – the architecture settings did not support 64 bit builds and a Digimarc library needed to be updated.

As I prepared to distribute the app for internal QA, I ran into a more difficult problem.  I was unable to download the Adhoc Crashlytics build to any of my test devices.


Console Log

In order to try to figure out what was occurring, I decided to look at the console log.    The app was setup to build on Xcode 7.3.1 and due to time constraints I proceeded with that version rather than update the project to be compatible with Xcode 8.  In order to view the console log, plugin the device that failed to install the app and choose Window->Devices.   Click on the arrow in the lower left corner of the main pane to reveal the log.


Next download the log to a file using the arrow to the right of the trash can in the lower right corner.


Failed to verify code signature

Searching on the app name in the console log showed me the following:

Dec 14 14:28:40 Scott-iPhone-SE installd[4309] <Error>: 0x16e247000 +[MICodeSigningVerifier 
_validateSignatureAndCopyInfoForURL:withOptions:error:]: 142: Failed to verify code signature 
of /private/var/installd/Library/Caches/
extracted/Payload/ : 0xe8008016 (The executable was 
signed with invalid entitlements.)

Looking just above this in the log I also noted:

Dec 14 14:28:40 Scott-iPhone-SE installd[4309] <Notice>: MIS: 
entitlement 'aps-environment' has value not permitted 
by provisioning profile 'Hub App Adhoc Profile 12_14_16C'

Examining provisioning profile

I found a nice technical note from Apple that was relevant to my debug – Technical Note TN2318 – Troubleshooting Failed Signature Verification

The article provided detail on how to examine your provisioning profile.

On my Mac my provisioning profiles are located at /Users/<username>/Library/MobileDevice/Provisioning Profiles

Finding the right one wasn’t obvious, but since I was intent on cleaning out old profiles anyway, I removed them all and downloaded the profile of interest again.

Per the technical note, the profile can be examined with the command:

security cms -D -i <profile>

Ex: security cms -D -i 82c0145c-460e-4a26-9ca1-d8176d77d842.mobileprovision

Searching the output for aps-environment showed:


Embedded Profile

The technical note also discusses examining the embedded profile (in the archive).

One can find the xcarchive by bringing up Window->Organizer, right clicking on the icon next to the archive of interest, and selecting Show in Finder.

Next within Finder select Show Package Contents on the archive.

In the directory Products/Applications/<app name>.app execute the security command again:

Ex: Products/Applications/> security cms -D -i embedded.mobileprovision

I found the value for aps-environment to be production here as well.

App Entitlements

Finally I checked the app entitlements per the technical note.

Ex: Products/Applications> codesign -d –entitlements :-


Here we see the mismatch which was causing the install error.

As a side note, we could also see the problem if we tried to export the archive.


Solution: The Entitlement file

After some searching, I found that the problem was in the file SmartPak-TheHub.entitlements

Here aps-environment was set to development when it should have been production.

One reference I found related to this was Xcode 8 “the aps-environment entitlement is missing from the app’s signature” on submit

I’m not sure why the entitlements file wasn’t being updated properly by Xcode – something I’ll need to revisit at a later date (the problem may not even be present in Xcode 8).


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s