Codesign verification nightmare

[trapper]

I'm having major troubles getting my app submission accepted by app store, no matter how many times I try, go through the instructions, confirm every step, make all the checks in build results, upload again - and still ‘codesign verification check failed’. I have tried via both the itune connect website upload, and the app loader application.

This is driving me mental, I spent the whole of Sunday just trying to upload my binary. I have even started from the ground up with a completely fresh project and copied my classes over to ensure I haven’t screwed up any of the build settings along the way, still no luck.

Now I have had success codesigning before, as I have sent my app out to a few friends via the ad-hoc distribution method - this installed and ran on their iphones with no issues… surely this means the codesign went through with no issues?

Any ideas or suggestions? I have noticed several contradiction in the apple instructions so have been asking around to find out the correct methods (as well as trying every conceivable combination). Is there any definitive guide out there??

[Gero]

Originally Posted by trapper

Now I have had success codesigning before, as I have sent my app out to a few friends via the ad-hoc distribution method - this installed and ran on their iphones with no issues… surely this means the codesign went through with no issues?

Those are two different certificates. You need one for ad hoc and another for the AppStore. And you have to select the right one in your 'Project "xyz" Info' window.

You can confirm that your build is alright by right-clicking on your app file and selecting "show contents" thus making shure your embedded.mobileprovision is in there. And have a look at you console log as described in Apple´s docs.

I had problems until I found the Entitlements.plist - tip... might want to look into that. That just "recently" made it into Apple´s documentation.

[logicpaw]

I once had to remove all my ad hoc (and other non-necessary) certificates from the entire machine, empty the trash, and reboot, in order to get a store distribution to build correctly.

YMMV.

Also, make sure any ad hoc .plists are not in your distribution build.

.

[trapper]

Originally Posted by Gero

Those are two different certificates. You need one for ad hoc and another for the AppStore. And you have to select the right one in your 'Project "xyz" Info' window.

Yeah I understand there are two separate certificates, was just meaning that I have had success through the ad-hoc method in the past.

Originally Posted by Gero

You can confirm that your build is alright by right-clicking on your app file and selecting "show contents" thus making shure your embedded.mobileprovision is in there. And have a look at you console log as described in Apple´s docs.

I had problems until I found the Entitlements.plist - tip... might want to look into that. That just "recently" made it into Apple´s documentation.

Show Contents revels the embedded.mobileprovision as expected, and also the build results show the outputs as detailed in apple’s docs. Haven’t looked at the console log yet though? will check this out tonight.

As far as Entitlements.plist goes, I was of the understanding that this only needs to exist in your project if you are attempting the ad-hoc method, apples docs say to skip the Entitlements.plist bit for app store distribution?


Logicpaw; I will try scrapping the ad-hoc certificates from my setup tonight too.

[crabFish]

so I discovered something that might or might not help... If you have not choosen the correct output things might not work as expected - like, if you did a test in the simulator and then move on to making a distrubution or AdHoc file - if you do not select set active sdk to iphone device it won't work... even if you choose distribution...

Might be totally irrelevant - just trying to help...

[Fnurglewitz]

You need to do remove the "iPhone Developer: Your Name Here" line from the Target Info screen, do a Clean All Targets, put the "iPhone Developer: Your Name Here" back, and do a rebuild. In the Build Results screen you can see whether CodeSign has been called. If you don't remove the line and then put it back in, then CodeSign may not be called properly.

Maybe that helps.

[trapper]

Ok, I've checked the console log and I see nothing? What am I supposed to see there?

Tried the codesign verification check in terminal...

codesign -vvvv MyApp.app
/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app: a sealed resource is missing or invalid
/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app/CodeResources: resource added

copied and pasted the codesign line out of build results to see what the error message is if i try and sign it manually.

codesign -f -s "iPhone Distribution: My Name" --resource-rules=/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app/ResourceRules.plist --entitlements /Users/trapper/Desktop/MyApp/build/MyApp.build/Distribution-iphoneos/MyApp.build/MyApp.xcent /Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app

/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app: replacing existing signature
codesign_allocate: unknown architecture specification flag: -a armv6 5760
codesign_allocate: known architecture flags are: any little big ppc64 x86_64 ppc970-64 ppc i386 m68k hppa sparc m88k i860 veo ppc601 ppc603 ppc603e ppc603ev ppc604 ppc604e ppc750 ppc7400 ppc7450 ppc970 i486 i486SX pentium i586 pentpro i686 pentIIm3 pentIIm5 pentium4 m68030 m68040 hppa7100LC veo1 veo2 veo3 veo4
Usage: codesign_allocate -i input [-a <arch> <size>]... -o output
/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app: object file format invalid or unsuitable

So this could be my problem? Or is it just because I am trying to run it out of the xcode environment?

Where can I look to see if these errors are logged when they occur inside xcode?

[trapper]

Ok made some more 'progress'...

If i set the environment variable CODESIGN_ALLOCATE as follows then it take care of the errors

export CODESIGN_ALLOCATE=/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin/codesign_allocate

now I get no errors when signing manually but still a problem when I verifying the signing.

$ codesign -f -s "iPhone Distribution: My Name" --resource-rules=/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app/ResourceRules.plist --entitlements /Users/trapper/Desktop/MyApp/build/MyApp.build/Distribution-iphoneos/MyApp.build/MyApp.xcent /Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app
/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app: replacing existing signature

$ codesign -vvvv /Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app
/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app: a sealed resource is missing or invalid
/Users/trapper/Desktop/MyApp/build/Distribution-iphoneos/MyApp.app/CodeResources: resource modified

[trapper]

Originally Posted by Fnurglewitz

You need to do remove the "iPhone Developer: Your Name Here" line from the Target Info screen, do a Clean All Targets, put the "iPhone Developer: Your Name Here" back, and do a rebuild. In the Build Results screen you can see whether CodeSign has been called. If you don't remove the line and then put it back in, then CodeSign may not be called properly.

Yeah, I have done exactly this, mutiple times. The build results show exactly what should be there acording to the apple docs. - The mobileprovision bit and the codesign bit.

But the app still fails codesign verification. :/

[breeno]

I feel your pain, I went through this very thing during submission last night.

So much "tribal knowledge" shrouds this process, it surely needs some cleanup on Apple's side of things...

Sadly, I can't pin down for sure what specific bit of magic made the beast happy; but fwiw, here's my Rain Dance outlined:

1) When installing the provisioning profiles via dropping them onto XCode, it appears to install them via their internal UUIDs (presumably to avoid naming conflicts) to their home of ~/Library/MobileDevice/Provisioning Profiles. That seemed a bit fishy upon perusal of the build logs, as the file name is at times referenced, and the external name" is at times references, so ...

2) I blew away the profiles found here and copied afresh my 3 profiles (developer, ad-hoc and app store distribution) into the ~/Library/MobileDevice/Provisioning Profiles directory manually without dragging them onto XCode.

3) I re-downloaded the WWDR intermediate certificate (to sate paranoia) and the Agent's (sounds like you are in an individual program, so does not apply) private key via a p12 export.

4) I fired up XCode and set the active SDK to device and went into the target's Build configuration. From here I verified that the Code Signing Identity was "iPhone Distribution: <our company name>" and I could see then see the 2 provisioning profiles for Ad-hoc and App Store listed (by name, UUID nonsense was vanquished), and manually selected the App Store profile.

5) I did a ritualistic clean. Killed XCode. Fired it back up and built, and much rejoicing as the app passed codesign on the happy joy joy submit.

Now, if I could only get all this to happen repeatedly on our build server....

[jeff_lamarche]

I think most of us feel your pain. The code signing stuff is a nightmare. I've got a pretty solid handle on it now, having had to compiler over a dozen different projects in either Ad Hoc or Release modes.

Like Breeno, I haven't been able to identify one thing that causes or fixes the problems, either. Sometimes certain tricks work, other times they don't. Here are some things that might help sometimes:

Make sure that your mobile device provisioning certificates are NOT named after your UUID. Import them directly into the folder, or through iTunes, NOT through Xcode.

If Xcode can't find the right provisioning profile for your identity, set it to default, remove your identity (set field to blank, or just to "iPhone Developer"), then create a new iPhone project and immediately go into the Targets menu and set the code signing identity to "iPhone Developer: {your name}". Now try the provisioning drop down in this new project. If it works (seems to be about 75%), then you should be able to go back to the old project and select it.

If it doesn't find the provisioning profiles after that, try restarting Xcode and/or rebooting your machine.

If you're compiling for Release or Ad Hoc, make sure you have specified your "Code Signing Entitlement" to a property list in your Resources folder. That plist should have one node called "get-task-allow", which should be a Boolean set to NO (unchecked).

If all else fails, start from scratch, with new certs, provisioning profiles, etc.

It also helps if there's a full moon, and burning incense may or may not fix the problem. You may want to do the process in the nude while sitting in Lotus. It won't help, but it'll give a good laugh to anybody who walks in on you..

[trapper]

Originally Posted by jeff_lamarche

If you're compiling for Release or Ad Hoc, make sure you have specified your "Code Signing Entitlement" to a property list in your Resources folder. That plist should have one node called "get-task-allow", which should be a Boolean set to NO (unchecked).

Now this is an interesting one… When I made my ad-hoc distribution I did exactly this (as directed in Apple’s guide) but for app store distribution the guide says something like “skip this step and go to 12.” And that’s what I did.

So do I also need the Entitlements.plist for app store distribution builds after all??

[jeff_lamarche]

So do I also need the Entitlements.plist for app store distribution builds after all??

Sorry, no... my bad, the Entitlements.plist is only for ad hoc distribution.

[StatCoder]

Maybe one of the generous developers here has an old binary that has been known to work in the past and that they can email to you so that you can see if it will upload and then reject if it works. That way you can at least test your upload process to see if there isn't some kind of weird problem there. Does iTunes Connect associate the binary with the account?

I upload my binaries as compressed files and have found, despite what others have said around here, that it will reject a binary that doesn't have an "Icon.png" file. Now, I don't know if that needs to be the actual icon pointed to by "Info.plist" (I'll find out with the latest update submission), however, the upload process seems to check for this file.

[trapper]

Well I finally found my problem and it was *very* obscure. Count yourselves very lucky that you aren’t developing on a PPC processor like me!

[twin8885]

I am having the same problem, does anyone have any tips on how to fix it.

[tawpie]

No "solution", but recently (post 2.2?) I have an every-other-build error, and it is literally every other build. Build one, error. Simply click build one more time, all is fine.

My error results in a failed build, so the foobar condition is flagged and I don't have to wait until a failed upload:

Codesign bunch of path stuff*.app: object file format invalid or unsuitable
*/codesign failed with exit code 1

I've uninstalled, reinstalled, repaired permissions, deleted certificates, redownloaded certificates, made a new certificate, gone back to 2.1... still get an invalid format every other time. So I'm just clicking build twice because the show has to go on. It does this whether or not I'm building for device or distribution...

So all I know is what doesn't work for me... I'm still alive and able to continue, but it is another little worry in the back of the ole noggin.

[jeff_lamarche]

Clearly you either missed the rain dance or forgot to sacrifice a virgin.

Honestly, I have no idea why Code Signing is sofa king stupid. I can get it to work, but it always takes longer than it should, and never works the first time. It's gotten better, though, and it takes less futzing around to get a project's code signing working now, so I guess I can live with it, but I must say this Code Signing stuff is not up to Apple's typical standards...

[EeKay]

Hello all,

I wanted to submit my app in december but i can't get the signing part right. I want to submit ad-hoc first, and then (after testing) to the AppStore.

I tried signing on various ways (after reading all sorts of forums and threads) but i always keep ending up the error:

"The application [appname] was not installed on the iPhone because it could not be verified."

This is what i have setup right now, for ad-hoc distribution for testing:

1) i manually copied my developer-, ad hoc distribution- and appstore distribution provisioning files to the correct directory. the files contain the "get-task-allow" part and it is set to false.
2) my project contains a dist.plist file in which the get-tast-allow is disabled (false)

3) my ID is [the generated part].com.eekay.myappname. In the (Distribution) Target's properties tab i used com.eekay.${PRODUCT_NAME:identifier} as my identifier

4)For the code signing properties. i used for the project settings screen:
no profile
For the target screen i used the "iPhone Distribution:my name" provisioning
profile. (see the screenshots for my exact configuration).


any1 know if my settings show misconfigurations, or if there are things likely to be cached etc. as mentioned i cleaned up the profiles and copied them myself. previously i also tried dragging them on iTunes and/or Xcode but this results in the same error as always..

BTW i also found the embedded.mobileprovisioning in the app package, i have no compiler errors, and i see in the build log:

green checkmark Codesign /mydirs/myapp.app
(although the line in the docs shows all sorts of params etc which i dont see.. i just see the app path+name after "codesigning"..

Hope someone can help me with this as this is delaying my plans (my own business, etc)..

Thanks in advance

[EeKay]

i guess im gonna get me some beers, i tried the instructions word-by-word on iphone sdk mobile provisioning (0xe800003a, 0xe8000001, ...) as well.. over there i discovered i didnt have the ad hoc profile on my phone. retrying everything from start on (certificates etc) and this glitch aside didnt get things rolling as well..


im stucked and in deep depression... hope to hear from ya peeps!

[lajos]

I have written a longish post about fixing code signing issues:

iphone code signing troubles

Hopefully the suggestions there can fix your problem.

I know this is not in line with what the program portal says, but try deleting all settings at the target level and have them only at the project level.

Also, I would use a wildcard app id.

-lajos

[EeKay]

I viewed your post and i got it to work. I found that the Developer Portal instructions (deleting, clean, delete, restart and resetting the profile) worked for me. I also pinned down that adding the iTunesArtwork file in the already build .App package does lead to the same error.

So i added it into Xcode (on root level of project) and compiled the WHOLE package with signing. That DOES work.

Thanks for your assistance!

I uploaded my ap on the 7th of januari so i hope it will be ready for sale soon...

(More info on: EeKay Online » EeKay Online)

[LostInAustin]

First of all thanks for all of the free flowing information. Its ridiculous that we have to jump through hoops to get something relatively simple like this to work. But the community spirit definitely is making things a lot more tolerable

Anyways, I followed some of the suggestions on here, and was still having problems with not being able to build.

I was getting the ApplicationVerification issue stated above. The thing was, my provisioning profiles were fine.

I hand ported fresh downloads of the provisions over to the provision directory, I created a new project, copied my files over, and it still failed. The provisions always seemed fine.

1) I have not EVER EVER EVER seen the field for Code Signing Provisioning Profile field. EVER. I have no idea where it is. Oh well
2) I have been able to build previous projects without this field.

What did it for me (or I should say what I " believe" fixed it, like people have said, this is voodoo) was to
1.Get Target Info, Build Tab
2. Under Build Locations, I changed the Base SDK field to Device - iPhone OS 2.0 (from OS 2.2).

What this did (in addition to changing the base SDK) was create an entry under the Code Signing section - Code Signing Resource Rules Path.

This was blank under OS2.2. Under 2.0 it now says iphoneos2.0/ResourceRules.plist

The ResourceRules.plist file was also created in

/Developer/Platforms/iPhoneOS.platform/Developer/Library/Xcode/File Templates/Code Signing/Resource Rules.pbfiletemplate

The file contains very little, but I think it may help the Code Signing step point to Info.plist file properly:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>rules</key>
	<dict>
		<key>.*</key>
		<true/>
		<key>Info.plist</key>
		<dict>
			<key>omit</key>
			<true/>
			<key>weight</key>
			<real>10</real>
		</dict>
                <key>ResourceRules.plist</key>
		<dict>
			<key>omit</key>
			<true/>
			<key>weight</key>
			<real>11</real>
		</dict>
	</dict>
</dict>
</plist>

Like I said, I'm not sure if this is what did it for me, but it appeared to. Hopefully this helps at least one person

[cheetah]

Originally Posted by trapper

Well I finally found my problem and it was *very* obscure. Count yourselves very lucky that you aren’t developing on a PPC processor like me!

Would sure like to know what the obscure problem was. I continue to get "object format invalid or unsuitable". Am using PPC as well.

[sittsen]

Have a try on the suggested steps described in TechieChok | Resolving iPhone code signing error.