xcodebuild archive fails ITMS validation

Question

Our app has a watchkit app + extension. Archives from XCode IDE always pass iTunes store validation. However archives generated via xcodebuild command tools (Xcode 6.4; Build version 6E35b) fail this validation with the following errors:

ERROR ITMS-90163: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'aps-environment' in 'Payload/TheDodo.app/PlugIns/DodoExtension.appex/DodoExtension'."

ERROR ITMS-90164: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. According to the provisioning profile, the bundle contains a key value that is not allowed: '##########.###.##########.######' for the key 'application-identifier' in 'Payload/TheDodo.app/PlugIns/TheDodoWatchKitExtension.appex/TheDodoWatchKitExtension'"

ERROR ITMS-90163: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'aps-environment' in 'Payload/TheDodo.app/PlugIns/TheDodoWatchKitExtension.appex/TheDodoWatchKitExtension'."

ERROR ITMS-90046: "Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, value '##########.###.##########.######' for key 'application-identifier' in 'Payload/TheDodo.app/PlugIns/TheDodoWatchKitExtension.appex/TheDodoWatchKitExtension' is not supported. This value should be a string starting with your TEAMID, followed by a dot '.', followed by the bundle identifier."

ERROR ITMS-90163: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'aps-environment' in 'Payload/TheDodo.app/PlugIns/TheDodoWatchKitExtension.appex/TheDodoWatchKitApp.app/TheDodoWatchKitApp'."

ERROR ITMS-90163: "Invalid Code Signing Entitlements. The entitlements in your app bundle signature do not match the ones that are contained in the provisioning profile. The bundle contains a key that is not included in the provisioning profile: 'com.apple.security.application-groups' in 'Payload/TheDodo.app/PlugIns/TheDodoWatchKitExtension.appex/TheDodoWatchKitApp.app/TheDodoWatchKitApp'."

The Makefile to archive and export looks something like this:

/usr/bin/xcodebuild -verbose -verbose -workspace 'rebelmouse.xcworkspace'  -scheme TheDodo -configuration "App Store" -sdk 'iphoneos' -archivePath /tmp/TheDodo.xcarchive -derivedDataPath /tmp/ROJECT.Ji9vwyH0 APPLICATION_BUILD_VERSION=2456 archive

/usr/bin/xcodebuild -exportArchive -exportFormat ipa -archivePath /tmp/TheDodo.xcarchive -exportPath /tmp/TheDodo.ipa -exportWithOriginalSigningIdentity

Any suggestion / help is very appreciated. Thanks in advance.

Answer 1

Answering this in case anyone else is stuck in the same boat.

With Xcode 7.0 the xcodebuild acquired a new command line option to export archive namely the exportOptionsPlist , this takes a full path to a plist that configures the archive.

You no longer need to set the -exportFormat

xcodebuild --help lists the details of the plist.

For enterprise builds I use this plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>method</key>
    <string>enterprise</string>
</dict>
</plist>

For App Store builds replace replace enterprise with app-store.

Answer 2

tell xcodebuild the name of the provisioning profile to use instead of having it 'auto-search' it:

 xcodebuild -exportArchive -exportFormat ipa -archivePath "FOLD/FILE.xcarchive" -exportPath "FOLD/FILE.ipa" -exportProvisioningProfile "NAME" > /dev/null || exit 1