25.6 · Reading profiles and signatures, signing order and API keys

Signing errors are usually solved by looking at the file instead of guessing: decode the profile, read the signature, sign in the right order and know what each credential can do.

Mental model. A profile is a signed plist, a signature is a seal plus a rule (the designated requirement), and CI authenticates with a short-lived token made from a long-lived key.

Profiles and signatures

Reading what is inside the files the system verifies.

  1. How do you decode and audit a provisioning profile: which fields matter, how do you tell development, ad hoc and App Store profiles apart, and does decoding verify it? 25.6.1 · L3
    A .mobileprovision is a CMS (PKCS#7) envelope around an XML property list. security cms -D -i file.mobileprovision prints the plist, and plutil -extract or…
  2. What is inside a code signature: the code directory, hashes, the designated requirement and the team ID, and how do you read and test them with codesign? 25.6.2 · L5
    A signature is a code directory plus optional blobs. The code directory lists a hash of every page of the executable and of each special slot (the Info.plist…

Order and automation

Signing nested code, and calling the App Store Connect API from CI.

  1. Why must nested code be signed before the code that contains it, what does “nested code is modified or invalid” mean, and why is --deep discouraged for releases? 25.6.3 · L3
    A bundle’s signature seals hashes of everything inside it, including the signatures of nested frameworks, extensions, helpers and the watch app. Signing is…
  2. How does a CI job authenticate to the App Store Connect API: API keys, the JWT claims, the signing algorithm, expiry, roles and rotation? 25.6.4 · L3
    You create an API key in App Store Connect (an issuer ID, a key ID and a one-time-download .p8 private key, with a role such as App Manager or Developer that…

More in App Store & release engineering