Bug 27384 - Distribution package has signing errors [Invalid 'com.apple.developer.aps-environment' entitlement value.]
Summary: Distribution package has signing errors [Invalid 'com.apple.developer.aps-env...
Alias: None
Product: Xamarin.Mac
Classification: Desktop
Component: mmp ()
Version: 1.12.0
Hardware: Macintosh Mac OS
: Normal normal
Target Milestone: ---
Assignee: Chris Hamons
Depends on:
Reported: 2015-02-24 20:18 UTC by Frank A. Krueger
Modified: 2015-03-01 16:49 UTC (History)
4 users (show)

Is this bug a regression?: ---
Last known good build:

Info.plist (4.29 KB, application/octet-stream)
2015-02-26 12:27 UTC, Frank A. Krueger
Entitlements (697 bytes, application/octet-stream)
2015-02-26 12:28 UTC, Frank A. Krueger
embedded provision (8.61 KB, application/octet-stream)
2015-02-26 12:29 UTC, Frank A. Krueger

Notice (2018-05-24): bugzilla.xamarin.com is now in read-only mode.

Please join us on Visual Studio Developer Community and in the Xamarin and Mono organizations on GitHub to continue tracking issues. Bugzilla will remain available for reference in read-only mode. We will continue to work on open Bugzilla bugs, copy them to the new locations as needed for follow-up, and add the new items under Related Links.

Our sincere thanks to everyone who has contributed on this bug tracker over the years. Thanks also for your understanding as we make these adjustments and improvements for the future.

Please create a new report on Developer Community or GitHub with your current version information, steps to reproduce, and relevant error messages or log files if you are hitting an issue that looks similar to this resolved bug and you do not yet see a matching new report.

Related Links:

Description Frank A. Krueger 2015-02-24 20:18:18 UTC
When trying to submit an update for an app, I get the following error from iTC:

Invalid 'com.apple.developer.aps-environment' entitlement value.

As far as I can tell my profiles and certs are all fine. I haven't changed my entitlements since the last time I updated the app.

I do not have this 'com.apple.developer.aps-environment' entitlement in my entitlements file so I assume it's something Xamarin.Mac is supposed to take care of for me.

Below is the update log:

[2015-02-24 17:12:27 PST] <main> DBG-X: Apple's web service operation return value:
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter ErrorMessage = ERROR ITMS-90283: "Invalid Provisioning Profile. The provisioning profile included in the bundle com.kruegersystems.circuitmac [com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app] is invalid. [Invalid 'com.apple.developer.aps-environment' entitlement value.] For more information, visit the Mac OS Developer Portal.
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter CPUToken = 248608d8-305f-4366-872e-ba602eccc3a6/1424826141897
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter FileSizes = {iCircuit-1.8.pkg=3881611}
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter AssetsToDescribe = [{UTI=com.apple.pkg, Role=source, ShouldDescribeAsset=true, Filename=iCircuit-1.8.pkg}]
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter Checksums = {iCircuit-1.8.pkg=5d2caae9c303ecec9296fde741d9ebaf}
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter ErrorCode = 1102
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter Success = false
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter Errors = [ERROR ITMS-90283: "Invalid Provisioning Profile. The provisioning profile included in the bundle com.kruegersystems.circuitmac [com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app] is invalid. [Invalid 'com.apple.developer.aps-environment' entitlement value.] For more information, visit the Mac OS Developer Portal."]
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter MinimumFileSizeThresholdForCheckum = 104857600
[2015-02-24 17:12:27 PST] <main> DBG-X:   parameter FilesToUpload = [metadata.xml, iCircuit-1.8.pkg]
[2015-02-24 17:12:27 PST] <main> ERROR: ERROR ITMS-90283: "Invalid Provisioning Profile. The provisioning profile included in the bundle com.kruegersystems.circuitmac [com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app] is invalid. [Invalid 'com.apple.developer.aps-environment' entitlement value.] For more information, visit the Mac OS Developer Portal."
[2015-02-24 17:12:27 PST] <main> DBG-X: The error code is: 1102
[2015-02-24 17:12:27 PST] <main>  INFO: Done performing authentication.
[2015-02-24 17:12:27 PST] <main> DBG-X: Returning 1

Package Summary:
1 package(s) were not uploaded because they had problems:
	/var/folders/db/4q6xfd4n68bg30j28vpc_c800000gn/T/94B0B2B6-5EE8-46DF-8557-D58AAEA8970F/454347770.itmsp - Error Messages:
		ERROR ITMS-90283: "Invalid Provisioning Profile. The provisioning profile included in the bundle com.kruegersystems.circuitmac [com.kruegersystems.circuitmac.pkg/Payload/iCircuit.app] is invalid. [Invalid 'com.apple.developer.aps-environment' entitlement value.] For more information, visit the Mac OS Developer Portal."

=== Xamarin Studio ===

Version 5.8 (build 426)
Installation UUID: e51e2705-c52a-4ae8-aa07-c481d6ab8a7a
	Mono 3.12.0 ((detached/b8f5055)
	GTK+ 2.24.23 (Raleigh theme)

	Package version: 312000077

=== Apple Developer Tools ===

Xcode 6.1.1 (6611)
Build 6A2008a

=== Xamarin.Mac ===

Version: (Enterprise Edition)

=== Xamarin.iOS ===

Version: (Enterprise Edition)
Hash: e573268
Build date: 2015-02-24 10:12:21-0500

=== Xamarin.Android ===

Version: (Enterprise Edition)
Android SDK: /Users/fak/Library/Developer/Xamarin/android-sdk-mac_x86
	Supported Android versions:
		2.1   (API level 7)
		2.2   (API level 8)
		2.3   (API level 10)
		3.1   (API level 12)
		4.0   (API level 14)
		4.0.3 (API level 15)
		4.4   (API level 19)
		5.0   (API level 21)
Java SDK: /usr
java version "1.7.0_51"
Java(TM) SE Runtime Environment (build 1.7.0_51-b13)
Java HotSpot(TM) 64-Bit Server VM (build 24.51-b03, mixed mode)

=== Xamarin Android Player ===

Version: Unknown version
Location: /Applications/Xamarin Android Player.app

=== Build Information ===

Release ID: 508000426
Git revision: f0ce187bab02866d18aad55f6326f88fd6bd5fca
Build date: 2015-02-24 13:56:29-05
Xamarin addins: 89cf292ae3cc83bcee31008e42826e9ebb8bbcea

=== Operating System ===

Mac OS X 10.10.2
Darwin lepton.local 14.1.0 Darwin Kernel Version 14.1.0
    Mon Dec 22 23:10:38 PST 2014
    root:xnu-2782.10.72~2/RELEASE_X86_64 x86_64
Comment 1 Chris Hamons 2015-02-25 08:51:50 UTC
- Is this a Unified project or a Classic project?
- Could you attach the file generated at ~/LibraryXamarin/Provisioning Profiles.plist to this bug. It contains enough information related to your signing keys / profiles to help use figure out what is going on.
- Did this work with XM 1.10?
Comment 2 Frank A. Krueger 2015-02-25 13:22:36 UTC
This is a Unified app that works just fine if I build and sign with developer profiles (entitlements work, I can access iCloud).

I have been building this app for 4 years now - yeah it worked with 1.10 - but I can't test that it still does because of API breaks.

That directory doesn't exist and I can't find that file anywhere in ~/Library
Comment 3 Chris Hamons 2015-02-25 14:45:09 UTC
Hey Frank,

We need some additional information from you to help sort this out. I think the following may be helpful in diagnosing the issue:

- What are your code signing settings in Project Options -> Mac Signing?
- A full build log of your build (Errors Pad -> Build Output).
- A copy of the provisioning profile it selected (a file in ~/Library/MobileDevice/Provisioning\ Profiles/ matching the guid in question).
- If you could attach your Info.plist and entitlements.plist as well.

We made a lot of code signing changes in XM 1.12 because code signing in XM 1.10 was very raw for Unified projects in general. It works much closer and shares a lot of code with iOS. That's part of the reason for the behavior changes you may be seeing.
Comment 4 Chris Hamons 2015-02-25 14:51:39 UTC
Two more things I forgot:

- Inside your app bundle should be a  "embedded.provisionprofile" that would also work (and should be the same provisioning profile).

- If you are blocked by a bug like this, feel free to contact support.xamarin.com instead of / in addition to filing a raw bug. We happened to notice this and remember your priority license, but mistakes happen and bugs can be filed under the "general bugs to fix as we have time". Creating a desk case with support ensures you get the priority you deserve in the future (they will poke me directly).
Comment 5 Frank A. Krueger 2015-02-26 12:26:49 UTC
Here are my settings. I will attach the other files momentarily.

  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Distribution|AnyCPU' ">
    <DefineConstants>SILVERLIGHT MONOMAC</DefineConstants>
    <PackageSigningKey>3rd Party Mac Developer Installer: Krueger Systems, Inc. (WNF26QR38H)</PackageSigningKey>
    <CodeSigningKey>3rd Party Mac Developer Application</CodeSigningKey>
Comment 6 Frank A. Krueger 2015-02-26 12:27:55 UTC
Created attachment 10057 [details]
Comment 7 Frank A. Krueger 2015-02-26 12:28:15 UTC
Created attachment 10058 [details]
Comment 8 Frank A. Krueger 2015-02-26 12:29:08 UTC
Created attachment 10059 [details]
embedded provision
Comment 9 Jeffrey Stedfast 2015-02-26 16:29:02 UTC
I'm not sure if this 100% of the problem or not, but at least part of the problem you are hitting is that the build system whitelisted "aps-environment" (which is the key iOS uses) but not "com.apple.developer.aps-environment" (which is the key that Mac OS X uses).

This means that the build system was not merging the following key/value pair from the Provisioning Profile's list of Entitlements:


Chris is making a new build with this fix and will post a link for you to test out.

You could also work around this bug by adding that key/value to your Entitlements.plist file (which overrides the build system's logic for filtering keys).
Comment 10 Chris Hamons 2015-02-26 16:44:56 UTC
Here is the build Jeff was talking about:


Could you please install it, restart XS (if open) and build your project again. Please attach the full build log if you still have having issues with it.
Comment 11 Frank A. Krueger 2015-02-27 11:23:42 UTC
Let me be clear, you want me to build with this and do what? Submit to Apple?
Comment 12 Frank A. Krueger 2015-02-27 11:57:46 UTC
I guess I'm asking in what ways is this build different from the one I've been testing?

I need to know whether I need to do a full test pass to check if anything else is broken or if this was a precision change to just the signing code.
Comment 13 Jeffrey Stedfast 2015-02-27 14:59:45 UTC
It's just a precision change to the entitlements merging logic and added logging in the MSBuild DetectSigningIdentity code.

I actually just fixed the MSBuild DetectSigningIdentity task to properly detect signing keys, so if you had a problem with that, I should have a fixed build shortly.
Comment 14 Jeffrey Stedfast 2015-02-27 15:53:00 UTC
Okay, this build fixes the com.apple.developer.aps-environment issue as well as a bug in the DetectSigningIdentity task that was causing errors such as "No Mac OS X code signing keys match..."


This build is identical to except for these 2 fixes in the MSBuild logic.
Comment 15 Frank A. Krueger 2015-03-01 16:49:00 UTC
Thank you for the quick response Jeffrey! I will try submitting tomorrow morning.