4

I use a continuous integration tool that builds an app using a Distribution identity and an Ad Hoc mobile provision. This app is sent on a web site for ad-hoc deployment and everything works well.

But now I would like to add a step in my build workflow to execute UI Automation tests. Instruments needs an app signed with a Developer identity, so instead of building a new version of the app signed with a developer certificate, I want/need (Q.A. team wants actually) to resign the previous created .ipa with developer certificates. I use the following commands to resign the app : 

unzip "App.ipa"
rm -rf "Payload/App.app/_CodeSignature" "Payload/App.app/CodeResources"
cp "Dev.mobileprovision" "Payload/App.app/embedded.mobileprovision"
/usr/bin/codesign -f -s "iPhone Developer: john doe" --resource-rules "Payload/App.app/ResourceRules.plist" "Payload/App.app"

Then I use fruitstrap to install the "Payload/App.app" (I tried to just install using the organizer it does not change anything), and I finally execute Instruments like this : 

instruments -w 5f9...3fd -t /Applications/Xcode.app/Contents/Applications/Instruments.app/Contents/PlugIns/AutomationInstrument.bundle/Contents/Resources/Automation.tracetemplate "App" -e UIASCRIPT /Users/../automation-tests-scripts/test-instruments.js -e UIARESULTSPATH /Users/../test-reports/

Instruments fail with the following error : 

2013-11-28 14:32:56.679 instruments[68408:1007] Permission to debug com.company.App was denied.  The app must be signed with a development identity (e.g. iOS Developer).
2013-11-28 14:32:56.681 instruments[68408:1007] Recording cancelled : At least one target failed to launch; aborting run
Instruments Trace Error : Error Domain=com.apple.instruments Code=1 "Error Starting Recording" UserInfo=0x7fb15b290560 {NSLocalizedDescription=Error Starting Recording, NSLocalizedRecoverySuggestion=At least one target failed to launch; aborting run}
Instruments Trace Error : Failed to start trace.

These commands works on iOS devices running on iOS 6.x but fails with the previous error on iOS 7.x only (I tried 2 iOS 6.x devices, iPhone 4S and 5, and also I tried with 4 devices running iOS 7.x). So the problem is related to iOS 7.

If the application is built directly with the Developer identity it works well, so i guess that something failed in the signing phase. I Also did a codesign -d -vvv on the resigned app and it shows this output 

Executable=/Users/.../App.app/App Identifier=com.company.App
Format=bundle with Mach-O universal (armv7 armv7s) 
CodeDirectory v=20100 size=8547 flags=0x0(none) hashes=420+3 location=embedded 
Hash type=sha1 size=20 CDHash=f00fac8eabf174e88042f2b875505a6cacdd6b0a
Signature size=4326 
Authority=iPhone Developer: john doe (BXX559V2VW)
Authority=Apple Worldwide Developer Relations Certification Authority
Authority=Apple Root CA 
Signed Time=28 nov. 2013 11:56:04
Info.plist entries=27
Sealed Resources version=2 rules=5 files=290
Internal requirements count=2 size=708

I looked at Xcode signing process and it exports a "CODESIGN_ALLOCATE" variable, I tried that and I did not get more success.

PS: I read somewhere about the "iOS Developer" that could have replaced "iPhone Developer" in certificates titles, but I did not find more information about this.

LiohAu
  • 611
  • 12
  • 36

2 Answers2

3

If you want to adapt your original entitlements you can do this.

Grab the original distribution entitlements: 

/usr/libexec/PlistBuddy -x -c "print :Entitlements " /dev/stdin <<< $(security cms -D -i production.app/embedded.mobileprovision) > entitlements.plist

Turn them into Development entitlements with 

/usr/libexec/PlistBuddy -c 'Set :get-task-allow true' entitlements.plist

and update any other entitlements that can differ, e.g. push notifications 

/usr/libexec/PlistBuddy -c'Set :aps-environment development' entitlements.plist

p.s. no need to remove _CodeSignature, codesign -f will replace it for you.

Rhythmic Fistman
  • 34,352
  • 5
  • 87
  • 159
  • Well thanks for those informations. But now I don't know if I should mark my answer as correct or yours since they are both a part of the answer ^^ – LiohAu Nov 29 '13 at 09:44
  • Thanks for this solution! I was running in circles trying to figure out why Instruments was warning me my app needed to be signed with a development identity when everything was agreeing that it was. I had to update my resigning script to set the get-task-allow to true when signing as a development build. – Seth Mar 26 '14 at 19:25
1

I finally found the problem, When a developer identity is used during a build, Xcode embed an Entitlements.plist file that contains a get-task-allow => true, when the identity is distribution, this get-task-allow is set to false. When the "distribution" app was "resigned", I was not passing a --entitlements option to codesign, so the app was still not a valid "developer" app for instruments.

Adding an Entitlements.plist file with a get-task-allow set to true in my project and referencing it in my Distribution configuration solved the problem, now when the app is built it contains get-task-allow => true, and when it is resigned, I pass this same Entitlements.plist to the codesign option.

It works for now, I hope that the other keys added by Xcode to the Entitlements file won't miss (since the one I'm using in my codesign command call only contains the get-task-allow key).

LiohAu
  • 611
  • 12
  • 36
  • Where does this entitlements.plist file located?, how could i edit it? – Mehul Thakkar Feb 10 '14 at 04:53
  • Xcode creates it for you (during compilation) unless you create it yourself and add it to your xcode project – LiohAu Feb 10 '14 at 08:16
  • I got that Xcode will create it, but where does it create?, i mean where does i find it? – Mehul Thakkar Feb 10 '14 at 08:32
  • In Xcode look at the build messages, there are a lot of "Compile" lines, and at the end there should be 2 ProcessProductPackaging, one for the .mobileprovision file and the 2nd for the entitlements. If you open the details of the logs, you'll have the full paths to the entitlements file (by the way, xcode use a .xcent extension for the entitlements). – LiohAu Mar 27 '14 at 08:29
  • I guess you finally decided! – Rhythmic Fistman Dec 12 '16 at 11:15
  • as we said in my country : "mieux vaut tard que jamais" :P – LiohAu Dec 12 '16 at 13:56