I was wondering that as well, so I checked out apple/swift-package-manager and debugged a little. It seems to me in the common case, originHash is little more than a SHA-256 checksum of your own Package.swift file; see for yourself by comparing it to the output of shasum -a 256 Package.swift. In case you depend on other local packages (.package(path:)), then the checksum is taken to include their package file contents as well. (See source code for 5.10 here.) It looks like swift package resolve (which AFAICT is roughly what Xcode also tells SwiftPM to do) doesn't normally touch your Package.resolved file if it exists. Weirdly, the command doesn't seem to care (!) whether your originHash actually matches, as can be tested by editing the pin file in a text editor and re-running the command. But if the pin file goes missing[^1] before resolving dependencies, then that forces SwiftPM to spit out a Package.resolved JSON with a newly computed originHash. So if you're lucky and no dependencies got downgraded in the process, it may as well be that the updated originHash is actually correct after all! [^1]: Because that's what Xcode apparently does sometimes when switching git branches.

Same here. Especially when manually releasing to all or with phased rollout, there is no earliestReleaseDate to be found. Phased releases have a startDate which can be used as a workaround, but in case releasing to all users at once, there is no way to access the release date via App Store Connect API, as far I can see. I would expect all released, regardless of release method, to have an earliestReleaseDate. And in case of phased releases, the startDate should simply match that. Filed FB13617347 just now.

We are also constantly seeing this bug in our app in the wild in iOS versions up to 15.5, but haven't been able to reproduce it reliably. Reported as https://feedbackassistant.apple.com/feedback/10875485.

I think this piece of documentation should answer your question: https://help.apple.com/developer-account/#/dev8e84490b9 You can also filter the certificates list by changing the "All Types" dropdown to "Cloud managed".