Unable to successfully sign Mac Catalyst app with Xcode

I've been trying to solve this problem off and on for multiple weeks now to no avail. I even have a DTS open with Apple but so far they haven't been able to help me.

Essentially, I am creating a Mac Catalyst version of an existing iOS app, and I want to use the same bundle ID to have the in-app purchases be cross-platform (now that that's a thing).

I can build and run locally without issue, and it archives just fine. However, there's some sort of signing issue that prevents it from uploading successfully. I have tried both automatic and manual signing.

I get the following error when trying to upload:

App Store Connect Operation Error: ERROR ITMS-90283: "Invalid Provisioning Profile. The provisioning profile included in the bundle org.cocoapods.gRPCCertificates-Cpp [<Bundle Id>.pkg/Payload/<App Name>.app/Contents/Resources/gRPCCertificates-Cpp.bundle] is invalid. [Invalid 'com.apple.application-identifier' entitlement value.] For more information, visit the macOS Developer Portal.

The initial advice was to not sign the gRPCCertificates-Cpp bundle, which does not help.

It's also strange that I have another catalyst app that uses the same bundle and it works just fine, so I think it's less an issue with that bundle and more how Xcode handles entitlements and signing. Though I'm open to all suggestions.

One possible difference between the app that works fine and the problematic one is that the problematic one uses an explicit App ID Prefix and the other has a Team ID prefix.

Another potential clue, I need to enabled Associated Domains, Autofill Credential Provider, Sign In with Apple and iCloud Key Value Storage entitlements for my app to function correctly. However, if I remove all of those and retain only In-App Purchase, Hardened Runtime, and App Sandbox entitlements the app does sign and upload successfully to the App Store.

So I'm thinking the issue must have something to do with these entitlements or how Xcode handles them compared to the others.

Does anyone have any ideas on what else I could try?

Replies

Getting the same error. When clicking on the info icon near the Provisioning Profile under Signing & Capabilities, App ID: (null) is displayed. But also says it matches the bundle id.

So, not sure what is the issue here? Found any solutions?
I have the exact same issue, and have been unable to upload a new App version since June. After much work, this is my latest reply to DTS:



I've pretty much confirmed it's the iCloud entitlement that is the root cause of the problem. I have absolutely no idea how to fix it.

You may recall I wiped my MacBook Pro's disk and did a fresh install of Catalina. I copied my unmodified *** workspace over and, as always, the *** App upload failed. I then simply deleted the iCloud entitlement and the upload works. Image 1) show the entitlements file diff, with the original in the right pane, and 2) shows a successful upload.

So maybe the issue is:
  • Mac Catalyst App

  • iCloud entitlement ( fails even without kvstore checked )

  • old fashioned App prefix which does not match Team ID

I too have no idea how to proceed, but the key is an App prefix that is not the same as the Team ID. This App is from a project created 11 years ago.

I wasn't particularly clear in my previous reply, here is the important fact:

but the key is an App prefix that is not the same as the Team ID

If the App prefix matches the Team ID then no entitlement (apparently) prohibits a MacCat App from uploading to Connect. However, Apps with a non-matching App prefix / Team ID will not upload when certain entitlements are present - I know iCloud is one such entitlement, and now it appears that there are others.

And this is a relatively recent change, because prior to the June-ish timeframe this scenario worked - perhaps the recent App Connect upgrade is the cause?