App Groups Xcode 10 Missing entitlement

Hi -


I have an .appex that when running in release mode doesn't work since it's relying on app groups to convey important state from the containing app. All works fine in debug mode.


I surmise that the cause has to do with my app-group entitlements for release but not debug builds. I have followed this carefully: https://help.apple.com/xcode/mac/current/#/dev298d7b2cb. And find that:


1. codesign -d -entitlements <path-to-debugbuild>/my.app shows

<dict>

<key>application-identifier</key>

<string>XXXX.com.mycorp.myapp</string>

<key>aps-environment</key>

<string>development</string>

<key>com.apple.developer.team-identifier</key>

<string>XXXX</string>

<key>com.apple.security.application-groups</key>

<array>

<string>group.com.mycorp.myapp</string>

</array>

<key>get-task-allow</key>

<true/>

</dict>


2. where if i unzip a signed/release/buggy app.ipa and issue the same codesign command, i get this:


<dict>

<key>application-identifier</key>

<string>XXXX.com.mycorp.myapp</string>

<key>aps-environment</key>

<string>production</string>

<key>com.apple.developer.team-identifier</key>

<string>XXXX</string>

<key>get-task-allow</key>

<false/>

</dict>


ie: no security.application-groups.


Even more mysteriously, inspection of the <Entitlements> portion of both embedded.mobileprovision files seems to suggest

that all is well.


Can anyone please help? I've recently upgraded to xcode 10 and haven't had such problems with older versions of xcode.


thanks in advance!

Replies

I'll answer my own question for potential help to others.

It appears that in recent generations of XCode (10 for certain), the editing of capabilities results in edits to a file "Entitlements-Debug.plist". Unfortunately, this doesn't update the file "Entitlements-Release.plist" and so it's possible to get a different set of entitlements for Release and Debug builds. The good news is that these Entitlement files can be manually edited which is how I solved my problem.