Bundle Identifier and push certificate… aps-environment entitlement error

Question

I\'ve read Where does xcode take application's Identifier from? , XCode bundle identifier formatting from {PRODUCT_NAME} , and loads more but...

I\'m trying to g

Answer 1

Setup:

Mac OS X 10.8 + Xcode 4.4

My Simple Solution:

1. Reissue your ad hoc provisioning profile after you have setup push notifications for your app ID and import them to Xcode.
2. Take a look into your .xcodeproj folder (right click -> Show Package Contents) and delete the xcuserdata folder.
3. That's it ;)

Some hints on that issue:

After activating Push Notifications for my app I suddenly couldn't create ad hoc files anymore. I ran across errors in my Console log on my iPhone while trying to install my app such as those:

Apr  1 20:56:10 unknown installd[384] <Error>: entitlement 'keychain-access-groups' has value not permitted by a provisioning profile
Apr  1 20:56:10 unknown installd[384] <Error>: entitlement 'get-task-allow' has value not permitted by a provisioning profile
Apr  1 20:56:10 unknown installd[384] <Error>: entitlement 'application-identifier' has value not permitted by a provisioning profile
Apr  1 20:56:10 unknown installd[384] <Error>: 2ff66000 verify_signer_identity: Could not copy validate signature: -402620394
Apr  1 20:56:11 unknown installd[384] <Error>: 2ff66000 preflight_application_install: Could not verify executable at /var/tmp/install_staging.44jV0O/foo_extracted/Payload/PersonalTrainer-Tester-iPhone.app
Apr  1 20:56:11 unknown com.apple.itunesstored[392] <Notice>: MobileInstallationInstall: failed with -1
Apr  1 20:56:11 unknown installd[384] <Error>: 2ff66000 install_application: Could not preflight application install
Apr  1 20:56:11 unknown installd[384] <Error>: 2ff66000 handle_install: API failed
Apr  1 20:56:11 unknown installd[384] <Error>: 2ff66000 send_message: failed to send mach message of 71 bytes: 10000003
Apr  1 20:56:11 unknown installd[384] <Error>: 2ff66000 send_error: Could not send error response to client

There is some technical note which recommends using codesign -d --entitlements - <YourAppName>.app to check if your app is signed properly for Apple Push Notifications. In case the output of the codesign command does not have an aps-environment set to production or development there is something fishy!

As far as I knew so far, my apps signed with an adhoc provisioning profile always have an embedded.mobileprovision inside the <YourAppName>.app folder with a specific part in them such as:

<key>Entitlements</key>
<dict>
    <key>application-identifier</key>
    <string>ABCDEFGH.com.myappname.tester</string>
    <key>aps-environment</key>
    <string>production</string>
    <key>get-task-allow</key>
    <false/>
    <key>keychain-access-groups</key>
    <array>
        <string>ABCDEFGH.*</string>
    </array>
</dict>

After using codesign I realized that the actual binary in <YourAppName>.app had some XML included as well, which said something very different than my embedded.mobileprovision file:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>application-identifier</key>
    <string>ABCDEFGH.com.myappname.tester</string>
    <key>get-task-allow</key>
    <true/>
    <key>keychain-access-groups</key>
    <array>
        <string>ABCDEFGH.com.myappname.tester</string>
    </array>
</dict>
</plist>

I assume this is the cause for the error message we are all experiencing. (although this error can have some different roots as well as other posts on stackoverflow suggest)

The executable was signed with invalid entitlements.
The entitlements specified in your application's Code Signing Entitlements
file do not match those specified in your provisioning profile. (0xE8008016).

My guess is that there is some bug in Xcode which keeps the settings in your plist from being updated in you schemes which then causes your app to be signed with the wrong provisioning profile in the end. So by deleting the xcuserdata folder you delete all schemes. Therefore Xcode will recreate them next time with the proper settings and you are happy again.

Answer 2

For me it worked after changing the bundle identifier to something random. Making sure that the signing error indeed shows up (remove all provision profiles from organizer and device and do a clean build CMD + OPT + SHFT + K then CMS + SHFT + K and then CMD + R) and then changing the bundle identifier back to appropriate one.

Answer 3

My problem was this. I created app that had configured push notifications, and in app delegate I was registering for push notifications with:

[[UIApplication sharedApplication] registerForRemoteNotificationTypes:(UIRemoteNotificationTypeAlert | UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeSound)];

But before releasing app I had to create new provisioning profile on other developer portal. I created new App Id, new provisioning for development and distribution, downloaded new provisioning, in application target I've set correct provisioning. Also I changed bundle identifier. But I was getting that error.

Problem was that new AppId was not configured for push notifications, but calling

[[UIApplication sharedApplication] registerForRemoteNotificationTypes:(UIRemoteNotificationTypeAlert | UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeSound)];

was creating error. When I configured push notifications error did not show again.

Answer 4

the solution for 10.8 Xcode 4.4 is to open the appname.entitlements file

and if the DataProtectionClass key has the value NSFileProtectionComplete, delete it!

Deleting this key allows me to test apps from Xcode on devices (it wasn't affecting simulation).

Answer 5

I had the same problem. For me the fix was like this:

1. Removed and reloaded the provisioning profiles from the organizer.
2. Selected my named provisioning profile under project settings->code signing. Somehow it wanted to use the blabla.* identity.

The wildcard profile ([prefix].*) won't do when your trying to run a APN enabled application, you need to specify the APN enabled profile.

Answer 6

In my case, the solution for this error turned out to be simple after hours of tinkering with certificates...

In the Capabilities tab of the project configuration, I had to enable the Push Notification flag in order for the environment files to be generated.

macOS Sierra 10.12 - Xcode 8.1