What's the correct archive method for an .ipa / Google Workspace MDM private iOS app? app cannot be installed, integrity could not be verified

I don't expect many people around here are using Google Workspace MDM to distribute private iOS apps, but maybe somebody will see this or can help anyway. Unfortunately, this forum won't let me link to their docs(!) but a web search for "google workspace private iOS apps" should explain.

The long and short of it is that we need to build and upload an .ipa file. I'm struggling with the options around provisioning profiles and XCode archives. I found that the Distribute App Adhoc option outputs an .ipa but then the users get "the app cannot be installed because its integrity could not be verified".

I think Adhoc is meant to be just for a subset of devices which are explicitly ticked in the provisioning profile. This won't work for us, we want to install on tens of user devices which are unknown to our Apple Developer account.

But the other Distribute App options don't seem relevant. Do I even need to do a Distribute App? It's the only way I could find to get the .ipa. I read online that the .xcarchive can be dragged to iTunes but I don't get that and the Mac doesn't have iTunes.

Grateful for any help, we're so close but not quite...

Replies

Bumping as we're still struggling with this even without using the Ad Hoc option. We now have Xcode 13, and we can build and upload to Test Flight successfully, and clicking Export... on the dialog produces the .ipa with not issues. When I upload it to Google Workspace MDM and users try to install it from the Google Device Policy app, the app downloads to the device but then stops on start with "the app cannot be installed because its integrity could not be verified". For what it's worth, we use automatic provisioning in Xcode.