TestFlight Removes my Embedded Provisioning File

Dear Support,

I am trying to verify the installation of my macOS app via Test Flight. I have verified through code sign that it is properly signed and has all of the the required entitlements, including sandbox. The package uploaded successfully via Transporter, and the app installs with Test Flight.

However, the app will not run. After numerous attempts, I discovered that the embedded.provisionprofile is missing from the Contents of the app bundle in the version that installs via Test Flight. If I install directly from the same PKG I uploaded to Transporter (that TestFlight is using for the build) I can verify that the embedded.provisionprofile is present.

Why does uploading the PKG and installing through Test Flight result in the removal of the embedded provisioning file? Is this expected and/or could be another reason why my app is refusing to run?

Much appreciated,

~Ross

Answered by DTS Engineer in 812079022
Why does uploading the PKG and installing through Test Flight result in the removal of the embedded provisioning file?

Because App Store, and hence TestFlight, re-sign your app before distribution. Given that a provisioning profile is tied to your signing identity, the profile that you originally included won’t do any good because the app is now signed by Apple.

If you want to learn more about how this actually works, have a read of:

So how is a TestFlight-installed app ever supposed to run? Well, TestFlight is able to issues profiles for your app and install them on the system. These profiles are not embedded in your app, but rather stored elsewhere on the system [1].

Most problems like this are covered by one of the issues discussed in TestFlight, Provisioning Profiles, and the Mac App Store.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] We don’t document the location but last I checked you can see them with the profiles command-line tool. For example, you can list the installed provisioning profiles like so:

% profiles list -type=provisioning            
TTTTTTTTTT.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB[1] attribute: identifier: F6CB4571-7AC4-4941-B6CD-2CC3A3F9A817

Here TTT… is the Team ID and BBB… is the bundle ID and F6CB4571-7AC4-4941-B6CD-2CC3A3F9A817 is the profile’s UUID. You can pass the UUID to the show command to get a dump of the profile:

% profiles show -type=provisioning -uuid=F6CB4571-7AC4-4941-B6CD-2CC3A3F9A817 -output=result
% ls -l result.plist
-rw-r--r--  1 quinn  staff  1781 Feb  7 08:14 result.plist
Why does uploading the PKG and installing through Test Flight result in the removal of the embedded provisioning file?

Because App Store, and hence TestFlight, re-sign your app before distribution. Given that a provisioning profile is tied to your signing identity, the profile that you originally included won’t do any good because the app is now signed by Apple.

If you want to learn more about how this actually works, have a read of:

So how is a TestFlight-installed app ever supposed to run? Well, TestFlight is able to issues profiles for your app and install them on the system. These profiles are not embedded in your app, but rather stored elsewhere on the system [1].

Most problems like this are covered by one of the issues discussed in TestFlight, Provisioning Profiles, and the Mac App Store.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] We don’t document the location but last I checked you can see them with the profiles command-line tool. For example, you can list the installed provisioning profiles like so:

% profiles list -type=provisioning            
TTTTTTTTTT.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB[1] attribute: identifier: F6CB4571-7AC4-4941-B6CD-2CC3A3F9A817

Here TTT… is the Team ID and BBB… is the bundle ID and F6CB4571-7AC4-4941-B6CD-2CC3A3F9A817 is the profile’s UUID. You can pass the UUID to the show command to get a dump of the profile:

% profiles show -type=provisioning -uuid=F6CB4571-7AC4-4941-B6CD-2CC3A3F9A817 -output=result
% ls -l result.plist
-rw-r--r--  1 quinn  staff  1781 Feb  7 08:14 result.plist

Thank you so much for your response and confirming that the embedded.provisionprofile is indeed removed by Test Flight intentionally.

After further investigation, we were able to determine that the reason our app wasn't launching is because the other frameworks included in the bundle were being signed with the main executable's entitlements.

I had wrongly assumed Transporter would catch this during the upload and app analyzing process, but since the app code was signed correctly, this was allowed to pass through and still allow Test Flight to install (but not launch) the app. I've learned this lesson well and will keep this in mind for the future.

Much appreciated,

~Ross

TestFlight Removes my Embedded Provisioning File
 
 
Q