We're hitting a submission deadlock with a Capacitor-based iOS app that I suspect will affect any app using Capacitor/Cordova (or similar frameworks distributed as prebuilt binaries) once Xcode 27 ships.
Setup: App built with the current Xcode, targeting the current SDK. Embeds Capacitor.framework and Cordova.framework (via ionic-team/capacitor-swift-pm).
The loop:
- Using Ionic's latest official release: these prebuilt frameworks are still built against an older Xcode/iOS SDK. App Store Connect rejects the upload with ITMS-90111 (stale SDK), even though the app's own target and every other embedded framework are current.
- To fix that, we rebuilt Capacitor.framework/Cordova.framework from Capacitor's open-source iOS source (MIT-licensed, same version as the official release) using the current Xcode — confirmed via archive that every framework now reports the current SDK.
- That upload is then rejected with ITMS-91065 (missing signature) — the rebuilt frameworks lack an Apple SDK signature that (as far as we can tell) only Ionic's own build pipeline can produce.
So: official release → current-SDK check fails. Self-rebuilt release → signature check fails. We verified this isn't a fluke with an isolated throwaway-archive test swapping only the framework source.
Questions for anyone who's solved this:
- Is ITMS-91065's "Apple SDK signature" requirement satisfiable by re-signing a self-built .framework with our own Distribution certificate during export, or does it specifically require Apple's own build-time signature that third parties can't reproduce?
- Has anyone shipped a Capacitor/Cordova app successfully against a new major Xcode/SDK before Ionic cut a matching signed release? If so, how?
Also filed with Ionic: ionic-team/capacitor#8537 (https://github.com/ionic-team/capacitor/issues/8537) — no response yet as of 2026-07-23.