-allowProvisioningUpdates doesn't work

Question

We are using Jenkins for Continiuous Integration. Everything we need to do in order to compile our app is done via commandline (bash script), because we have several machines where the build has be done without any human access to the devices.

As you can imagine I was very happy to see the new xcodebuild feature flag -allowProvisioningUpdates in XCode9.

I understand, that I need to add the credentials of our Apple ID into the XCode settings.

The credentials are adde to the XCode account tab in Preferences, but when I try to compile using "xcodebuild ... -allowProvisioningUpdates" the following error message appears:

 2017-09-19 09:47:59.692 xcodebuild[74979:3824315]  DVTAssertions: Warning in /Library/Caches/com.apple.xbs/Sources/DVTFrameworks/DVTFrameworks-13231/DVTFoundation/Portal/DVTDeveloperAccountCredentialsManager.m:38  
Details:  Unable to find default keychain.  
Object:   <DVTDeveloperAccountCredentialsManager>  
Method:   +defaultAccountCredentialsManager  
Thread:   <NSThread: 0x7fe17860aa40>{number = 4, name = (null)}  
Please file a bug at http:/  
2017-09-19 09:47:59.792 xcodebuild[74979:3824308] [MT] IDEDistribution: Step failed: <IDEDistributionSigningAssetsStep: 0x7fe17d45cf20>: Error Domain=IDEDistributionSigningAssetStepErrorDomain Code=0 "Locating signing assets failed." UserInfo={NSLocalizedDescription=Locating signing assets failed., IDEDistributionSigningAssetStepUnderlyingErrors=(  
    "Error Domain=DVTServicesSessionErrorDomain Code=0 \"Unable to log in with account '[email protected]'.\" UserInfo={NSLocalizedFailureReason=Unable to log in with account '[email protected]'., NSLocalizedRecoverySuggestion=The login details for account '[email protected]' were rejected., DVTDeveloperAccountErrorAccount=<DVTAppleIDBasedDeveloperAccount 0x7fe179b016c0: username: [email protected]>, NSUnderlyingError=0x7fe179e8ee60 {Error Domain=DVTDeveloperAccountErrorDomain Code=4 \"[email protected] could not sign in.\" UserInfo={NSLocalizedRecoverySuggestion=Cannot sign in to this account. Try signing into it again in the Accounts preference pane., [email protected] could not sign in., DVTDeveloperAccountErrorAccount=<DVTAppleIDBasedDeveloperAccount 0x7fe179b016c0: username: [email protected]>}}}",  
    "Error Domain=IDEProfileLocatorErrorDomain Code=1 \"No profiles for 'com.yyy.CITestProject' were found\" UserInfo={NSLocalizedDescription=No profiles for 'com.yyy.CITestProject' were found, NSLocalizedRecoverySuggestion=Xcode couldn't find any iOS App Store provisioning profiles matching 'com.yyy.CITestProject'.}"  
)}  
error: exportArchive: The operation couldn’t be completed. Unable to log in with account '[email protected]'.

Does someone know how to fix this problem?

update: We use this plugin to start ssh sessions to our Jenkins slaves in order to do the buildjob: https://wiki.jenkins.io/display/JENKINS/SSH+Slaves+plugin

Answer 1

I have the same problem. I reported the bug to Apple, to no avail. To move forward with Xcode 9, I switched to manual signing for Jenkins only. (Developers still use automatic signing.)

/usr/bin/xcodebuild -exportArchive \
    DEVELOPMENT_TEAM=*your-dev-team-id* \
    CODE_SIGN_STYLE=Manual \
    CODE_SIGN_IDENTITY="iPhone Distribution: *your cert*" \
    PROVISION_PROFILE="*your*.mobileprovision" \
    *rest of your parameters*

Answer 2

This -allowProvisioningUpdates worked for me in Xcode 9 final release.

Verify You Can Build an auto-signing Xcode Project Using Xcode IDE

• 1) Open an Xcode project configured for automatically sign
  • Select target from Targets > General > Signing
  • [x] Automatically manage signing
  • Enter your team account credentials
• 2) Build the project and verify build succeeds

Close Xcode and Build project using xcodebuild with options -allowProvisioningUpdates

• 1) Add option "xcodebuild ... -allowProvisioningUpdates
• 2) When prompted, "xcode wants to access key "xcode apple id access" in your keychain"
  • Enter credentials and press button Always Allow

Now Jenkins command line builds should work.

Answer 3

I've fixed this. The problem was that I specified the team using team_id Fastlane command. You should use enable_automatic_code_signing instead. Also, configuration was not specified. Now I have this script:

    enable_automatic_code_signing(
        team_id: <YOUR_TEAM_ID_REQUIRED_HERE>,
    )
    gym(
        scheme: <YOUR_SCHEME_REQUIRED HERE>,
        configuration: <YOUR_CONFIGURATION_REQUIRED HERE>,
        export_method: "development",
        xcargs: "-allowProvisioningUpdates",
    )

Also, I'v found this page. I've tried it at the same time with changes above, so I don't know what helped me. But I've reverted the change from the page and it still works. So I assume the problem was with team_id and configuration.