Can't validate and submit an App to the Mac App Store

Question

I've done codesigning and submitting for iOS apps countless times. This time it struck me with the Mac App Store. I'm repeatedly getting the same error message:

"My Name" is a valid identity. However, you do not have the associated package identity.

I've recognized this 2 topics here on stack overflow: mas-code-signing-identity-private-key and mac-app-package-identity-not-installed

Nothing inside there solved the problem for me.

Thats how I (most reliably) reproduce this message:

1. I clean up all my certificates and private keys starting with "Mac Developer" or "3rd Party Mac Developer". Of course also the expired ones.
2. Revoking all the stuff inside the Mac certification portal.
3. Create App-ID (did it only once)
4. Create new certificate for Mac Development. I can only assume that this is comparable to the debugging certificates for iOS development.
5. Create new certificate for Mac App. Once again I can only assume that this could be something similar to a distribution certificate in iOS-development.
6. For completion reasons create a new certificate/profile for my system.
7. Create a production provisioning profile. I can only assume that this might be equivalent to an iOS distribution profile.
8. I then download all the certificate mess and install it properly. Some go into the Keychain, others got into the Preferences and XCode.
9. For making sure I restart XCode or even the whole Mac (doesn't change the frustrating outcome anyway).
10. I go to the project build settings and select the production provisioning profile, because I assume "production" is equivalent to "distribution". Changing the codesigning identity in the target build settings doesn't work either. While Apple claims in it's documentation that for App Store submission the signing identity has to be changed in the project build settings.
11. I run an archive build.
12. I select the archive in the organizer and click validate.
13. This error message appears:

"My Name" is a valid identity. However, you do not have the associated package identity.

I can't find any pointer to what the term "package identity" actually means. What is most frustrating to me is that this terminology mess in Apples documentation concerning the code signing and submission process appears not very clear and precise to me. At least not as clear and precise as the documentation for the same process concerning iOS App submission (which is using completely different terminology).

Probably I understood something wrong? Thanx for any help or pointer in advance.

Answer 1

OK, I have some important pointers (additional to Apples documentation) for people stumbling over similar issues.

1. The error message is totally misleading.
2. Don't take every word in Apples documentation too seriously.

For solving the issue, 2 points have been most significant:

1. Additional to all the other profile-mess you need 2 certificates for submission to the Mac App Store (contrary to the same process for iOS App Store submission). Both have to be installed together with their corresponding public and private key pairs.
   1. Mac App
   2. Mac Installer
2. The codesigning needs to be set on the build target, not the project. I don't remember where but this was described wrong side around in one of Apples documentations.

Eventually my submission worked by keeping to those 2 points.

Answer 2

There is an additional issue with Keychain & XCode.

When Xcode uses a certificate, they want one and only one certificate in your keychain. If you have an expired one, as well as a valid one, Xcode often fails the operation.

So you look at your keychain using Keychain Access, and do not see an expired certificate. It is still there! The default setting for Keychain Access hides expired certificates. Goto the View menu and select Show Expired Certificates. Delete all the expired ones, they are not good for anything.

Quit Keychain Acces and Relaunch Xcode. Xcode often requires a relaunch when adding/deleting certificates.

At that point, the Archive Validate process worked for me.

Answer 3

This is what it was for me as well.

Just want to clarify, you absolutely need both Mac App Distribution and Mac Installer Distribution certificates. Thanks Jacque for your explanation above. It should look like this: