Code Signing issue for Project with Multiple Targets

Question

I'm trying to get my application, which does not appear in the Dock, to have an option to launch at login. This is tricky, and involves creating a second, helper application which you add as a startup item. This helper app is only responsible for launching the main app and then exiting.

I've followed the instructions here and here and it works like a charm - the problem is, of course, code signing. I have two targets; the helper app target is copied to the Contents/Library/LoginItems subdirectory of the main bundle at compile time. Each bundle has its own bundle identifier and own deployment provisioning profile, but when I validate my archive for the app store, I get the following error:

Invalid provisioning profile. The provisioning profile included in the bundle BUNDLE NAME [BUNDLE NAME.app] is invalid. For more information, visit the Mac OS Developer Portal. 

If I remove the helper bundle from my main target, there's no problem. It looks like the presence of another provisioning profile is setting off the error.

How can I include two signed bundles and pass the validation?

Answer 1

I was finally able to resolve this problem by using codesign on a coworker's computer (there must have been something wrong with my Keychain) and deleting the embedded.provisionprofile file from the helper app by adding the following run script:

if [ -f "${BUILT_PRODUCTS_DIR}/${PRODUCT_NAME}.app/Contents/embedded.provisionprofile" ]; then     rm "${BUILT_PRODUCTS_DIR}/${PRODUCT_NAME}.app/Contents/embedded.provisionprofile"     echo "Removed embedded provisioning profile." else     echo "No profile found" fi 

Answer 2

You should use the same Mac App Store Production Certificate to sign both the helper app and the main application. I haven't tried this in Xcode — we have a helper app that's a bundle resource, but our code signing is a command line script. We didn't have any problems with the app store system.

I'm not sure why you're ending up with a provisioning profile in the built product, and I don't think this is required for app store submission. You can try using codesign manually:

codesign -f -s "3rd Party Mac Developer Application: My Company" \     -i "com.mycompany.loginitem" \     --entitlements path/to/loginitem.entitlements" \     path/to/appname.app/Contents/Library/LoginItems/loginitem.app  codesign -f -s "3rd Party Mac Developer Application: My Company" \     -i "com.mycompany.appname" \     --entitlements path/to/app.entitlements" \     path/to/appname.app