How to re-sign an iOS app for App Store distribution?

Question

I am trying to understand how the code signing procedure works. My goal is to take an .ipa file that was signed with Company A's Enterprise certificate, change the bundle ID and then sign again with Company B's App Store Distribution certificate and publish to the App Store.

First of all, is this even possible? I read here that "...I’m pretty sure you can’t (and shouldn’t) use this tool to resign an app with an App Store distribution certificate". Can someone elaborate on that?

I have tried many scripts like this and this and this, but after some tweaking they all seem to have the same problem when I try to send the app for review using Application Loader. The errors I'm getting there are:

• Application failed codesign verification. The signature was invalid, contains disallowed entitlements, or it was not signed with an iPhone Distribution Certificate.
• Unable to extract entitlements from /var/folders/67/(large_number)/new.ipa/Payload/original.app/original

Can anybody help me with that? Please note that I know how to do that by exporting certificates etc -- but here I'm exploring if Company B will be able to do that by themselves, if I give them Company A's .ipa file. I can explain in much more detail what I'm doing if needed - just ask.

Thanks!

EDIT: I am already aware of this closed SO question, however I posted a new one because I think mine is more specific and I'm not asking for a generic way to accomplish what I want - I only want to see if the described scenario is possible.

Answer 1

To resign a new application, which should be possible, you will need to create all new distribution profiles in the dev portal (assuming you got this far). Everything needs to match from your app to the new profile. The app ID is probably the most important thing. When you create a new one, that has to be set up in your project to match up. Usually com.companyname.appname.optional. This new app id has to be paired up in your build settings to the Bundle Identifier. Once you match those up, you should be able to pair it up with your new distro/provisioning profiles.

FWIW, swapping these profiles out has to be the most convoluted process in all of iOS development. It might take some tinkering and trial and error, but I'm certain it can be done. Good luck.

Answer 2

I've had trouble doing this before. Setting the new profile and rebuilding in Xcode seems to work, but just using the command line resigning an existing app after editing the plist with the bundle id in it was giving me grief. I suspect that it's the embedded profile that is placed into the app when it's built, but honestly, I'm not sure.

I see you were having trouble with entitlements - note that some of these are set in the dev profile (push notifications, IAP, and maybe iCloud) and have to be correct there.

Second tip is that Xcode caches the dev profile in the project (somewhere) so even if you delete one from the mobile profiles folder inside your Library folder you'll have to actually go change it in the target settings in the Xcode project or it might still use the old one (grrr).