iPhone Entitlements problem with XCode 4 for Ad Hoc distribution

Question

I have reread all the documentation and postings on Ad Hoc distribution and still have a problem. If I try 'wireless' distribution (with a .plist and .ipa file being downloaded using Safari) the app starts to download, the icon is drawn correctly and the name changes from 'Installing..' but when its about 90% complete I get an 'Unable to Download ...' alert.

If I use the iTunes method of transferring the app I get 'The app "xx" was not installed on the iPhone "xx" because the entitlements are not correct.'

Q1: I have read that you no longer need to separately add the .mobileprovision file because XCode (I am using 4.0.1) adds it to the bundle - is this true ?

Q2: when I 'download' the .mobileprovision in safari (on the iPhone) it merely displays it as text. Is this symptomatic of my problem or an irrelevancy ?

Q3: does this problem concern the Entitlements.plist ? I can't find any documentation from Apple or any blogs that relate to what I see when editing this file with XCode 4.0.1. If I follow the instructions (New->New File->Code Signing->Entitlements) I get a default file with only a 'Can be debugged' Key. I have tried setting this to NO, adding a get-task-allow Key (replacing the existing - presumably Can be debugged is the same key ?) adding my application-identifier, and adding an iPhone Entitlements Dictionary with the above two keys in (as per Apple's documentation).

Q4: what is the suicide rate amongst iPhone developers trying to get Entitlements and Code Signing working?

To cut down on suggestions I've seen for similar questions: I do have Code Signing Entitlements set to my Entitlements.plist for Distribution and Release. I have tried restarting XCode, rebuilding, archiving etc I have tried restarting the iPhone I have gone back to the iPhone

Update:In XCode 4.0.1 there is a menu option when the Entitlements.plist is being edited (Editor->Show Raw Keys and Values) which will toggle the key from 'Can be debugged' to 'get-task-allow'

Answer 1

The entitlements file should be:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
         <key>get-task-allow</key>
           <false/>
         <key>application-identifier</key>
           <string>$(AppIdentifierPrefix)$(CFBundleIdentifier)</string>
         <key>keychain-access-groups</key>
           <array>
             <string>$(AppIdentifierPrefix)$(CFBundleIdentifier)</string>
           </array>
</dict>
</plist>

this works for wireless too.
Why on earth the default one doesn't have all this in is something only Apple can answer. I can't see how to edit the raw text of a plist in Xcode so edited in TextEdit.