Re-signing an IPA that contains a Framework

Question

I'm re-signing an iOS app (using iResign) in order to upload it to the App Store; and as part of this I'm changing the bundle ID. I only have the IPA (not the source code).

The app contains a third party framework.

The resign appears to go fine; but when I upload using Application Loader, I get the following error:

ERROR ITMS-90046: "Invalid Code Signing Entitlements. Your application bundle's signature 
contains code signing entitlements that are not supported on iOS. 
Specifically, value 'XXXXXXXXXX.COM.X.Y.Z.A' for key 'application-identifier' in 
'Payload/APPNAME.app/Frameworks/FRAMEWORKNAME.framework/FRAMEWORKNAME' is not supported. 
This value should be a string starting with your TEAMID, followed by a dot '.', followed by
the bundle identifier."

(Obviously I've changed the values shown in CAPS)

I'm assuming that the problem is that the application-identifier in my entitlements.plist matches the Bundle identifier in my app, but does not match the Bundle identifier in the framework.

Just to rule it out, I set the same Bundle identifier on the framework and the app. This did allow me to upload to the app store; but failed with an error when I tried to install the app onto an iPad.

Do I need to provide a separate entitlements file for the framework? How can I get around this issue?

UPDATE: Just to rule it out, I've tried using a wildcard provisioning profile and entitlements plist; but that gives the same error

Answer 1

You must re-sign the frameworks too.

Just open your .ipa and find the frameworks used under

Payload/MyApp.app/Frameworks

Try to sign them with command below

/usr/bin/codesign -f -s "iPhone Developer: Some Body (XXXXXXXXXX)" --entitlements entitlements.plist Payload/MyApp.app/Frameworks/*

After that re-zip it.

Additionally, lots of people got good results with AirSign.

Answer 2

Assuming you run all your regular actions like removing app signature then remove the old signature on frameworks and resign those frameworks without including the entitlements:

rm -r Payload/"$ipaExe"/Frameworks/*/_CodeSignature
codesign -f -s "$certificate" Payload/"$ipaExe"/Frameworks/*

Then sign your app itself:

codesign -f -s "$certificate" --entitlements $entitlementFile Payload/"$ipaExe"