Xcode 4.3: Codesign operation failed (Check that the identity you selected is valid)

Question

After installing Xcode 4.3 I can't validate and distribute application using Organizer. While building, signing and validating in Xcode is OK, the validation in Organizer fails with the message in the title of this question.

First, Xcode 4.3 can download provisioning profiles automatically (there's an option in Organizer), but it downloads only development profiles and ignores distribution profiles as if there are none. OK, I downloaded and installed it manually and it appears in Organizer. Then I set proper Code Signing Identity both for project and for target and use Distribution profile that matches Distribution certificate in my keychain. Then I do Archive (build-sign-verify) and no errors, in the log I see green checkmarks for CodeSign and for Verify steps. Looks good and the archive appears in Organizer.

And that's where all goes wrong, I just select Validate, choose the new version I just prepared in iTunes Connect, choose correct code signing identity, same as was used for Archiving (actually, there are no other choices in my case), it asks for iTunes login/password as usual, and then says

Codesign operation failed

Check that the identity you selected is valid

Ahhh!!! Why!? It had no problems while archiving it, then same code signing doesn't work when trying to submit to AppStore. Well, not even submit, but validate before actually sending it. So this issue is local to my machine. The very same signing and validation that is successful during build, fails in Organizer...

I tried everything, re-installed Xcode, removed/revoked and re-issued all certificates, removed duplicated private and public keys from keychain, put all certificates in one "login" keychain, issued new profiles, installed Application Loader 2.5.1, and so on... still no luck.

Could it be that I have some left-over from previous Xcode installs? Or that I have to update some tools to make Organizer work properly?

Meanwhile, if anyone knows another way to upload binary to AppStore, please share. I couldn't figure out how to do that using Application Loader, when it asks me to choose a bundle to upload, all I have is xcode archive created by Xcode in Archive step. How do I get my hands on iap or whatever file the Application Loader wants from me?

Answer 1

I've discovered that Xcode 4.3.1 has a serious issue validating apps with resources within a directory tree within an application bundle.

Apps can pass validation within the Xcode "Build for Archive" process - it only fails when the validation is run via Organizer.

After spending hours trying to trace down the usual code signing entitlement issues, I eventually noticed the following line in the system console when the export fails:

3/10/12 2:32:48.450 PM [0x0-0x261261].com.apple.dt.Xcode: /Users/chris/Library/Developer/Xcode/Archives/2012-03-10/Coverage 3-10-12 2.32 PM.xcarchive/Products/Applications/Coverage.app/Tiles/T-Mobile-roam/4: Is a directory

I spent a day trying to isolate this bug, and I've finally nailed it.

The code signer in XCode 4.3.1 when validating for the App Store or saving for AdHoc distribution chokes whenever there is a subdirectory in your bundle that has the same name as its parent directory.

For example:

test/test/file.x -- FAIL test/test2/file.x -- WORKS 

This seems to be new in Xcode 4.3.1, and hopefully will be fixed soon.

Notes: This thread seems related: https://devforums.apple.com/message/630800

Answer 2

I was the original poster on the Apple Dev Forums...
https://devforums.apple.com/message/621193

I've also attempted to bring this to the attention of the AddThis developers:
https://www.addthis.com/forum/viewtopic.php?f=19&t=38292

As mentioned in the other posts, the only way I've found to prevent the code signing failure is to remove the ATResources.bundle file from the project.

Of course, this bundle contains many of the necessary images for AddThis, among other things, but the error no longer occurs.

I'm hoping this helps someone else discover the correct way to solve this issue.