xcodebuild - codesign -vvvv says"resource envelope is obsolete"

Question

I've just updated my xcode install to use xcode 6.0.1 in order to start compiling my app for ios8 devices. For some reason I am not able to ever sign the app file correctly that is generated using the following:

xcodebuild -project GrantM/GrantM.xcodeproj -configuration Release

it compiles the code and appears to be fine, but running:

/usr/bin/codesign --verify -vvvv GrantM/GrantM.app

give me:

Program /usr/bin/codesign returned 1 : [GrantM/GrantM.app: resource envelope is obsolete]
Codesign check fails : GrantM/GrantM.app: resource envelope is obsolete

checking that the code was signed at all using: /usr/bin/codesign -dv GrantM/GrantM.app

returns:

Executable=Documents/GrantM/GrantM/GrantM.app/GrantM
Identifier=com.grantapps.GrantM
Format=bundle with Mach-O universal (armv7 (16777228:0))
CodeDirectory v=20200 size=647 flags=0x0(none) hashes=23+5 location=embedded
Signature size=4336
Signed Time=24 Sep 2014 12:54:53 pm
Info.plist entries=34
TeamIdentifier=N3KKU46JLY
Sealed Resources version=2 rules=5 files=55
Internal requirements count=1 size=180

has anyone else run into similar issues on OSX 10.9.5 & xcode 6.0.1? Or am I just being a bit stupid and doing something obvious wrong?

additionally, I was able to find the debug version of the app generated in xcode and could sign that successfully, but it being a debug version it won't work for distrobution. I can't even manually sign the xcodebuild generated app file.

thanks for any help or advice in advance.

Answer 1

If you are using Mac OSX 10.9.5 or later, then there is an issue with OS codesigning with V2 signature.

So, use --no-strict flag with codesign --verify to get over this error.

If you're using PackageApplication to create an .ipa file, then

Edit the PackageApplication perl script tool using vi PackageApplication command and update codesign function occurrences to pass --no-strict parameter.

Example:

my $result = runCmd("/usr/bin/codesign", "--verify", "--no-strict", "-vvvv", , $plugin );

I was facing same and got the following response from Apple Dev Team. The issue is resolved for me.

The command line tool “codesign” has changed in 10.9.5 and 10.10, you need to pass “--no-strict” option to the command, (the problem has been reported and will be fixed). To workaround the problem, please save a copy and modify PackageApplication to pass “—no-strict” to codesign, you can locate PackageApplication by running the following: xcrun -sdk iphoneos -f PackageApplication

Answer 2

I've got a Jenkins CI system setup to provide automated builds of our iOS app from our git repo. In addition I also upload / submit a built to Crashlytics for crash log monitoring.

Everything worked fine with Xcode 6.0 GM, but since installing Xcode 6.0.1 the upload to Crashlytics fails with the same error. I'm asking for their assistance about this.

Part of my build job does use xcodebuild to generate an archive of the app, and from that I also use PackageApplication to get an .ipa file, and PackageApplication does issue the codesign command and that does NOT fail. I am using a distribution build, rather than debug too.

Here is the command I use to clean / archive the app in my job:

xcodebuild clean archive -scheme MyScheme -target MyTarget -sdk iphoneos -configuration AdHoc CODE_SIGN_IDENTITY="iPhone Distribution: MyCompany" PROVISIONING_PROFILE="UDID_Of_Provisioning_Profile"

Here is the command I use to package / get an .ipa file of the app from within the generated archive:

xcrun -sdk iphoneos PackageApplication "Path/to/MyApp.app" -o "/Path/To/MyApp.ipa" --sign "iPhone Distribution: MyCompany" --embed "Path/To/UDID_Of_Provisioning_Profile.mobileprovision"

Try modifying those to suit your setup and see if you get the same error.

Answer 3

In my case, I verified every framework and dylib I used to find out which is rejected, then resign this very framework or dylib and the whole app saved my ass.

Answer 4

Follow these steps to avoid this error.

1. Remove CFBundleResourceSpecification = ResourceRules.plist from Info.plist
2. Avoid --resource-rules in the codesign line and do the code signing.
3. Verify App: codesign --verify -vvvv Payload/*.app