Invalid code signing entitlements with app group on macOS

Question

Created Feb ’25

Replies 48

Boosts 12

Views 3.7k

Participants 26

I'm getting this error when uploading a build of my macOS app to App Store Connect. It has always worked before, and nothing changed about my use of app groups, and the iOS build uploaded without any problems. Cleaning the build folder and derived data folder doesn't help. I'm using automatically managed signing in Xcode.

Invalid code signing entitlements. Your application bundle’s signature contains code signing entitlements that aren’t supported on macOS. Specifically, the “[group.<rest of app group ID>]” value for the com.apple.security.application-groups key in “<bundle identifier>.pkg/Payload/<app name>.app/Contents/MacOS/<app name>” isn’t supported. This value should be a string or an array of strings, where each string is the “group” value or your Team ID, followed by a dot (“.”), followed by the group name. If you're using the “group” prefix, verify that the provisioning profile used to sign the app contains the com.apple.security.application-groups entitlement and its associated value(s).

Answered by DTS Engineer in 826363022

It mysteriously got resolved

App groups are more complicated than you might think. I have a bunch of backstory to this in App Groups: macOS vs iOS: Fight!.

Note that the story has changed in the last few days. I suspect that the action you took here caused Xcode to rebuild your distribution profile, resulting in a new profile that includes your app group in its allowlist.

The good news here is that, now that we fully support iOS-style app groups on macOS, we’ll see a lot fewer problems like this.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

darkpaw OP

Feb ’25

Anything on this page help? Since you say your iOS app works fine, it might be that you've got the wrong code signing identity against macOS.

0

Answer 2

Superabundant OP

Feb ’25

None of the suggestions on that page helps. These are my code signing settings, which have never changed. Screenshot 2025-02-22 at 07.59.40.png

0

Answer 3

Superabundant OP

Feb ’25

Accepted Answer

It mysteriously got resolved when I changed my code signing settings to sign manually with a local provisioning profile and then changed them back to automatic. While uploading the build to App Store Connect, I had to enter my password several times to access the certificate. This seems to be a bug in Xcode or macOS.

0

Answer 4

aehlke OP

Feb ’25

Wiping derived data, toggling code signing settings, etc. has not resolved this for me. Looks like this regressed in the past week or so.

0

Answer 5

DejiApps OP

Feb ’25

I started getting this error too even though nothing had changed for me either.

0

Answer 6

Superabundant OP

Feb ’25

These are the steps that I seem to have resolved it for me: I created a provisioning profile in my developer account, used this provisioning profile instead of the automatic signing (although it couldn't find a corresponding certificate), and then switched back to automatic signing in Xcode. I was prompted several times to enter my password, including during the archiving/uploading process, and then it finally worked when I submitted the build to App Store Connect.

1

Answer 7

Furkans70 OP

Feb ’25

Same issue here, suddenly started happening while I haven't changed anything from code signing side.

2

Answer 8

bangbae OP

Feb ’25

same here... 😭

1

Answer 9

Superabundant OP

Feb ’25

Now I'm getting this error when I try to run my app from Xcode on an iOS device:

Unable to Install “<app name>”

Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.PIDzl9/extracted/<app name>.app : 0xe8008015 (A valid provisioning profile for this executable was not found.)

Please ensure sure that your app is signed by a valid provisioning profile.

If this issue persists, please attach the following when sending a report to Apple:

- A sysdiagnose from this Mac

- A sysdiagnose from the device failing installation

- An IPA of the app failing installation

0

Answer 10

Superabundant OP

Feb ’25

And the solution to the "Unable to Install" error was to disable the App Sandbox in the build settings.

0

Answer 11

DTS Engineer OP

Apple

Feb ’25

Recommended

It mysteriously got resolved

App groups are more complicated than you might think. I have a bunch of backstory to this in App Groups: macOS vs iOS: Fight!.

Note that the story has changed in the last few days. I suspect that the action you took here caused Xcode to rebuild your distribution profile, resulting in a new profile that includes your app group in its allowlist.

The good news here is that, now that we fully support iOS-style app groups on macOS, we’ll see a lot fewer problems like this.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 12

Superabundant OP

Feb ’25

Yes, I noticed that I now no longer get the dialog about accessing files when launching my app in the development environment. I'm glad that's finally resolved.

0

Answer 13

allenu OP

Feb ’25

Were you fully able to resolve this? I am seeing the same error when uploading my macOS app to the App Store.

I'm using the iOS-style App Group ID and I can certainly resolve the issue by prefixing the App Group with my Team ID. However, this is problematic because users with existing installations of my macOS app will have their data in the Group Container folder that uses the iOS-style App Group ID.

I'm using the Xcode managed Profile for the provisioning profile and I've inspected it and it does appear that the com.apple.security.application-groups key with value group.com.XXXX exists in there. I'm not sure what else I'm missing here or if iOS-style App Group IDs just no longer works?

0

Answer 14

DTS Engineer OP

Apple

Feb ’25

With the very recent changes in the Developer website, to accommodate the changes in Xcode 15.3 beta, you should be able to resolve this by creating a new provisioning profile. I’m not sure Xcode 16.2 knows that it can fix this for you. My advice is that you manually create a profile to confirm that things are working as required. Once you’ve done that, you just need to find a way to force Xcode to create a new profile for you (-:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 15

Moleskyth OP

Feb ’25

Hi DTS Engineer,

Thanks for your input. I have a couple of questions regarding your advice:

Did you mean Xcode 16.3 beta instead of Xcode 15.3 beta?
Could you please provide a more detailed solution or workaround? I have a single app targeting iPhone, iPad, and Mac Catalyst, and when I try to upload the Mac archive, I encounter the error. Any further guidance would be greatly appreciated.

Thanks in advance!

1